FirstPicked privacy policy

Last updated 3 November 2026

FirstPicked is a Shopify app. It shows store owners how AI apps (like ChatGPT, Gemini and Perplexity) recommend their store. It suggests fixes and shows which sales came from AI. This page explains what data we use, why we use it, and how we keep it safe.

What we collect

• Your store details: shop name, web address, plan, and your products (titles, descriptions, types, tags, prices and images). We use them to write questions and fixes.
• Orders that came from AI: the order number, total, currency, product names and amounts. We also keep where the visit came from (the site that sent it, the first page and the utm tags), which shows it came from AI. And we keep daily totals of orders and visits, so we can show AI as a share of your sales.
• Visits from AI: our web pixel records visits that come from an AI app, but only when the shopper agrees to analytics cookies. It records the site that sent the visit, the page address with its utm tags, and a scrambled (hashed) browser id. We use that id only to avoid counting the same visit twice.

We never collect your customers' names, email addresses, phone numbers or addresses. We don't sell any data. We never use one store's data for another store.

Free product check

Anyone can check a product on our website without installing FirstPicked. To run the check, we send the text of that public product page to Claude (Anthropic). We send the questions to ChatGPT, Gemini and Perplexity through our data provider. We keep the product link, what we read from the page and the AI answers, and delete them after 30 days. We also keep a scrambled (hashed) copy of your IP address, so we can limit how many free checks one person runs. We delete it after a day.

Each report has its own link that isn't listed anywhere. But anyone you share the link with can see the report.

If you ask for the full report by email: we keep your email address, the words you agreed to and when, and which report you asked for. That's so we can email you that report (a PDF) once. If you also tick the box for tips, and then confirm from that email, we send you tips now and then on getting recommended by AI. We never put you on the tips list without both steps. Every email has an unsubscribe link. You can also reply to any email to stop them.

We delete your address, and our record of the reports we emailed you, in one of two cases. One: 30 days after you unsubscribe (counted from your last request). Two: 2 years after you last asked for a report or clicked a link in our emails. After that, we keep only a scrambled code (a hash) of an address that unsubscribed. That way we never email it tips again by mistake. We also keep a record of each report we emailed, with a scrambled (hashed) IP address for a day. This limits how many reports one person can ask for. We delete that record after 90 days.

Your browser keeps a small cookie (geo_check_leads) for 30 days, only on the check pages. It lets the report page show where your report went. It holds the address you typed, signed so it can't be changed, and only your browser sends it.

We never sell your email address. We share it only with Resend, which sends our emails for us. We don't upload it to Facebook, Google or any other ad service.

Free tools

Our free tools at firstpicked.com.au/tools work without an account.

• Some tools run in your browser: the FAQ Schema Generator, the AI Bot Checker with pasted text, and pasted robots.txt, llms.txt or product data. They don't send what you type to us. If JavaScript is off in your browser, the form goes to our server once to build the result, and we don't keep it.
• When you enter a web address, our server gets public files from that site (like robots.txt, llms.txt or a product page) to check them. We don't keep the files.
• The AI Overview Checker sends your search to our data provider, Treg. Treg passes it to a Google results service (Crawl4AI, or AnyAPI as a backup). We keep the result in memory for up to 24 hours, so the same search is fast next time. If you add your website, we only use it to compare with the results.
• To stop abuse, we count requests using a scrambled (hashed) copy of your IP address. We hold it in memory and clear it within a day. We record what each search cost us, without your IP address or your search.

The AI Visibility Checker is our free product check, described above.

Waitlist

If you join the waitlist on our home page, we keep your name, your email address, the words shown with the form and when you joined. We also keep which button you used. If you came from an ad or another website, we keep the ad's tracking tags in the page address (like utm_campaign or Facebook's click id) and the name of that website. To stop abuse, we keep a scrambled (hashed) copy of your IP address for a day.

We use this only to contact you about FirstPicked. We delete it 24 months after you joined, or sooner if you ask.

Booking a call

If you book a call with Ross on our website, we add it to Ross's Google Calendar with your name, your email address and your store's website. Google then emails you the invite with a Google Meet link. We also email Ross the same details, and the ad's tracking tags (like utm_campaign) if you came from an ad. To stop abuse, we keep a scrambled (hashed) copy of your IP address for a day.

We use this only to talk with you about FirstPicked, and we delete it if you ask.

Giveaway

If you enter our giveaway, we keep your store's website, your name, email address and phone number, the words shown with the form and when you entered. If you came from an ad or another website, we keep the ad's tracking tags in the page address and the name of that website. To stop abuse, we keep a scrambled (hashed) copy of your IP address for a day.

We use this to run the draw and to contact you about FirstPicked. We delete it 24 months after you entered, or sooner if you ask.

Ads and cookies on our home page, giveaway page and booking page

Our home page, giveaway page and booking page use Meta's pixel (Meta runs Facebook and Instagram). It lets us see which of our ads work and show our ads to people who visited. It tells Meta that a browser looked at the page. If you join the waitlist, enter the giveaway or book a call, it tells Meta that someone did. It never sends your name, email address or phone number. Meta may set cookies, and it gets your browser's details and IP address, as Meta's own privacy policy says.

In Europe and the UK, the pixel only starts after you click OK on the cookie notice. Everywhere else, it runs unless you click No thanks. To change your choice, clear this site's cookies and data in your browser, and the notice shows again. The pixel is not part of the FirstPicked app and never sees your store's data.

Why we use it

Your store's data: only to run FirstPicked for you. That means checking AI answers about your products, writing suggested fixes for you to approve, and showing the clicks, orders and sales that came from AI. We don't use it for ads or anything else.

Free product check: to run the check, to email you the report you asked for, and to send tips now and then if you ticked the box and confirmed. We don't use your email address for anything else, and never for ads.

Waitlist: only to contact you about FirstPicked.

Booking a call: only to talk with you about FirstPicked.

Giveaway: to run the draw and to contact you about FirstPicked.

Shoppers' choices

Our web pixel only runs when the shopper says yes to analytics in your store's cookie banner. (That's Shopify's customer privacy settings.) If they say no, we record nothing about their visit.

How long we keep it

• We remove the scrambled browser id from visit records after 90 days.
• We keep everything else while FirstPicked is installed, so you can compare with your starting point.
• When you uninstall, Shopify tells us to delete your store's data (usually 48 hours later), and we do. As a backup, we delete it ourselves 30 days after you uninstall.
• If a shopper asks your store to delete their data, we delete any of their orders from our records.

How we protect it

All data is locked (encrypted) while it travels (HTTPS and encrypted database connections) and while it's stored. Each store's data is kept apart, and only the FirstPicked app can read it.

Services we use

• Railway (Singapore): runs the app.
• Meta (Facebook and Instagram): our own ads, and the pixel on our home page, giveaway page and booking page described above.
• Google: Google Calendar and Google Meet, for calls booked on our website.
• Supabase (Tokyo): stores the data.
• Treg: gets public AI answers to buying questions. It gets the questions only, never customer data.
• Anthropic (Claude): reads AI answers and writes draft fixes from your product details. It never gets customer data.
• Resend: sends your monthly email report and free check reports (and tips, for people who asked for them). It gets the email address and the email.

Your rights and contact

You can ask us what we hold about your store, or ask us to delete it, at any time using the contact details on FirstPicked's Shopify App Store listing. Uninstalling FirstPicked also deletes everything.

If you asked for a free check report by email, you can ask us for the email address we hold about you, or ask us to delete it. Do it the same way, or reply to any of our emails. If you joined the waitlist, entered the giveaway or booked a call, you can ask us for your details or ask us to delete them the same way.