Privacy Policy

Updated: May 15, 2026

1. Data We Collect

When you register and use FirstDay, we collect your email, user name, onboarding and step content, uploaded media, onboarding progress, employee email addresses used for links and reminders, and support messages you send to us.

2. How We Use Your Data

• To provide the service: storing onboardings and progress
• To send onboarding links via email (if you provide an email address)
• To send reminders about incomplete onboardings
• To provide technical support

3. Sub-processors

We use the following third-party services to process data:

• Vercel — web app hosting
• Railway — API hosting
• PostgreSQL via Hetzner infra — product data storage
• Mailor — transactional email delivery
• Cloudflare R2 — media file storage (USA/EU)
• GoatCounter — privacy-friendly analytics after your consent
• Google Analytics — product usage analytics after your consent
• Meta Platforms — domain verification and campaign measurement if enabled after your consent

4. Your Rights (GDPR)

If you are located in the EU or UK, you have the right to:

• Receive a copy of your data
• Correct inaccurate data
• Delete your account and all associated data
• Object to the processing of your data

To exercise these rights, contact us at privacy.infracore@outlook.com.

5. Data Retention

We retain your data until you delete your account. After deletion, all data is removed within 30 days.

6. Cookies

We use the technically necessary firstday_auth_token cookie for authentication and the ab_variant cookie to select a landing-page variant. Your consent choice is stored in localStorage as cookie-consent.

GoatCounter and Google Analytics load only after your consent. Google, Meta, or other advertising/analytics services may use their own cookies or similar technologies for analytics or campaign measurement if those integrations are enabled and you have consented.

7. Contact

For privacy inquiries: privacy.infracore@outlook.com