Privacy policy

Who can see a reaction video

By default, a reaction video is only viewable by the person who sent the invitation (the “originator”). It is not public, not searchable, and not visible to other people on the platform.

The originator can choose to publish an individual reaction on a public celebration page for that moment. That page is only reachable by its link, but anyone with the link can open it without an account. Nothing is published unless the originator turns it on for that specific reaction. If your reaction has been published and you want it taken down, email contact@mail.firstlook.cloud and we will remove it.

How videos are protected

Videos are uploaded directly to encrypted cloud storage over an encrypted connection (HTTPS), and are encrypted at rest. Access to a stored video requires a signed, time-limited link that only the originator’s account can generate.

Face detection

We use an automated tool to find where a face sits in the frame of a reaction video, so reaction reels can be cropped without cutting people’s heads off. It only measures a position in the frame. It does not identify or recognize anyone, and the result is not stored.

Cookies

When you open a shared FirstLook link we set one cookie, fl_device. It holds a random ID with no personal information in it, and we use it to avoid counting the same person twice in a moment’s view count and to stop the same person voting twice in a poll. It is a session cookie — your browser drops it when you close it. We don’t use advertising or third-party tracking cookies.

What we don’t do

We don’t sell reaction videos or recipient data, we don’t use them to train models, and we don’t share them with anyone besides the originator and the vendors we need to run the service (cloud storage, payments, email, and text message delivery).

How long we keep things

We keep an announcement, its reactions, and their videos for as long as the originator’s account exists, so they can go back and rewatch them. There is no automatic expiry. When an announcement, a reaction, or an account is deleted, the stored videos are deleted with it.

Alongside each reaction we also store the moment you agreed to be recorded and which version of the consent wording you were shown. We keep that record for as long as the reaction exists, so that if there’s ever a question about whether a recording was agreed to, there’s an answer. It is deleted when the reaction is.

Your rights over your data

If you have an account: you can delete an individual announcement, an individual reaction, or your entire account at any time from your dashboard settings, which permanently removes the stored videos. You can also email contact@mail.firstlook.cloud to ask for a copy of the data we hold about you.

If you recorded a reaction and never signed up: you can delete your own recording yourself. On the page where you recorded, once your video finishes sending, there’s a “Delete my recording” link that removes the video, its thumbnail, and the row we stored — no account and no email needed. That link works from the same browser you recorded in; clearing your site data or switching devices loses it.

If you no longer have that link, email contact@mail.firstlook.cloud from any address, tell us roughly when you recorded it and whose announcement it was (the name of the person who sent you the link is enough), and we’ll find it and delete it. You can also just ask the person who sent you the link — they can delete it themselves from their dashboard.

We aim to answer these requests within 30 days.

The vendors we rely on

We don’t run everything ourselves. To deliver the service we share the minimum necessary data with a few trusted providers, each acting only on our instructions:

• Cloud storage & hosting — stores your videos and runs the app.
• Stripe — processes payments; we never see or store your full card number.
• Resend — sends our email (password resets, receipts, notifications).
• Twilio — sends the one-time codes that verify your phone number.
• Cloudflare — protects sign-up and waitlist forms from bots.

Legal basis & regional rights

If you’re in the EEA or UK, we process your data to provide the service you asked for (performing our agreement with you), to record reactions with your consent, and to keep the service secure and working (our legitimate interests). You can withdraw consent, or ask us to access, correct, or delete your data, at any time — see the section above or email contact@mail.firstlook.cloud.

If you’re in California, you have the right to know what we collect, to request deletion, and to opt out of the sale of your information. We don’t sell your information, so there’s nothing to opt out of — but you can still exercise the other rights by emailing contact@mail.firstlook.cloud. We won’t discriminate against you for doing so.

Contact

Questions about this policy, or anything else? Email contact@mail.firstlook.cloud.