Privacy Policy

1. Who this applies to

This policy covers visitors to our marketing site, account holders (the adult who creates and pays for an account), and learners who use the platform. ThinkFirst is for adults: every account holder and learner must be 18 or older, including anyone you buy a seat for.

2. Information we collect

• Account information — name and email, handled by our authentication provider (Clerk).
• Learning activity — journeys, modules, and activities completed, and related progress, stored in our database (Convex).
• AI chat conversations — the messages you exchange with our AI learning scenarios, so we can provide and improve the lesson experience.
• Payment information — handled by our payments provider (Stripe). We do not store full card numbers.
• Limited technical/usage data — needed to operate and secure the service.

We practise data minimization: we collect only what is reasonably necessary to provide the service, and we do not condition participation on collecting more than that.

3. How we use information

• To provide the learning experience and track progress.
• To operate AI chat scenarios and keep them safe.
• To process subscriptions and payments.
• To secure the service and meet legal obligations.

4. AI conversations

AI chat messages are processed by our model provider (OpenRouter) to generate responses. Conversations are retained per our Data Retention policy and are removed as part of the purge that runs when you delete your account (see Section 7). You can also email us to request removal of a specific conversation. We do not sell conversation data.

5. Sharing and third parties

We do not sell personal information. We share data only with the service providers needed to run ThinkFirst — Clerk (authentication), Convex (database), Stripe (payments), and OpenRouter (AI model access) — each under their own terms, and only for the purposes above. We will disclose the specific categories and purposes of any third-party sharing in our consent flow.

6. Age requirement

ThinkFirst is for adults. You must be 18 or older to create an account or use the service, and anyone you buy a seat for must also be an adult. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we delete it.

7. Your rights and choices

Depending on where you live (including under Canada's PIPEDA, Quebec's Law 25, and US state privacy laws), you have rights to access, correct, delete, and port your information, and to withdraw consent. Most of these are self-serve, right in your account:

• Export your data — from Settings → Privacy, download a portable JSON copy of your account data on demand, no email required. Very large accounts may see a category flagged as partial in that download; email us for the complete history of a flagged category.
• Delete your account — from Settings → Security, permanently delete your account with a typed confirmation. This cancels any subscription on a team only you own, deletes your sign-in record with our authentication provider (Clerk), and starts an automatic purge of your personal data across the platform. If you own a team with other members, or are assigned to an active or upcoming classroom session, deletion is blocked until ownership is transferred or the assignment is reassigned — we'll show you what's blocking it, or you can email us for help.
• What deletion retains — a minimal record of your consent/terms acceptance (kept as our legal record of your agreement); a pseudonymous reference in shared classroom or session history so records other participants rely on stay intact, with your display name cleared from it; payment and invoice records held at Stripe, our payment processor, as its own system of record; and a minimal account marker used only to reject sign-in under the deleted identity.
• Assisted or verified requests — for identity verification, edge cases the self-serve tools don't cover, or a formal access or deletion request you'd rather we handle directly, email privacy@thinkfirst.ai. We aim to respond to formal requests submitted this way within 30 days.

8. Retention and security

We keep personal information only as long as needed for the purposes above and then delete it — see our Data Retention policy. We maintain a written information-security program and use reasonable technical and organizational safeguards.

9. Where we operate

ThinkFirst operates in Canada and the United States. By default we apply privacy-protective settings (privacy by default). Quebec residents have specific rights under Law 25, including in relation to automated decision-making where applicable.

10. Changes

We may update this policy; we will post the new date above and, where required, notify you.

11. Contact & Privacy Officer

Questions or requests: privacy@thinkfirst.ai. Our designated Privacy Officer (per Quebec Law 25) can be reached at the same address. [Legal entity name and mailing address to be confirmed before launch.]