Privacy Policy
Last updated /
What FirstGen collects to build, show and host websites for local businesses, why, who handles it for us, and what you can ask us to do.
Who this covers
This policy is from Nexus Media LLC dba FirstGen, an Indiana limited liability company ("FirstGen", "we", "us"). It explains what we collect through firstgen.dev, the app and dashboard at app.firstgen.dev, the sites we build and host at {name}.firstgen.site and on customers' own domains, and the emails we send, and what you can do about it.
It covers four groups of people:
Visitors to firstgen.dev, including anyone who opens a link from one of our emails.
Business owners whose public business information we used to build a preview website, and whom we may have emailed about it.
Customers: owners who keep a site we built, and sign in to the dashboard to edit it.
Visitors to the sites we host, including people who send a message through a site's contact form. The business is in charge of those messages. We handle them on its behalf under our Data Processing Addendum (firstgen.dev/legal/dpa).
What we collect on firstgen.dev
Links from our emails. A link in one of our emails can carry a first name, business name, trade, city and website address so the page greets you by name. We keep those five things, and nothing else, in a first-party session cookie named fg_visitor. We set it, only we read it, and it expires when you close your browser. Pages personalized this way are marked so search engines don't index them. The Cookie Policy (firstgen.dev/legal/cookies) has the details.
The Ask box. If you type a question into the Ask box, we send your question and the page you're on to Anthropic so its model can answer from what's on our site. We don't store the conversation.
Building and buying happen in the app. The "Build mine" form, checkout and sign-in live at app.firstgen.dev, covered in the next section. firstgen.dev itself has no sign-up form.
Analytics. There are no advertising cookies and no advertising pixels on the marketing site.
Server logs. Our host keeps short-lived logs of requests (internet address, browser, page requested, time) to keep the site running and to stop abuse.
What we collect in the app and dashboard
Build mine. When you ask us to build a site, you give us a business name and city or a Google Maps link. We look the business up and build a preview from its public information, as described under "Public business information" below.
Checkout. Stripe collects your name, email, billing address and card on its checkout page. At checkout you also confirm you own or are authorized to represent the business. We receive a Stripe customer reference, your email, your subscription status and billing dates. The full card number never reaches our servers.
Signing in. You sign in with your email address and a one-time code or link we email you. There's no password to store.
Your site and your edits. The content of your site (business name, services, hours, phone, address, about text, reviews, photos and any extra pages), every change you ask for in the dashboard chat with our reply, your custom domain, and messages you send us from the Help page.
How you use the app. Our own first-party tracker records page views, clicks, scroll depth, form starts and time on page in the app and dashboard, tied to a random session id and, if you came from one of our emails, to the link's token. We use it to see where people get stuck and to fix it.
Visitors to the sites we host
Contact forms. When someone sends a message through a site's contact form, we receive their name, phone number and message. We store it, email it to the business owner if the site is live, and post it to our internal alerts channel so we can make sure it was delivered.
Visit counts and activity. On every site we host, our first-party tracker records page views, clicks, calls tapped, scroll depth and time on page. On preview sites at firstgen.site, we also set a cookie so a visit is counted once, and we may record sessions with Microsoft Clarity, which captures how the page is used with typed text masked.
The business owns its visitors' messages. We handle them only to run the site, deliver messages to the owner and keep the service working. We never sell them or use them to market to the visitor ourselves. To see or delete a message you sent, contact the business, or email support@firstgen.dev and we'll help.
How we use it
To build a preview website for a local business from its public information.
To tell the business owner the preview exists, and to follow up a few times unless they ask us to stop.
To host the site, connect a custom domain, and make the changes a customer asks for.
To bill the subscription through Stripe and send billing, payment-failed and sign-in emails.
To deliver contact-form messages from a site to its owner.
To answer support requests, sent by email or from the dashboard's Help page.
To keep the sites, the app and the dashboard secure, to find and fix problems, and to meet our legal duties.
We don't sell personal information, and we never have. We don't share it for other companies' advertising, and we don't run advertising pixels on any site we host.
Public business information
To build a preview, we gather information a business has made public: its Google Maps listing (name, address, phone, hours, category, photos, rating and recent reviews), its own website, and the public Facebook and Instagram pages linked from them. We check its website's speed and mobile layout with Google's PageSpeed Insights.
Reviews on a site are quoted from the business's public Google Business Profile, with the reviewer's public name, and attributed to Google. We never write or alter reviews.
Photos come from the public listing or website, or from the owner. Any photo can be removed on request.
We may read names that reviewers mention (like the owner's first name) to make our email to the owner more personal.
A preview isn't indexed by search engines. If you're the owner and want a preview taken down, email support@firstgen.dev and we'll delete it.
Emails we send to businesses
When we build a preview for a business that didn't ask for one, we may email the business to tell them it exists. We only use an email address published by the business itself: on its website, its listing, or its own Facebook or Instagram page. We check the address is deliverable with MillionVerifier before sending, and send through Instantly. The link in the email carries a token so we know which preview was opened. We don't email businesses that asked for a preview themselves through "Build mine".
To stop. Reply to any of our emails saying so, or write to support@firstgen.dev. We stop the sequence, add the address to our do-not-contact list, and delete the preview if you ask. We keep the address on that list only so we never email it again.
