Privacy notice

1. Who this covers

This notice applies to founders and company users of First Yes, people who join a corporate waitlist, and contacts we log in the desk CRM. It does not create a public people-search. Partner logins are not offered in this version of the site.

2. What we collect

When you create an account and Authorize, we collect:

• Identity: name, email, password (stored as a hash), company name.
• Dossier: structured answers about the use-case, scores, and completeness.
• Files you upload (for example safety data and test reports), with a content hash.
• Messages, offers, and activity in the founder portal and the desk.
• Technical logs needed to keep the service up (IP address, session cookie).

If a partner or buyer is logged as a record by the desk, we store organization details and named contacts the desk has a business reason to hold (name, role, email, phone, what they trial). That is operator data, not a public listing.

3. Why we use it

We use this information to:

• Create and secure your account.
• Score the use-case and show you gaps.
• Screen, package, and (only after you accept an offer) introduce a buyer.
• Operate the desk CRM, including both sides of deal flow.
• Comply with law and protect the service.

Legal bases, where a basis is required: your Authorize click (consent / contract), our legitimate interest in running a scouting desk, and legal obligation.

4. When a buyer sees anything

We do not show your package, files, or company identity to a buyer until you accept an offer in the portal. Before that, only desk operators see the dossier. We do not paste your materials into public AI models.

5. Processors

We use infrastructure providers to host the site, database, and files (currently including a cloud application host and a hosted Postgres database). They process data on our instructions. We do not sell your information.

6. Retention

Account and dossier data is kept while your account is open and for a reasonable period after, so we can show score history and honor conflicts. You may email the desk from your logged-in account to request deletion. We may retain a minimal record where we must (for example, that an introduction was declined, or as required by law).

7. Cookies

We use an httpOnly session cookie to keep you logged in. If we later add a privacy-respecting analytics tool, it will be named here. We do not run advertising pixels on this site today.

8. Your requests

You may ask for a copy of the personal data we hold, to correct it, or to delete the account. Use the logged-in desk or the contact on this site. We may need to verify it is you. If you are in a jurisdiction with additional rights (for example the EEA or California), we will honor those rights to the extent they apply to this service.

9. Children

The desk is for company users. It is not directed at children under 16.

10. Changes

We will post updates on this page with a new effective date. If we ask for a new Authorize click, the new version is stored on your account.