Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including:

• Account information (name, email address, password)
• City or general location (geocoded from your device or derived from your shipping address)
• Proof submitted to establish Day 1 fan status (e.g., receipts, tickets, screenshots)
• Payment and billing information (processed via our third-party payment processor)
• Shipping address and contact information for fulfillment
• Communications you send to us

We also automatically collect certain information when you use the Service, such as device information, IP address, and usage data, through cookies and similar technologies (see Section 7).

2. How We Use Your Information

We use your information to:

• Operate, maintain, and improve the Service
• Verify Day 1 fan status and process submissions
• Process purchases and coordinate fulfillment
• Communicate with you about your account, orders, or verification status
• Detect and prevent fraud, abuse, or security issues
• Understand how fans engage with campaigns, in aggregate, to improve the platform

3. How We Share Your Information

We share your information in the following circumstances:

• With partnering artists' teams, as follows:
  • If your submission is verified as a Day 1 fan, we share your name, city, and proof submission with the partnering artist's team as a standard part of the verification service. This allows the artist to see and recognize their verified Day 1 fan community.
  • We only share your email address with the partnering artist's team if you separately opt in to receive marketing or promotional communications from that artist. This is a distinct, optional choice, separate from the verification process itself. Consent to marketing is never a condition of verification or purchase — choosing not to opt in has no effect on your Day 1 fan status or ability to buy from a drop. If you do not opt in, your email address is not shared with the artist's team.
  • If your submission is pending or not verified (rejected), we do not share your name, city, email, or proof submission with the artist's team.
  • If you opted into marketing and later wish to stop receiving communications from a specific artist, you will need to contact that artist's team directly, as firstfan does not control communications sent outside our platform.
• With service providers who help us operate the Service, including Stripe (payment processing), Printful and Printify (order production and fulfillment), Resend (transactional email), and Google Cloud Platform (data storage and infrastructure). These providers process your information on our behalf, under contractual protections, only as needed to provide the Service.
• When required by law, or to protect the rights, safety, or property of firstfan, our users, or others
• In connection with a business transaction, such as a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

4. Data Security

We use reasonable technical and organizational measures to protect your information. However, no method of storage or transmission over the internet is completely secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your information as described in Section 6 below, subject to legal and operational limitations.

6. Your Privacy Rights

Depending on your location, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your information
• Object to or restrict certain processing
• Request a copy of your data (data portability)
• Withdraw consent, where processing is based on consent

To exercise any of these rights, contact us at info@firstfan.app.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and equivalent UK legislation, including the right to access, correct, and erase your personal data, restrict or object to our processing, request data portability, and lodge a complaint with your local data protection authority. Where we rely on your consent to process your data (such as for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before your withdrawal.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service and understand usage patterns. You can control cookies through your browser settings; disabling cookies may limit some features of the Service.

8. Third-Party Links and Services

The Service may link to or integrate with third-party websites or services (such as our payment processor). We are not responsible for the privacy practices of those third parties, and we encourage you to review their policies separately.

9. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can address it.

10. International Data Transfers

Your information may be processed or stored in the United States or other jurisdictions with data protection laws that differ from those in your location. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the "Last updated" date. Material changes will be communicated with reasonable notice where required by law.