Skip to content
FirstAsk

Privacy Policy

Effective 6 September 2026 · Version 2.0 · Operated by Brewcode LLC

Who we are

This Privacy Policy explains how Brewcode LLC ("Brewcode", "FirstAsk", "we", "us" or "our") collects, uses, discloses and protects personal information when you use the FirstAsk website, web application, deliveries, API and related services (collectively, the "Service"). FirstAsk is a product of Brewcode LLC, a Delaware limited liability company and a subsidiary of Brewcode Technologies Private Limited (India). Brewcode LLC is the data controller for personal information processed through the Service. By using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

Data controller: Brewcode LLC, 1130 Ogletown Road, PMB # 1857, Suite 2, Newark, Delaware 19711, USA — a subsidiary of Brewcode Technologies Private Limited, #198, CMH Road, 2nd Floor, Desk No. 269, Indiranagar, Bangalore, India – 560038. Contact: [email protected].

This Policy covers two groups of people: Subscribers, who create accounts and use the Service, and Posters, whose public requests for services we index. Section 3 is written specifically for Posters.

1. Information we collect from Subscribers

  • Account information: name, email address, organisation, timezone, password (stored only as a salted hash), the time and IP address at which you accepted these terms, and any profile details you add.
  • Configuration: the Profiles, keywords, verticals, locations, delivery channels (email, Slack, webhooks) and notification preferences you set.
  • Activity: Leads viewed, saved, flagged or dismissed, feedback and ratings, pipeline states, notes you keep about Leads, exports and API calls.
  • Payment information: payments are handled by our payment processor (currently Stripe). We do not store full card numbers on our servers; we receive limited transaction metadata (amount, status, plan, a tokenised reference and billing country) needed to manage your subscription and handle billing enquiries.
  • Communications: messages you send us through support channels, and email delivery events (delivered, opened, clicked, bounced, complained) for the emails we send you.
  • Device and log data: IP address, browser type, operating system, referring pages, request identifiers and approximate location derived from your IP.
  • Cookies and similar technologies: used for authentication, preferences, security and analytics, as described in our Cookie Policy.

2. How we use Subscriber information

We use the information we collect to:

  • provide, operate and maintain the Service, including matching Leads to your Profiles and delivering digests, alerts, webhooks and API responses;
  • process subscriptions, payments and plan changes;
  • authenticate you, secure your Account, and detect and prevent fraud, abuse and breaches of our Terms;
  • improve the quality of matching, scoring and the Service generally, including by learning from your feedback;
  • communicate with you about transactions, security alerts and service updates;
  • send marketing communications where permitted, which you may opt out of at any time; and
  • comply with legal obligations and enforce our Terms of Service.

3. People who post requests (Posters)

The Service indexes requests for services that people have published on public forums, social platforms, procurement portals and search results. If you have posted such a request, this section explains what we do with it.

  • What we collect: the username, handle or name displayed on the public post; the public text of the post or an excerpt and summary of it; the public URL; the date; public engagement metadata (such as reply counts); and any contact detail you yourself included in the post. Where a procurement portal publishes an organisation's contact for a tender, we may store that published contact.
  • Where it comes from: only public sources — official APIs, public feeds, public search results and openly published procurement notices. We do not access private groups, private messages or content behind a login that is not ours.
  • Why: to connect people who have publicly asked for a service with professionals who provide it. We process this data under our legitimate interests (and, where applicable, the legitimate interests of the Subscribers who receive it), and we have documented a Legitimate Interest Assessment for this processing.
  • What we do not do: we do not build profiles of Posters; we do not enrich posts with data from third-party databases or append private contact details; we do not sell Poster data; and we never email or message Posters. Any outreach comes from a Subscriber, under their own responsibility and their own legal obligations, and our Terms require them to comply with anti-spam and privacy law and platform rules.
  • How long: posts are stored as excerpts and summaries with a link to the original. Raw source payloads are archived within 180 days of collection. Leads expire on a per-source schedule and are removed from Subscriber views within 90 days of expiry. If a source post is deleted, we mark the Lead withdrawn and hide it.
  • Removal: if you posted something we indexed and want it removed, email [email protected] with the link. We remove the Lead, add your handle to an ingestion-time denylist so it is not re-collected, forward the deletion to any Subscriber who exported it, and confirm completion. We aim to complete this within 7 days and in any case within the time the law requires.