AI features
We use Anthropic's model to draft a site's text from the business's public information, to write the short personal part of our emails to owners, to sort replies to those emails (interested, not interested, stop), to apply the changes a customer asks for in the dashboard chat, and to answer questions in the Ask box. Anthropic doesn't train on what we send through its API, and neither do we. The AI Terms (firstgen.dev/legal/ai-terms) have the full description.
Text messages (SMS)
FirstGen Texts is our text message program. We only text you if you ask us to: for example by ticking the box to get texts on the free preview form. It is never required, and you can buy without it.
What we collect through texts: your mobile number, that you agreed to get texts, when you agreed and the exact wording you agreed to, the texts we send you, and any replies you send us (including STOP and HELP).
What we text about: the website preview links you asked for, callback reminders, account and billing notices, and replies to your support questions. Message frequency varies. Msg & data rates may apply.
How to stop: reply STOP to any of our texts and we stop texting that number right away (you get one last text confirming it). Reply HELP for help, or email support@firstgen.dev. You can also ask us to stop by email.
We do not sell, rent, or share your mobile phone number or SMS opt-in consent with any third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties.
The full terms of the program are in our SMS Terms.
Who handles it for us
We share information only with the providers that run parts of the service for us, under their terms that limit what they can do with it:
Vercel: Hosts firstgen.dev, app.firstgen.dev and the sites we build. What it receives: Requests to those sites and their logs.
Supabase: Database and sign-in. What it receives: Accounts, site content, edits, messages and activity.
Cloudflare: DNS for firstgen.dev and firstgen.site, and the proxy in front of hosted sites. What it receives: Requests to hosted sites.
Stripe: Checkout, subscriptions, invoices and refunds. What it receives: Billing name, email, address and card.
Resend: Sends sign-in, billing and contact-form emails. What it receives: Recipient email and the message.
Twilio: Sends and receives our text messages (FirstGen Texts). What it receives: Your mobile number and the messages. It may not use them for its own marketing.
Anthropic: The model behind site copy, chat edits, email lines, reply sorting and the Ask box. What it receives: Only what each task needs.
Outscraper: Looks up public Google Maps listings and reviews. What it receives: A business name and city.
Apify: Reads public Facebook and Instagram business pages. What it receives: A public page address.
Google PageSpeed Insights: Tests a business website's speed. What it receives: A public website address.
MillionVerifier: Checks an email address is deliverable. What it receives: The business email address.
Instantly: Sends our emails to business owners and receives replies. What it receives: Business name, email and preview link.
Attio: Our customer list, for support. What it receives: Customer email, business name, site address and status.
Slack: Internal alerts to our team. What it receives: Help requests, contact-form messages and replies to our emails.
Microsoft Clarity: Session recordings on preview sites. What it receives: How a preview page is used, with typed text masked.
We may also share information when the law requires it, to protect someone's safety or our rights, or as part of a sale or merger of the business, in which case this policy keeps applying to it.
How long we keep it
Customers: while you're a customer. A paused site (cancelled, refunded or unpaid) and its content stay saved for 60 days so you can come back, then we delete them.
Deleted accounts, sites and previews: removed from our live database within 7 days of a confirmed request, and from provider backups within 30 days.
Invoices and payment records: 7 years, as tax law requires. Stripe keeps its own records under its own policy.
Contact-form messages: as long as the business keeps its site, or until the business or the sender asks us to delete them.
Previews and the public information behind them: a preview link is held 14 days, then taken down. Sooner if the owner asks us to delete it.
The do-not-contact list: for as long as we send email, so we never email that address again.
Your rights and choices
We're a United States company and our customers are in the United States. If you live in California, the CCPA and CPRA give you specific rights. If you live somewhere with similar law, you have similar rights. We honor them for everyone, wherever you live:
To know what personal information we have about you and where it came from.
To get a copy of it in a usable format.
To correct it.
To have it deleted, subject to what we have to keep for tax or legal reasons.
To opt out of the sale or sharing of personal information. We don't sell or share it, so there's nothing to opt out of.
To limit the use of sensitive personal information. We don't collect any.
Not to be treated differently for using these rights.
To use any of them, email support@firstgen.dev from the email address we know you by, or use the Help page in your dashboard. We'll confirm it's you, then answer within 30 days. You can have someone ask on your behalf if they can show you authorized them. Site visitors should ask the business first, as explained above.
Email. You can stop our emails to your business at any time by replying or writing to us. Sign-in, billing and payment-failed emails still go out while you have an account, because the service needs them.
Children
FirstGen is a service for businesses. We don't serve anyone under 18, and we don't knowingly collect information from anyone under 18. If you think we have, email support@firstgen.dev and we'll delete it.
Security
Everything between your browser and us travels over HTTPS. Each customer's rows are fenced at the database with row-level security, there are no passwords to steal, and Stripe holds card data so we don't have to. The Security (firstgen.dev/legal/security) page lists what we do and how to report a problem. No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.
Changes to this policy
When what we do changes, we'll update this page and the date at the top. If a change matters to customers, we'll email them before it takes effect.
Contact
Nexus Media LLC dba FirstGen, 18948 Stonebluff Lane, Noblesville, IN 46062. For any privacy question or request, or anything else, email support@firstgen.dev.
This policy is governed by the laws of the State of Indiana.
