What we collect.
What we do not.

01

The short version

02

Information we handle

When you browse

Vercel, our hosting and serverless provider, and the network services used to deliver the site may process technical request information such as an IP address, request time, requested path, browser or device headers, referral information, and security or diagnostic events. The typefaces used on this site are served from this site itself; your browser does not request fonts from a third-party host.

FirstFold's own event endpoint can record a fixed event name, one of five page categories, an optional fixed action or outcome, a coarse viewport category, and whether reduced motion is requested. It does not accept the address you scan, an email address, a referrer, free text, a cookie ID, or another persistent visitor identifier. The hosting layer still receives ordinary request information. A keyed, one-way connection digest is used only for abuse limiting and is not stored with the event row.

When you run the website analysis

We receive the website address you submit. The checker retrieves the final public homepage and the public robots.txt, llms.txt, and sitemap.xml responses within defined redirect, time, and size limits. It sends the verified public homepage address to Google PageSpeed Insights for phone and desktop rendering, which can execute the public page's JavaScript and return automated measurements and rendered screenshots. If the optional visual-review layer is enabled, the two bounded screenshots are sent to Google's Gemini service with provider-side interaction storage disabled. Screenshots are held only long enough to complete the request and are not placed in the public report, report reference, database, or email. The checker does not crawl private pages or retain the fetched raw HTML.

For abuse prevention, the application creates a keyed, one-way digest from the connection address and stores the digest with a rate-limit scope, time window, and request count. The application does not put the raw address in the analysis report-request record. Expired rate-limit entries are removed after approximately two days, although our host may retain its own request and security logs under its policies.

A completed scan can produce an encrypted report reference in your browser. That reference contains the server-produced report and a random scan identifier and normally expires within 30 minutes. Until you request email delivery, the application does not create a report-request record in our database.

When you request the complete report by email

We collect the email address you enter and store it with the submitted site URL, server-produced report, random scan identifier, request time, and email-delivery state. Delivery metadata may include a provider message identifier or a limited error code. Resend receives the destination address and report content so it can send the one-time transactional message.

When you contact, book, or pay

If you email us, we receive your address, message, attachments, and related correspondence. If you use the Google Calendar booking link, Google collects the scheduling details you submit and shares the appointment information needed for FirstFold to hold the call. If you start a Stripe-hosted payment, Stripe collects payment and identity information directly. FirstFold receives limited customer, transaction, amount, status, tax, refund, dispute, and provider-reference information needed to administer the payment; we do not receive or store your full card or bank-account number.

03

Why we use information

• to deliver the website, run the website analysis, display results, and send a report you request;
• to respond to questions, schedule calls, prepare proposals, and administer a client relationship;
• to process and reconcile payments, refunds, disputes, and required business records;
• to prevent abuse, protect the service, diagnose failures, and enforce our Website Terms;
• to meet legal, accounting, tax, security, and dispute-resolution obligations; and
• to evaluate the service using aggregated or de-identified operational information.

We do not sell or rent personal information. We do not use an analysis report request to add you to a marketing list.

04

Service providers and disclosures

We disclose only the information reasonably needed for a provider to perform its role, or when disclosure is required by law, needed to protect rights and safety, or directed by you. Our current website workflow uses:

Vercel

Website hosting, serverless processing, request delivery, and operational or security logs.

Supabase

Database storage for selected cookie-free operational events and for a requested analysis report and its delivery record.

Resend

Delivery of the one-time report email, including its destination and content.

Google

PageSpeed Insights phone and desktop rendering; optional Gemini screenshot review with interaction storage disabled; Google Workspace email; and Google Calendar scheduling when you choose the booking link.

Stripe

Payment, billing, tax, fraud-prevention, refund, and dispute processing when a payment flow is offered and used.

Linked portfolio sites and other external pages are operated under their own terms and privacy notices. We may also disclose information in a reorganization or transfer of the business, subject to appropriate confidentiality and legal requirements.

05

Processing outside Canada

FirstFold is based in Ontario, but several providers above operate in the United States and other countries. Personal information may therefore be processed outside Canada, where it can be subject to the laws and lawful access procedures of the place where it is held. FirstFold remains accountable for information transferred to processors and uses provider agreements and other appropriate measures to require protection, but protections can differ from those available in Canada.

Write to our privacy contact if you want information about the providers relevant to your request or transaction.

06

How long we keep it

• Fetched site content: processed in memory for the scan and not retained as raw HTML or a screenshot.
• Browser-held scan reference: normally expires within 30 minutes.
• Application rate-limit entries: expired entries are removed after approximately two days.
• Cookie-free operational events: coarse event rows are removed no later than 90 days after collection; longer-lived reporting uses aggregated counts without a visitor identifier.
• Emailed report requests: email address, site URL, report, and delivery record are retained for no more than 90 days.
• Contact, booking, project, and payment records: retained only while needed for the relationship, security, dispute handling, and applicable legal, accounting, or tax requirements. Required transaction records may be kept longer than ordinary correspondence.

Backups and provider systems may take additional time to cycle after deletion. We may retain a minimal record needed to honour an unsubscribe, legal hold, fraud-prevention need, or other obligation.

07

Access, correction, deletion, and consent

You may ask whether we hold personal information about you, request access to it, ask us to correct inaccurate or incomplete information, or request deletion. You may also withdraw consent for a use that depends on consent, subject to reasonable notice and any legal or contractual restriction. Withdrawing consent can prevent us from completing the related request.

Email info@firstfoldstudio.com with the subject “Privacy request.” Describe the information or interaction involved. We may take reasonable steps to verify identity before disclosing or changing records. If we cannot fulfill all or part of a request, we will explain the reason unless the law prevents us from doing so.

08

Safeguards

We use safeguards proportionate to the information involved, including encrypted network connections, server-side credentials, restricted provider access, bounded inputs, rate limits, and separation between public pages and server-only operations. No internet transmission or storage system is perfectly secure. If an incident affecting personal information occurs, we will assess it and make records, reports, and notifications where required.

09

Cookies and analytics

The public site does not install a FirstFold advertising pixel, behavioural analytics platform, marketing cookie, or persistent visitor identifier. The cookie-free first-party event flow described above measures only selected operational steps. Hosting and security systems may use request logs and essential technical mechanisms. Google and other services you choose to open — such as Calendar or Stripe — may use cookies or similar technologies under their own notices.

If FirstFold adds non-essential analytics, advertising technology, or new cookie-based features, we will update this notice and provide choices where required before treating the new use as active.

10

Changes to this notice

We may update this notice when the website, providers, or legal requirements change. The effective date at the top will show the latest version. If a change materially affects how existing personal information is used, we will provide additional notice or seek consent where required.