Data Processing Addendum
Last updated /
How we handle your visitors' information, the people who contact you through your site, while we host it.
Who this is between and what it covers
This addendum is part of the Terms of Service (firstgen.dev/legal/terms) between Nexus Media LLC dba FirstGen, an Indiana limited liability company ("FirstGen", "we", "us"), and the business that keeps a site we host ("you"). It covers the personal information of the people who visit your site and send you messages through it (your "visitor data"), which we handle for you. For that data, you're the controller (under the CCPA, the "business") and we're the processor (the "service provider"). You decide what happens to it. We handle it on your behalf and on your instructions.
Your own account information (your name, email, billing details) and the public business information we used to build your site are covered by the Privacy Policy (firstgen.dev/legal/privacy), not by this addendum, because there we're the controller.
What we process
Whose data: People who visit your site, and people who send you a message through its contact form.
What data: From the contact form: name, phone number and message. From visits: pages viewed, clicks, calls tapped, scroll depth, time on page, device type and a random session id.
Why: To deliver contact-form messages to you, to count visits, and to keep your site working and secure.
How long: For as long as you're a customer and keep your site with us, then deleted as set out below.
Where: The United States, through the providers listed below.
Your instructions
We process your visitor data only on your documented instructions. These terms, your site and settings, and what you ask us to do in writing are your instructions. We'll tell you if we think an instruction breaks the law. We won't sell your visitor data, share it with another customer, use it for our own marketing, or combine it with data from other customers, except to produce numbers that can't identify anyone.
Our duties
Only the people on our team who need it to run your site can see it, and each of them is bound to keep it confidential.
We protect it with the measures on the Security (firstgen.dev/legal/security) page and in the section below.
If a visitor asks you to see, correct or delete their information, we help you answer within the time the law gives you. If they ask us directly, we pass the request to you and act on your instruction.
We help you with any data-protection assessment or regulator question that concerns our processing, as far as we reasonably can.
We keep a record of the processing we do for you and make it available on request.
We don't transfer it outside the United States without telling you first.
We meet the service-provider requirements of the CCPA and CPRA, and we'll tell you if we can no longer meet them.
Sub-processors
We use these providers to run your site. Each one handles your visitor data only to do its job for us:
Supabase: Database: stores contact-form messages and visit records. Where: United States.
Vercel: Hosting and server functions for your site and app.firstgen.dev. Where: United States.
Cloudflare: DNS and the proxy in front of firstgen.site addresses. Where: Global network.
Resend: Emails each contact-form message to you. Where: United States.
Slack: Our internal alerts channel, which receives a copy of each contact-form message so we can check delivery. Where: United States.
Microsoft Clarity: Session recordings on preview sites only, never on a live site. Where: United States.
Stripe: Payments. It receives your billing details, not your visitors' data. Where: United States.
Before we add a sub-processor that will handle your visitor data, we'll email you at least 30 days ahead. If you have a good reason to object, tell us in writing within that time and we'll work with you on a fix. If we can't find one, you can cancel without any cost. We stay responsible for every sub-processor's work.
Security measures
Everything between a visitor's browser, our servers and our providers travels over HTTPS (TLS).
The database is encrypted at rest by the provider.
Row-level security at the database, so each customer can only reach its own rows, even if the app has a bug.
Sign-in by one-time code, with no passwords, and staff access limited to a fixed list of named team members.
Stripe holds all card data. It never reaches our servers.
Secrets live in the host's environment settings, never in code or in the browser.
Backups taken by the database provider, encrypted.
A spam trap on every contact form.
If there's a breach
If we confirm that your visitor data was accessed, changed or lost without permission, we'll tell you within 72 hours of confirming it. The notice says what happened, what data and roughly how many people are affected, what we've done, and what we suggest you do. We'll keep you updated as we learn more and help you with any notices the law requires you to send. Telling you about a breach isn't an admission that we're at fault.
Audits
Once a year, on written request, we'll answer a reasonable security questionnaire and provide the documents we have that show how we meet this addendum, including our providers' own certifications and reports. If that isn't enough to meet a legal requirement, you can have an independent auditor you choose, bound to confidentiality, review the relevant parts of our processing, during business hours, with 30 days' notice, at your cost. We don't hold a SOC 2 report today.
When the service ends
When your site pauses (after you cancel, take a refund or stop paying), we keep your visitor data with it for 60 days, then delete it. When you ask us to delete your account, we delete your visitor data from our live database within 7 days and from provider backups within 30 days. Before that, ask us for a copy of your contact-form messages and we'll send it. We keep only what the law requires, as the Data Deletion (firstgen.dev/legal/data-deletion) page describes, and we confirm in writing when it's done.
Liability and precedence
The limits on what we owe each other in the Terms of Service (firstgen.dev/legal/terms) apply to this addendum too. If this addendum and the Terms of Service disagree about your visitor data, this addendum wins. This addendum is governed by the laws of the State of Indiana.
Contact
Nexus Media LLC dba FirstGen, 18948 Stonebluff Lane, Noblesville, IN 46062. Questions about this addendum, or to sign a copy: support@firstgen.dev.
