Privacy Policy

Account information

When you create a Firstcliq account, we collect your name, email address, and (if you sign up with Google) the basic profile information Google provides.

Google Business Profile data

If you connect a Google Business Profile, we request access, via Google's OAuth consent screen, to read and reply to your reviews, view your business profile information, and post updates on your behalf. We store your reviews, review replies, and basic business listing details (name, address, category, phone, website) so we can display and manage them in your dashboard.

Your Google OAuth access and refresh tokens are encrypted at rest (AES-256-GCM) and are never exposed to your browser or any party other than our own servers.

Review page data

If you use Firstcliq's review collection page feature, we store the business details you provide (name, logo, message, Google review link) and any feedback your customers submit through that page (name, email, phone, comment).

Payment information

Billing is handled by Stripe. Firstcliq does not receive or store your full card details — Stripe processes payments directly and shares with us only what is needed to manage your subscription (plan, billing status, and similar account-level information).

Usage data

We collect standard technical information such as IP address, browser type, and pages visited, to operate and secure the service.

Analytics and advertising data (only with your consent)

If you accept analytics or marketing cookies in our cookie banner, Google Analytics, Google Ads and the Meta Pixel collect information about your visit — pages viewed, the ad that brought you, and whether you signed up, started a trial or subscribed — linked to a cookie identifier. We use this to understand how the site is used and to measure and improve our advertising. You can withdraw consent at any time from “Cookie settings” in the footer.

• •To operate your dashboard and provide the features you sign up for
• •To read your Google reviews and, where you have enabled it, generate and post replies on your behalf
• •To send you service-related emails (alerts, receipts, account notices)
• •To process payments and manage your subscription
• •To detect and prevent abuse, fraud, and security issues
• •To improve and maintain the service

We do not sell your personal information, and we do not use your Google Business Profile data for advertising purposes.

Under the GDPR and similar laws, we process personal data on these grounds:

• Contract: to provide the Firstcliq service you signed up for — your account, your Google Business Profile connection, replies, alerts and billing.
• Consent: where you give it, for example when you connect a Google Business Profile or opt in to marketing emails. You can withdraw consent at any time without affecting processing that happened before.
• Consent for analytics and advertising cookies: Google Analytics, Google Ads and Meta are used only if you accept them, and stop when you withdraw consent.
• Legitimate interests: to secure, maintain and improve the service and prevent abuse, where those interests are not overridden by your rights.
• Legal obligation: to meet legal, tax and accounting requirements.

Agencies, their clients and Firstcliq. Each party is a controller or a processor according to its actual role in deciding why and how personal data is processed. An agency is generally the controller for data it processes for its own purposes, such as its billing and business contacts. When an agency manages a client's Business Profile, the client business is often the controller of its customers' data and the agency may act on its instructions. Firstcliq acts as a processor when it handles data on behalf of an agency or its client, and as a controller for its own purposes, such as billing and account security. See section 15 of our Terms of Service.

To generate review reply drafts and analyse review sentiment, review text is sent to OpenAI's API. This data is used solely to generate the requested output for your account and is not used by us or, per OpenAI's API terms, by OpenAI to train their models.

We use the following providers to operate Firstcliq. Each processes data solely to provide their service to us:

• •Supabase — database, authentication, and file storage
• •Vercel — application hosting
• •OpenAI — AI reply generation and sentiment analysis
• •Stripe — payment processing
• •Resend — transactional email delivery
• •Trigger.dev — scheduled background jobs (e.g. review polling)
• •DataForSEO — keyword rank tracking, where enabled
• •Google — Business Profile API access, per the scopes you explicitly authorise; and, only with your cookie consent, Google Analytics and Google Ads measurement
• •Meta — only with your cookie consent: the Meta Pixel, to measure and show our ads on Instagram and Facebook

We never sell your personal data. We share it only:

• With service providers listed above, who process it only to provide their service to us.
• When the law requires it, or to protect our rights, your safety or the safety of others.
• In a business transfer, such as a merger or acquisition. You will be told of any such change.
• With your consent, where you ask us to.

Firstcliq is operated from the United Arab Emirates, and some of our providers process data in other countries, including the United States and the European Union. Where data is transferred internationally we rely on appropriate safeguards — including our providers' data processing terms and, for data from the European Economic Area, Standard Contractual Clauses where required — and data is encrypted in transit.

We retain your account and business data for as long as your account is active. If you disconnect your Google Business Profile, we stop syncing new data immediately; previously synced data is retained until you request deletion or close your account. You can request deletion of your data at any time by contacting us at the email below. Billing and invoice records are kept for up to 7 years to meet tax and accounting rules. When a retention period ends, data is securely deleted or anonymised.

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data, subject to legal exceptions
• Restrict how we use your data in certain cases
• Port your data in a structured, machine-readable format
• Object to processing based on legitimate interests or for direct marketing
• Withdraw consent at any time — including Google Business Profile access, from your dashboard settings or at myaccount.google.com/permissions
• Complain to a data protection authority

To exercise any of these rights, email privacy@firstcliq.io. We respond within 30 days.

We use industry-standard safeguards including encryption of OAuth tokens at rest, database row-level security so accounts can only access their own data, and HTTPS for all data in transit. No method of transmission or storage is 100% secure, but we work to protect your information appropriately. If a personal data breach occurs that affects you, we will notify you and the relevant authorities as the law requires — for breaches covered by the GDPR, within 72 hours of becoming aware of it.

Firstcliq uses essential cookies and browser storage to keep you signed in and remember your settings. Analytics (Google Analytics) and advertising (Google Ads, Meta) cookies are used only if you accept them in our cookie banner, and you can change that choice at any time. See our Cookie Policy for the full list.

Firstcliq is designed for businesses and is not intended for anyone under 16. We do not knowingly collect personal data from children; if we learn we have, we delete it. Contact privacy@firstcliq.io if you believe we hold a child's data.

We send marketing emails only with your consent, or where you are a customer and the email is about services similar to those you use, where the law allows. Every marketing email has an unsubscribe link, and we act on it within 48 hours. Unsubscribing does not stop service emails such as alerts, receipts and account notices.

Firstcliq's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

For individuals and businesses in the United Arab Emirates, we process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL): lawfully, fairly and transparently, limited to what is necessary for the purposes above. Cross-border transfers from the UAE follow the PDPL's requirements. UAE residents can exercise their rights by emailing privacy@firstcliq.io.

We may update this policy from time to time. Material changes will be communicated by email or an in-app notice before they take effect.

Lenawa Solutions LLC-FZ, Meydan Free Zone, Dubai, United Arab Emirates
Email: privacy@firstcliq.io