Privacy policy.

firstreactions is a product of NeighborhoodConnect Ltd, a company registered in England and Wales (company number 17051993). Registered office: 128 City Road, London, EC1V 2NX.

Data controller contact: hello@firstreactions.app.

From creators: name, email, workspace name, uploaded content (audio, video, image, or text), audience filter selections, batch history, payment method details (processed by Revolut Merchant — we don’t see full card numbers).

From reactors: ID verification data (age, identity), self-declared taste and demographic tags, recorded reaction videos, verbal transcripts, consent records for each session.

From visitors: basic analytics (page views, referrer, device type) and functional cookies. See our Cookies page for details.

Creator data powers your account, delivers your reports, and processes your billing. Reactor data powers the batches you commission and builds the analytics you receive. We do not sell personal data to third parties, ever.

Aggregated, anonymised trends (e.g. “average sentiment across batches this month”) may be used internally to improve the product.

Creator accounts and batches are kept while your account is active. On account closure we delete personal data within 30 days, subject to any legal retention obligations (e.g. tax invoices, 7 years).

Reaction videos are stored on hot infrastructure for 30 days after delivery, moved to cheaper “nearline” storage from 30 – 90 days, and to cold storage after 90 days. All reactor videos are automatically deleted after 2 years unless you explicitly request longer retention for a specific commercial use.

We use the following sub-processors to run the service. Each has been assessed for adequate safeguards under UK GDPR:

• Google Cloud (Firebase, Vertex AI)— hosting, database, authentication, and AI analysis of reactor recordings. Data processed in the US and EU regions.
• Revolut Merchant— payment processing (subscriptions, cards, invoicing). Card data never touches our servers.
• Prolific— recruits reactors from their verified participant pool. Prolific handles reactor identity verification and payment.
• Resend— transactional email delivery (notifications, receipts, team invites).
• PostHog— product analytics (events, page views, session replays for debugging — masked for sensitive inputs).
• Vercel— frontend hosting for the marketing site, dashboard, and reactor recording pages.

Reactors provide explicit informed consent before recording. Their consent covers: the specific creator’s use of the reaction video for creative and promotional purposes, storage duration, and automated AI analysis of the recording. Reactors can request deletion or anonymisation of their submission at any time via the data controller contact above.

Under UK GDPR you have the right to access, correct, delete, port, or restrict processing of your personal data. Email hello@firstreactions.app with any request and we’ll respond within 30 days.

If you’re unsatisfied you can complain to the UK Information Commissioner’s Office at ico.org.uk.

Primary hosting is in the EU/UK (Ireland region for email; us-central1 for backend functions on Firebase). Some sub-processors (Vertex AI, PostHog) may process data in the US under standard contractual clauses. We use only providers with adequate safeguards.

If we make material changes we’ll email account holders and update the “Last updated” date above.