Privacy Policy

Last updated: 15 October 2026

This policy explains how information is processed when you visit or use the FirmCourier service.

1. Privacy contact

For privacy questions and requests about personal information processed through FirmCourier, contact info@firmcourier.com. Do not send full payment-card details or account passwords by email.

2. Information we process

• Account and profile: name, email, date of birth, country, optional company and role, business profile and onboarding answers; password hashes or a Google account identifier; verification and account status.
• Business research and memory: prompts and instructions, business focus and criteria, company records and sources, research results, qualification/history, notes, contacts, opportunity information and saved preferences.
• Campaigns and workflows: campaign configuration, intended recipients, contact and permission/exclusion status, message drafts, approvals, workflow settings and execution/audit status. Campaign data is not the same as permission to send; sending remains subject to service controls.
• Authentication and security: hashed session-token records, session expiry, IP address and user-agent information recorded with sessions, password-reset/email-verification tokens in hashed form, two-step-verification material and security events.
• Contact and support: the name, reply email, optional company, inquiry category, subject, message, ticket reference, status and correspondence you submit or receive. We process contact-form submissions and associated contact information to respond to support requests and maintain support history.
• Gmail connection, if you choose to connect Gmail: Google account email, granted-scope names, token expiry/status and OAuth access/refresh tokens. Tokens are encrypted at rest by the application. The connection requests openid, email and https://www.googleapis.com/auth/gmail.send.

3. Google sign-in and Gmail are separate

Google sign-in requests only the identity scopes openid, email and profile, and uses the returned identity to authenticate your account. It is separate from an optional Gmail connection.

The Gmail connection requests openid, email and Gmail send permission (https://www.googleapis.com/auth/gmail.send). The current integration uses Google user-info to identify the connected account and retains credentials needed for Gmail API access. It does not request Gmail message-reading or inbox-reading scopes and does not read Gmail messages. The send scope permits sending through Gmail when sending is enabled; sending availability depends on the service and account configuration.

OAuth tokens are encrypted at rest using authenticated AES-256-GCM encryption and are used server-side. They are not returned to the browser as connection records. You can disconnect an account in the Service; disconnection deletes the stored access and refresh tokens from the connection record.

4. Purposes and legal bases

• Provide accounts, business profiles, search, research, saved company information, workflows and account support: steps to provide the requested service or perform a contract.
• Authenticate users, prevent abuse, maintain availability, protect accounts and diagnose failures: legitimate interests in operating a secure service, balanced against your rights.
• Use Google sign-in or connect Gmail: your choice and the requested service functionality; Google also processes data under its own terms and privacy policy.
• Answer contact requests and maintain support tickets and correspondence: steps requested by you and our legitimate interest in responding and keeping a support history; consent is used where the form asks for it.
• Meet accounting, legal and regulatory duties: compliance with legal obligations when they apply.
• Optional marketing or non-essential analytics: consent where required. We do not currently load third-party analytics or advertising tools on the public pages.

5. AI and other service providers

When AI-assisted features are used, relevant prompts, business profile/context, and research material may be sent to OpenAI to generate responses, conduct research or prepare outputs. Do not submit information you are not authorised to share. OpenAI processes such data under its applicable service terms and configuration; its processing and retention are also governed by its own policies.

The application uses PostgreSQL and Redis and may be hosted on third-party infrastructure. Depending on configuration and the function used, transactional email may be sent through Brevo or Resend; Google processes sign-in and Gmail OAuth requests; OpenAI processes AI requests; and Stripe processes checkout and subscription billing when enabled for an authorized test account. Stripe-hosted Checkout receives payment details; the application does not receive or store full card numbers. Only information needed for the relevant function is sent to these providers. We do not claim a security certification.

6. Sharing and international transfers

We do not sell personal data. We share information with service providers only as needed to operate features you use, protect the Service or meet legal obligations. Providers may process information in countries outside Slovenia or the European Economic Area. The provider and processing location depend on the feature and the provider configured; where a transfer outside the EEA occurs, it must use a transfer mechanism permitted by applicable data-protection law. We do not claim that a particular Standard Contractual Clause arrangement or certification applies to every provider.

7. Retention

We retain account, profile, company, research and workflow records while needed to provide the Service and administer your account. There is currently no self-service account-deletion control; you can request account and data deletion by emailing us, and we may need to verify your identity and retain limited records where required by law or needed to resolve a request or protect the Service. Session records expire after the configured session period (up to 12 hours for a non-remembered session or 30 days for a remembered session, subject to renewal while in use). Reset and verification tokens have shorter expiry periods. Support, security and transaction-related records may be kept as needed to resolve requests, protect the Service or satisfy legal obligations. We do not state a fixed deletion interval for records where the system has no defined automatic retention schedule.

8. Your rights and choices

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and withdraw consent where processing relies on consent. You may also complain to the Slovenian Information Commissioner or another competent supervisory authority. To make a privacy request, email info@firmcourier.com. We may need to verify your identity before acting.

9. Cookies and session technologies

The Service uses necessary browser cookies for session authentication and short-lived OAuth/security flows, with HttpOnly and SameSite attributes; secure cookies are used over HTTPS. The public site uses browser storage to remember that the cookie notice was acknowledged, support short-lived sign-in and onboarding flows, and retain a temporary contact-form submission key so a retry does not create a duplicate ticket. The cookie notice is informational; it does not provide an optional tracking-consent control. No third-party analytics or advertising trackers are loaded by the public-site source. Browser settings can remove or block storage, although sign-in and other functions may then stop working.

10. Security

Measures visible in the implementation include hashed passwords and session tokens, encrypted Gmail OAuth tokens, secure/HttpOnly/SameSite session cookies, access checks and optional two-step verification. Production is configured to require an encryption key for email tokens and uses HTTPS at the public deployment. No method of transmission or storage is perfectly secure, and we do not claim certification.

11. Children and policy updates

FirmCourier is intended for adults aged 18 and over and is not directed to children. We may update this policy as the Service or legal requirements change. The current version and update date will be published here; we will provide additional notice where required.

12. Contact

Additional privacy contact: michael.jobmail5@gmail.com