Last reviewed by counsel: July 2026 · Meridian Data LLC
Privacy Policy
FirstPick is built to hold as little personal data as possible. The summary below describes how that works in plain terms.
1. What we collect
We collect the minimum we need to run the service: your account email, the business details you enter (such as business name and locations), and publicly available data about how AI assistants describe your business. We also ask one optional question in your account settings: how you first heard about FirstPick, picked from a short fixed list. You can clear it at any time, and it changes nothing about your account. That is the scope. We do not ask for more than this.
We also collect and process publicly available information about local businesses, including businesses that are not our customers, from AI assistant answers and public web pages. We use this information to measure how visible businesses are in AI answers and to build our reports. Where a business is a sole proprietorship, its business name can identify a person; in that case, the rights described in this policy apply to that information.
Cookies: we use only essential cookies, and only when you sign in. A session cookie keeps you signed in to your dashboard; visitors who never sign in get no cookies from us. We set no advertising or analytics cookies. The cookie policy has the full detail.
2. No treatment or patient data
FirstPick is designed not to collect treatment records, patient identities, protected health information, or private customer data. We do not ingest, request, or store any of it. Review-reply copy we generate never references a specific treatment or patient detail. If you operate a regulated practice, you should not send us that data, and our product is built so you do not need to.
Washington state: FirstPick does not collect consumer health data, Washington users are geofenced from the Service, and the Service is designed not to collect health data. Meridian Data LLC does not represent that Washington's My Health My Data Act applies to the Service.
3. We never access your systems
We do not connect to your website, booking tool, CRM, point-of-sale, email, or phone systems, and we do not hold credentials for any of them. Our findings come from public sources and the information you choose to enter.
4. We do not sell your data
We do not sell, rent, or trade your personal data. We use the data you give us only to deliver and improve the reports, memos, and draft copy you signed up for, to communicate with you about your account, and, if you answer the optional question described above, to check which of our own marketing efforts actually reached you.
We do combine our customers' scan results into de-identified, aggregated benchmarks and analytics that describe markets rather than any one business, and we minimize identifiable data before storage. Our lawful basis for processing publicly available business information is our legitimate interest in providing market intelligence about businesses to other businesses, balanced against the rights and interests of the people concerned.
5. Service providers
We rely on a small number of vendors to run the service. They process data only to provide their service to us, and each is bound by its own contractual and privacy obligations. The categories we use are: cloud hosting and content delivery (Vercel), database and authentication (Supabase), payment processing (Stripe), email delivery (Resend), licensed search and AI-answer data (DataForSEO and Cloro), business listing lookup used to identify a business and its location (Google Places), AI text processing to build your reports (Anthropic), bot protection on our public forms (Cloudflare), and error monitoring (Sentry). If a category changes, we update this page.
The business listing lookup is the one that receives a street address. When we identify a business, we send its name and address to Google Places to match it to a listing, so that we are measuring the right business rather than one with a similar name in another city.
6. Email and CAN-SPAM
FirstPick is a push product: most of the value arrives as an email memo. Any marketing email we send will identify us clearly, include our physical mailing address, and give you a working one-click way to unsubscribe. Account and transactional messages (such as billing receipts) are separate from marketing and are sent as part of providing the service.
7. Your choices
You can ask us what account data we hold, ask us to correct it, or ask us to delete it, subject to any records we are required to keep. To make a request, email firstpick-privacy@appgild.ai from your account email and say what you need: access, correction, or deletion. We confirm we received your request within 5 business days and complete verified requests within 30 days. If a record must be kept for billing, tax, or legal reasons, we tell you which one and why.
These choices are not limited to customers. Any business, whether or not it uses FirstPick, can object to or request removal of data we hold about it by emailing firstpick-privacy@appgild.ai. The same timelines apply: we confirm receipt within 5 business days and complete verified requests within 30 days. When a business that is not a customer objects, we honor the objection by adding that business to our permanent do-not-contact list, which is checked before any outreach message is sent.
8. Contact
For any privacy question, email firstpick-privacy@appgild.ai. You can also write to us at 522 W Riverside Ave Ste N, Spokane, WA 99201. The same address appears in the footer of any marketing email we send.