4. Legal bases for processing

Where required by law (for example under the GDPR or UK GDPR), we rely on the following legal bases:

  • Contract: to provide the Service you request and fulfil our agreement with you, including matching, digests, alerts and billing.
  • Legitimate interests: to index public requests for services (Section 3); to secure, improve and promote the Service; to keep logs and analytics; and to prevent fraud and abuse, in ways that do not override your rights.
  • Consent: for optional features such as marketing emails, which you may withdraw at any time.
  • Legal obligation: to comply with applicable laws, tax and accounting requirements.

5. How we share information

We do not sell personal information. We share it only as described below:

  • Service providers (processors): Google Cloud (hosting, database, storage and AI qualification; US region); Amazon Web Services SES (email delivery; US East); Stripe (payments); DataForSEO (search results); Apify and its vendor actors, where enabled (collection from public sources); Google Analytics and Microsoft Clarity (marketing-site analytics and usage recording); Meta Platforms (Meta Pixel on the marketing site for ad measurement and retargeting); PostHog (product analytics); Sentry (error reporting); Slack, where you connect it (alert delivery). Each processes data on our behalf under contractual safeguards.
  • Your team: other Seats on your Account can see the Profiles, Leads, notes and pipeline states of that Account.
  • Subscribers: Poster data described in Section 3 is delivered to Subscribers whose Profiles match. Subscribers are bound by our Terms and, where they export data, by the Data Processing Addendum.
  • Legal and safety: to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property or safety of Brewcode, our users, Posters or the public.
  • Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

6. Data storage and security

Your data is stored on reputable cloud infrastructure with encryption in transit and at rest. We apply administrative, technical and organisational safeguards designed to protect your information, including access controls, least-privilege roles, audit logging, hashed passwords, field-level encryption of secrets such as API keys and webhook signing keys, and signed, time-limited links. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data retention

  • Account data: for the life of the Account plus a 30-day grace period after deletion, after which it is deleted or anonymised.
  • Billing records: as long as tax and accounting law requires, held by our payment processor.
  • Email delivery events: 90 days.
  • Technical logs: 30 days.
  • Database backups: a rolling 7-day point-in-time window.
  • Poster data: as described in Section 3.

When data is no longer required, we delete or anonymise it, except where retention is required by law.

8. Your rights and choices

Depending on your location, and as applicable under the GDPR, UK GDPR, India's Digital Personal Data Protection Act, the California Consumer Privacy Act and similar laws, you may have the right to:

  • access the personal information we hold about you;
  • correct inaccurate or incomplete information;
  • delete your personal information;
  • restrict or object to certain processing, including processing based on legitimate interests;
  • request a portable copy of your data;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with a data-protection authority.

Subscribers can export and delete their data from account settings. Posters can use the removal process in Section 3. For anything else, contact [email protected]. We may need to verify your identity before acting on a request. We will respond within the timeframe required by applicable law. We do not "sell" personal information. The Meta Pixel on the marketing site passes visit data to Meta for ad measurement and retargeting, which California law treats as "sharing" for cross-context behavioural advertising; you may opt out by blocking the Pixel in your browser, in your Meta ad preferences, or by contacting us.

9. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service and understand how it is used. You can control cookies through your browser settings; disabling certain cookies may affect the functionality of the Service, including the ability to stay signed in. For full details, see our Cookie Policy.

10. Marketing communications

With your consent, or where otherwise permitted, we may send you product news and promotional emails. Every marketing email includes an unsubscribe link, honoured promptly. Lead digests and alerts are part of the Service you subscribed to; they stop the moment you turn them off in settings or use the one-click unsubscribe. Transactional and security messages are not promotional and may still be sent while your Account is active.

11. International data transfers

We are based in the United States with a parent company in India, and our processors operate in the United States and elsewhere. Your information may be processed and stored in countries other than your own, which may have different data-protection laws. Where we transfer personal data internationally we use appropriate safeguards, such as standard contractual clauses and the UK International Data Transfer Addendum, consistent with this Policy and applicable law.

12. Children's privacy

The Service is not directed to children under the age of 18, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can delete it.

13. Third-party links and sources

Leads link to third-party websites and platforms that we do not control, and the Service may contain other third-party links. This Policy does not apply to those sites, and we encourage you to review their privacy policies before providing any information.

14. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes we will notify Subscribers by email or through an in-app notice and update the effective date above. Your continued use of the Service after the changes take effect constitutes acceptance of the revised Policy.

Contact us

Privacy questions or requests? Write to Brewcode LLC (operator of FirstAsk) at [email protected].

  • Registered address: 1130 Ogletown Road, PMB # 1857, Suite 2, Newark, Delaware 19711, USA
  • Parent company: Brewcode Technologies Private Limited, #198, CMH Road, 2nd Floor, Desk No. 269, Indiranagar, Bangalore, India – 560038
  • Response time: within 30 days, or sooner where required by law