Privacy notice

Last updated 5 November 2026

Who we are

FirstSpotted, United Kingdom is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Contact: hello@firstspotted.com.

What we collect, why, and our legal basis

• Account: your email address, to log you in and send account and service messages. Basis: contract.
• Creator details: your social handle, platform, follower range, bio, optional business email, pitch and photo. We use them to verify you and to show your public profile and picks. Your profile, handle, bio, business email (if you add one) and cards are public. Basis: contract.
• Payments: Stripe handles card payments. We never see or store your full card number. We keep a record of what you paid and when. Basis: contract and legal obligation (tax records).
• Daily email: your email address, only after you confirm it. You can unsubscribe in every email. Basis: consent.
• Brand shortlist requests: company, name, work email, brief and budget, to reply and deliver the shortlist. Basis: legitimate interests and steps before a contract.
• Visit statistics: when someone views a profile or clicks a featured link, we record the time, the referring site and an identifier scrambled with a key that changes daily. This lets us count unique visitors without being able to identify you. We do not store IP addresses. Basis: legitimate interests (showing creators and brands how the site performs).
• Sponsor statistics: when a “Sponsored by” banner appears on your screen, or you click a sponsor’s link (on the site or in our email), we add one to that day’s total for the sponsor. We store only the daily totals, nothing about you, and we don’t track whether you open our emails. Basis: legitimate interests (reporting to sponsors).

Cookies

We only use cookies that the site needs to work: the login cookie that keeps you signed in. We don’t use advertising or tracking cookies, so we don’t ask for cookie consent.

Who we share it with

We don’t sell your data. We use these providers to run the site, and each one processes data only on our instructions:

• Supabase: database, login and file storage
• Netlify: website hosting
• Stripe: payments
• Resend: sending email

Some of these providers process data outside the UK, including in the United States. Where they do, they are covered by the UK’s data bridge with the US or by the UK’s approved standard contract clauses. We may also share data if the law requires it.

How long we keep it

• Account and creator details: while your account is open, then deleted within 30 days of you closing it
• Payment records: 6 years, as UK tax law requires
• Daily email address: until you unsubscribe
• Shortlist requests: 2 years after our last contact
• Visit statistics: 2 years

Your rights

You can ask to see, correct, download or delete your data, or to object to or limit how we use it. You can also withdraw consent at any time. Email hello@firstspotted.com and we will reply within one month.

If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live. We’d appreciate the chance to sort it out first.

Children

FirstSpotted is for people aged 18 and over. We don’t knowingly collect data from anyone younger.