What this product stores.

Who is responsible

The person responsible for personal data processed by this site is Juan Carlos Gomez Garcia, who provides FIRST FOR NOW as an individual service. Address: Escultor Claret 30, 17800 Olot, Girona, España. Identification: NIF-VAT ES77917855L. Contact: hello@firstfornow.com.

Account

When you create an account, the authentication provider stores your email address and a password hash. FIRST FOR NOW stores a matching profile and a wallet starting at zero credits. The signed-in identity is taken from the server session, not from a form field.

Listings

A listing stores the owner, display name, tagline, destination URL, derived domain, logo reference, moderation state, and timestamps. Edits to an approved listing are stored as a separate pending revision. The previously approved version stays public until the revision is approved.

Ranking and purchases

Ranking occupancy, protection deadlines, purchases, credit-ledger entries and public activity events are stored so the board, history and account balance can be reconstructed. Historical occupancy becomes a contender record. Those facts are used to show public history and Hall of Fame records. They do not set current prices or purchase priority.

Battle

When Battle is used, the application stores the two listings, the reserved Credit movement, votes from verified accounts, and the confirmed result so a person can cast only one immutable vote per Battle and so the competitive record can be shown. Votes are not sold as advertising audiences.

Reports and staff actions

If you report a listing, the report stores the listing, a category, optional text, and that you filed it. Other users cannot see who reported a listing. Staff actions that change moderation state are written to an append-only administrative log.

Illegal-content notices

If you send an illegal-content notice, FIRST FOR NOW stores the allegation, the identified electronic location, the alleged-illegal-content category, optional jurisdiction or legal reference, and — unless the child-sexual-offence identity exception applies — your name and email so a receipt can be sent. A receipt email, when contact details exist, uses the FIRST FOR NOW transactional mailer. This is legal and compliance processing. It is not marketing and it is not consent. Reporter identity is not shown to the reported user. Notice and decision evidence is kept while the case or a related restriction remains active. After genuine final case closure, that core evidence is generally retained for five years for legal, compliance and claims purposes. The five-year period is FIRST FOR NOW’s documented retention policy. It is not a claim that the DSA itself mandates a five-year notice-retention period. Data may be kept longer where a legal hold, a proceeding, a competent-authority requirement or another mandatory legal reason applies. Where ordinary processing must stop but the evidence must remain reserved for possible liabilities, access is blocked as required by Spanish data-protection law. After the applicable period, the data are deleted or irreversibly anonymised. Short-lived operational security and rate-limit data have shorter periods.

Moderation decisions and statements of reasons

When FIRST FOR NOW decides a notice or restricts a listing because information is allegedly illegal or incompatible with the Terms, it stores an immutable decision snapshot and, where a restriction is imposed, an immutable Statement of Reasons. Decision emails to a notifier, and Statement-of-Reasons emails to an affected recipient, use the FIRST FOR NOW transactional mailer when an electronic contact is known. Delivery attempts are recorded as accepted, sent or failed — not as mailbox delivery. Reporter identity is not included by default. This is legal and compliance processing, not marketing and not consent. Decision and Statement-of-Reasons evidence follows the same documented retention policy as notices: kept while the case or restriction remains active, then generally five years after genuine final case closure for legal, compliance and claims purposes. That five-year period is FIRST FOR NOW’s policy. It is not a DSA-mandated fixed statutory period. A legal hold, proceeding, authority requirement or other mandatory legal reason may keep data longer. Where suppression is due but evidence must remain reserved, access is blocked. After the applicable period, the data are deleted or irreversibly anonymised.

Law-enforcement and public authorities

Where applicable law requires it — including a Digital Services Act duty to inform law-enforcement or judicial authorities of information that gives rise to a suspicion of a criminal offence involving a threat to the life or safety of a person, or to protect a person from such a threat — FIRST FOR NOW may disclose relevant information it already holds to those authorities. This is a legal obligation. It is not marketing, not consent, and not a finding of guilt. Only information that is relevant and already available is disclosed. FIRST FOR NOW does not collect extra material from third-party destinations merely to enlarge a report.

Payments

When credit checkout is enabled, Stripe receives the amount and a reference to the internal top-up. FIRST FOR NOW stores payment identifiers and status needed to credit a verified payment once. Card numbers are not collected by this application. Live payments are currently disabled.

Outbound clicks

Visits that leave through /go increment a daily count per listing. That count is not unique visitors. The product does not store raw visitor IP addresses, User-Agent history, fingerprints, or a unique visitor identity for those clicks.

Hosting and database providers may keep their own operational logs separately from this product analytics. Those logs are not used to rank listings or price positions.

Sessions and cookies

Sign-in uses essential cookies so the server can recognise the session. There is no advertising pixel and no third-party analytics product in this application. See cookies.

Other services this product uses

This application currently uses Supabase for authentication, database and file storage; Vercel to host the site; Cloudflare Turnstile on sign-in forms; and, for destination screening, Google Web Risk, Cloudflare URL Scanner, Cloudflare Browser Rendering, and OpenAI classification or moderation endpoints. Stripe is configured only for a later credit checkout and is not taking live customer payments. This page describes those transmissions as they are implemented. Signed data-processing terms with each vendor are not reproduced here, so this page does not label every vendor “processor”, “subprocessor” or “independent controller” by assumption.

Automated content screening

Destination URLs, listing text and, where needed, images may be sent to those safety services so FIRST FOR NOW can evaluate promotional eligibility. FFN_EVAL_V8 is FIRST FOR NOW’s evaluator and remains the decision authority. A provider score is evidence, not a final legal ruling. Outcomes may be ALLOWED, REVIEW_REQUIRED or BLOCKED. REVIEW_REQUIRED is a human-review path. A BLOCKED or restricted listing is told through the product and, where contact details are known, through a statement of reasons. This is not a claim of perfect detection.

Your rights

You may write to the contact below to ask for access, rectification, erasure, restriction, objection or portability, and to complain to the Agencia Española de Protección de Datos (AEPD). Financial ledger, purchase and ranking-history rows are kept so the economy can be reconstructed; they are not silently rewritten. Account closure is not a self-serve button today. A request is handled by email. Some rows cannot be deleted while they remain a legal or accounting record.

How long data is kept

Account, listing and session data are kept while the account exists and as long as needed to operate the service. Credit-ledger, purchase, top-up identifiers and staff-action rows are append-only audit records. Illegal-content notices, moderation decisions and Statements of Reasons are kept while the case or a related restriction remains active. After genuine final case closure, that core evidence is generally retained for five years for legal, compliance and claims purposes. The five-year period is FIRST FOR NOW’s documented retention policy, not a claim that the DSA mandates a five-year period. Data may be kept longer for a legal hold, proceeding, competent-authority requirement or other mandatory legal reason. Where ordinary processing must stop but evidence must remain reserved for possible liabilities, access is blocked as required by Spanish data-protection law. After the applicable period, the data are deleted or irreversibly anonymised. Short-lived operational security and rate-limit data have shorter periods. Content-policy evidence stores hashes and normalised provider output with an expiry on the cache; raw provider payloads and screenshots are not kept in the product database. Hosting and authentication providers keep their own operational logs. There is no marketing-profile store.

International transfers

Some of the services named above are provided from outside the EEA, including the United States. Where a transfer occurs, it relies on that provider’s published transfer mechanism (typically Standard Contractual Clauses) in the contract actually in force with that provider — not on a clause invented here. Ask the contact below if you want the current reference.

Contact

Privacy and support requests go to hello@firstfornow.com.