Privacy Policy
This policy explains what Firsay processes, why it is needed, and how to request access or deletion.
Data we process
- Account email, password hash, role, account status, and authentication cookie. With Google sign-in we receive your verified email and a Google account identifier only; we never see your Google password.
- Free searches without an account: a one-way hash of your IP address and the day, used only to limit free searches and new accounts per network. The raw IP address is not stored.
- API keys: only a one-way hash, a short prefix, a label, and the last-used time. The full key is shown once at creation and cannot be recovered.
- Search tasks, selected filters, provider queries, saved runs, candidate records, feedback, and outreach drafts.
- Payment invoice identifiers, selected plan, asset, amount, payment address, provider status, transaction timing, and subscription period. USDT payments are matched by reading public blockchain records (sending wallet, amount, transaction hash), which are public by nature. Firsay does not store wallet private keys or seed phrases.
- Operational metadata such as request counts, estimated provider cost, timestamps, error codes, and security events.
- Public professional information returned by configured sources, including public profiles, posts, project links, and public contact paths.
Firsay never asks for, connects to, or stores your Telegram, X, or email account login. Outreach drafts are sent by you, from your own apps: Firsay only copies the text and opens the chat.
How we use data
We use data to authenticate users, execute requested research, verify and deduplicate results, rotate previously shown candidates, save workspaces, control abuse and cost, diagnose failures, and provide support. The operator receives an automatic notification (through a private Telegram bot) when a new account is created or a payment is confirmed; it contains the account email, the plan and the amount, nothing else. We do not sell personal data and do not use advertising trackers. Visit statistics use Vercel Web Analytics, which is cookieless and does not identify individual visitors.
Service providers
Firsay may send the minimum necessary query, public-source identifiers, or payment invoice data to Vercel (hosting), Turso (database), Google (sign-in), public BNB Chain RPC nodes and TronGrid (public blockchain APIs), OxaPay, TwitterAPI.io, Tavily, Telegram, GitHub, DexScreener, and a configured language-model provider. Their processing is governed by their own terms and policies.
Retention and security
Account and workspace data is retained while the account is active and as needed for security, billing, dispute handling, and legal obligations. Candidate history is used to reduce repeated results. Free-search IP hashes are kept for up to 90 days. Payment records are kept as long as required for accounting and dispute handling. Database backups are stored privately, accessible only to the operator, and deleted automatically after 30 days. Secrets are stored server-side; passwords and API keys are stored as salted or one-way hashes. No online service can guarantee absolute security.
Your choices
You can request a copy, correction, or deletion of your account data, and revoke any API key at any time from the account menu. Some records may be retained when required for fraud prevention, security, or legal compliance. Do not submit private credentials, private messages, or sensitive personal data in a search task.
Contact
Send privacy requests to @firsayai on Telegram. Include the account email and the request type, but never send your password, API key, or session string.