Privacy Policy

Who this covers

This Privacy Policy explains how FirmOptic (“FirmOptic,” “we,” or “us”) collects, uses, and shares personal information on firmoptic.com and app.firmoptic.com (the “Service”). It covers two groups of people:

• Our customers and site visitors: people who visit our website, create an account, or use the app.
• People at companies our customers research: business owners and executives whose business information appears in research results. See Research data.

The Service is built for business use and is not directed to anyone under 18.

What we collect from customers

Account information

Your name, email address, and password (stored only as a one-way hash), or, if you sign in with Google or Microsoft, the name, email, and account identifier they share with us. We also store your organization, team members, invitations, and role (Owner, Member, or Viewer).

Content you provide

Theses and search criteria, messages you send to the thesis coach, notes, pipeline and deal data, memos, and documents you upload.

Billing information

Payments are handled by Stripe. We never see or store your full card number. We keep Stripe customer and subscription identifiers, your plan, billing interval, subscription status, and billing period dates.

Technical information

When you sign in we record a session, including your IP address and browser user agent. Our servers keep operational logs for security and debugging. We use an error-monitoring service (Sentry) that receives error details, the page involved, and basic browser information.

Email

We send transactional email such as welcome messages, password resets, team invitations, and shared-memo notifications. We do not use your account information for advertising.

Website analytics

Our marketing site (firmoptic.com) uses Google Analytics to measure traffic and which pages are useful. The app (app.firmoptic.com) does not use Google Analytics.

Research data about companies and people

FirmOptic researches private companies for our customers. To do that we gather information about companies and about the people who own or run them. This can include a person’s name, job title, employer, seniority, work email address, and work phone number.

Where it comes from

• Third-party data providers, principally CompanyEnrich, for company profiles and business contact data for people at those companies.
• Public and government sources, such as USAspending.gov and GovInfo federal records, state business registries, and Small Business Administration PPP loan data.
• The public web, including search results, company websites, news, and review sites such as BBB, Clutch, Glassdoor, and G2, gathered through search and web-page retrieval services.

Why we have it

Our customers use this information to evaluate acquisition targets and to contact the owners and executives of businesses they may want to buy, invest in, or partner with. We process it for that business purpose only.

If you are a person in our results

You can ask us to show you what we hold about you, correct it, or remove it. Email [email protected] with the subject “Privacy request,” and include your name and the company, so we can find your record. We will remove the information from our systems. Because the same information may also be held by our data providers and by public sources, you may need to contact them separately.

How we use information

• Provide, operate, secure, and support the Service, including research, scoring, memos, and the pipeline.
• Process payments, manage subscriptions and credits, and prevent fraud and abuse (including multiple accounts used to avoid limits).
• Communicate with you about your account, security, and changes to the Service or our terms.
• Understand how the website is used and fix errors.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your account information, and we do not use it for advertising.

AI processing

We use third-party AI model providers to generate research, scores, memos, and thesis-coach replies. Your prompts and thesis details, and the company information gathered for a research task, are sent to these providers to produce the result. We route these requests through OpenRouter, which sends them to model providers; at the time of writing these include OpenAI, Google, xAI, and DeepSeek.

We do not use your content to train AI models. The providers process content on our behalf to return results to us, and their own terms govern that processing. We do not send your uploaded documents to AI providers.

AI output can be wrong. See our Terms of Service.

Who we share information with

We share information with service providers that help us run the Service, and only as needed for that purpose:

• Google Cloud: hosting, database, and storage of uploaded documents (Google Cloud Storage), in the United States.
• Stripe: payment processing and subscription billing.
• SendGrid: sending transactional email.
• OpenRouter and the model providers it routes to: AI processing, as described above.
• CompanyEnrich: company and business-contact data.
• Serper, Exa, and Scraping Robot: web search and page retrieval used during research.
• Google and Microsoft: sign-in, if you choose it.
• Sentry: error monitoring.
• Google Analytics and Cloudflare: analytics and hosting for the marketing website.

Within your organization, other members can see content according to their role. When you share a memo, the people you share it with can view it.

We may also disclose information to comply with law or legal process, to protect rights, safety, and security, and in connection with a merger, financing, or sale of our business. Personal information of our customers is not sold. Research results include business contact information about people at target companies, which we obtain from third-party providers and make available to our customers as part of the Service; see Research data and Your rights.

Cookies and similar technologies

• Session cookie (session_id): keeps you signed in. It is HTTP-only and sent only over secure connections. It lasts for your browser session, or 30 days if you choose “remember me.”
• Security tokens: a token tied to your session protects against cross-site request forgery, and a short-lived cookie protects Google and Microsoft sign-in.
• Browser storage: the app keeps interface preferences and in-progress work in your browser’s local and session storage.
• Analytics cookies: Google Analytics sets cookies on firmoptic.com. You can block them in your browser settings or with Google’s opt-out browser add-on.

We do not use advertising cookies. Some browsers send a Do Not Track or Global Privacy Control signal; because we do not sell or share personal information for advertising, our handling does not change.

Retention and deletion

We keep account and content data while your account is active and as long as needed to provide the Service, meet legal and tax obligations, resolve disputes, and prevent fraud.

• Closing your account (an Owner can do this in Settings) cancels your subscription at the end of the billing period and deactivates your login. It does not by itself erase your data.
• Deleting your data: email [email protected] and we will delete your account and content, including uploaded documents, from our active systems within 30 days. We may keep records we must retain for billing, tax, security, or legal reasons, and deleted data can remain in backups for a limited time until they expire.
• Stripe keeps its own payment records under its own policies.

Security

We protect information with encryption in transit, hashed passwords, role-based access within organizations, time-limited signed links for document uploads, and restricted access to production systems. No system is perfectly secure, so we cannot guarantee absolute security.

Your privacy rights

Depending on where you live (for example California and other U.S. states, the European Economic Area, or the United Kingdom), you may have the right to:

• Access the personal information we hold about you and get a copy;
• Correct information that is wrong;
• Delete your personal information;
• Port your information in a usable format;
• Opt out of the sale or sharing of your personal information. We do not sell our customers’ personal information and do not share it for cross-context advertising. If you are a person in our research results and want your information removed, use the process in Research data;
• Object to or restrict certain processing, and withdraw consent where we rely on it;
• Not be treated unfairly for using these rights.

How to make a request

Email [email protected] with the subject “Privacy request,” tell us which right you want to use, and give us the email address on your account (or, for research results, your name and company). We may need to confirm your identity. We respond within 30 days, or within the period the law requires; where the law allows, we may extend that period and will tell you why. You can use an authorized agent, and we may ask for proof they act for you. If we deny a request you can appeal by replying to our response, and you can also contact your state attorney general or data protection authority.

If you are outside the United States

We operate in the United States, and your information is processed there. Where GDPR or UK GDPR applies, we rely on contract (to provide the Service), legitimate interests (security, fraud prevention, and our customers’ business-to-business research), and legal obligation.

Changes to this policy

We may update this policy. We will post the new version with a new effective date and, for material changes, notify you by email or in the Service.

Contact

Questions or requests about privacy: [email protected].