Privacy policy

Last updated October 3, 2026

Firstword helps businesses follow up with their leads by email and text. This policy explains what data Firstword handles, why, and the choices you have. Questions: privacy@firstword.io.

Who this covers

Our customers are businesses. When a business connects its tools to Firstword, we process its account data and the contact data in those tools on the business’s behalf. The business decides who it contacts and is responsible for having permission to contact them.

What we collect

• Account details: your name, email address and password (stored as a secure hash), or your Google name and email if you sign in with Google.
• Connected tools: access tokens for HubSpot, Quo and Gmail. These are encrypted before they’re stored.
• CRM data: contact and deal details read from your HubSpot account, used to decide who enters a sequence and to fill in fields in messages.
• Messages: the sequences, designs and messages you create, and a record of what was sent, opened, clicked or replied to.
• Usage data: basic logs (such as IP address and browser) kept to run and secure the service.

Google user data

If you connect Gmail, Firstword asks for permission to send email on your behalf. We use it only to send the sequence emails you set up, from your own address. We do not read, store or analyze the contents of your mailbox.

Firstword’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and people at Firstword do not read it unless you ask us to for support, it’s needed for security, or the law requires it.

If you sign in with Google, we receive only your name, email address and profile picture.

How we use data

• To run the sequences you set up: enrolling contacts, sending emails and texts, and stopping when someone replies or unsubscribes.
• To log sent messages on the contact’s HubSpot timeline.
• To keep the service secure, fix problems, and contact you about your account.

We never sell personal data.

Who we share it with

Only the providers that run Firstword, under contracts that limit their use of the data: Vercel (hosting), Neon (database), Upstash (caching), Resend (account emails), Google (Gmail sending and sign-in), HubSpot and Quo (the tools you connect), and Stripe (billing). We may disclose data if the law requires it.

How long we keep it

We keep data while your workspace is active. Disconnecting a tool deletes its stored access tokens straight away. Deleting your workspace deletes its data within 30 days, except where we must keep records by law.

Your choices

• Disconnect HubSpot, Quo or Gmail at any time in Firstword. You can also remove Firstword’s Gmail access at myaccount.google.com/permissions.
• Ask us to access, correct, export or delete your data: privacy@firstword.io.
• People who receive emails or texts sent with Firstword can unsubscribe through the link in any marketing email or by replying STOP to a text. They can also contact the business that sent it.

Security

Data is encrypted in transit, and connection tokens are encrypted at rest. Access to production systems is limited to the people who need it.

Changes

If we change this policy in a way that matters, we’ll email workspace owners before it takes effect.