Privacy policy
1. Who is responsible
True Meridian AI, which operates Firstday, is accountable for the personal information in its custody. We handle it under the Personal Information Protection and Electronic Documents Act (PIPEDA).
Our Privacy Officer can be reached at caelen@truemeridianai.com.
2. What we collect
From the contact form
If you fill in the contact form on our website we collect your name, email address, the subject line if you write one, and whatever you put in the message box. We use it only to reply to you. We do not add you to a newsletter and we do not pass it to anyone else.
From Members
| Information | Why we need it |
|---|---|
| Name, email, phone | To create your account and let Organizations contact you about a trial day you RSVP'd to. |
| Date of birth | To confirm you are 15 to 25, and to work out whether guardian consent is required. |
| Postal code, and travel range | To rank listings by how far you would have to travel. We use the area, not a precise address. |
| Interest picks, and the themes produced from them | To rank listings by fit. Explained in section 5. |
| RSVPs, who you bring, and check ins | To run the service and to show you your trial day history. |
| Guardian name and contact details, where you are under 16 | To request and record consent. |
| Messages sent through the Platform | To deliver them, and to investigate safety reports. |
| Device type, app version, IP address, and pages or screens used | To keep the service working and secure, and to fix faults. |
From Organizations
Contact details for the people who administer the account, the Organization's name and registered status, and listing content. We do not currently collect billing details from Organizations, because listing a trial day is free during the pilot.
What we do not collect
We do not ask for a Social Insurance Number, health information, or precise background-check results. We do not buy personal information from data brokers, and we do not track you across other websites.
3. Consent
We collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise.
You give express consent when you create an account, when you pick your interests, and when you RSVP to a listing, which releases specific information to that Organization. We tell you what is being shared at the point you RSVP.
Members under 16
If you are under 16, we ask for a parent or guardian's contact details during registration and send them a request to approve the account. The account stays inactive until they approve it. We also ask them to approve each RSVP before it is confirmed.
We collect the guardian's name, email, and relationship to you, and use it only for consent and for contacting them about your use of Firstday.
A guardian can review what we hold about the young person, ask us to correct it, or withdraw consent at any time by writing to caelen@truemeridianai.com. Withdrawing consent closes the account.
Withdrawing consent
You can withdraw consent at any time, subject to legal and contractual limits, by closing your account or writing to us. We will tell you what withdrawing means in practice. Some of it, such as a record of an RSVP an Organization has already relied on, may need to be retained.
4. How we use it
- To create and run your account.
- To rank and show trial days that fit.
- To pass an RSVP, and who you are bringing, to the Organization hosting it.
- To record check ins and to show you your trial day history.
- To request and record guardian consent.
- To respond to support requests and safety reports.
- To keep the Platform secure and to prevent fraud and misuse.
- To understand how the Platform is used, in aggregate, so we can improve it.
- To meet legal obligations.
We will not use your information for a new purpose without asking, unless the law allows it.
5. The interest picker and automated ranking
Your interest picks are sorted into themes. Those themes, your postal area, and your stated travel range are used to rank listings. The ranking is produced automatically.
It affects the order in which you see things. It does not decide anything about you. It does not gate access to listings, and it is not shown to Organizations as a score. When you RSVP, an Organization sees your interest themes as context alongside your RSVP; it does not see your individual picks.
You can update your interests whenever you want, which replaces the previous result. You can ask us for a plain-language explanation of how a ranking was produced.
6. Who we share it with
Organizations you RSVP to
When you RSVP, that Organization receives your name, age or age band, contact details, interest themes, approximate distance, and the name of anyone you are bringing. Where you are under 16, it also receives confirmation that guardian consent is on file. Organizations that host you also receive your check-in record.
Organizations are separately responsible for the information they receive. What they do with it is governed by their own privacy practices, not this policy.
Service providers
We use a small number of companies to run the Platform. They may access personal information only to do the work we have asked them to do, under contracts requiring protection comparable to ours.
| Provider | What it does for us |
|---|---|
| Vercel | Hosts and serves the website and app front end. |
| Supabase | Runs our database, file storage, and account authentication. Most personal information described above lives here. |
| Resend | Delivers transactional email, including email verification, guardian consent requests, and RSVP reminders. |
We also use GitHub to store our source code. It holds no personal information about users. We do not currently use a payment processor, because listing a trial day is free for Organizations during the pilot; if that changes, this policy will be updated to name the provider before any payment is collected.
Legal and safety
We may disclose information where the law requires it, to respond to a valid legal demand, to establish or defend a legal claim, or where we reasonably believe it is necessary to prevent serious harm to a person. If we believe a young person is at risk we may contact police or a children's aid society.
Business changes
If Firstday is sold or merged, personal information may transfer as part of that, subject to the buyer honouring this policy. We will give notice before any transfer takes effect.
We do not sell personal information, and we do not share it with advertisers.
7. Where it is stored
Our database is hosted with Supabase. Vercel serves the site from edge locations in several countries. Resend operates from the United States.
This means personal information is stored or processed outside Canada, including in the United States. Information held in another country is subject to that country's laws and may be accessible to its courts, law enforcement, and national security authorities. By using Firstday you consent to that transfer. Write to us if you would like more detail about where a particular category of information sits.
8. How long we keep it
| Category | Retention |
|---|---|
| Contact form submissions | Until your enquiry is resolved, then 12 months. |
| Account and profile | While the account is open, then 12 months after closure. |
| RSVP and attendance records | 24 months. |
| Guardian consent records | 7 years after the account closes, as proof consent was obtained. |
| Messages | 24 months. |
| Safety reports and investigations | 7 years. |
| Technical logs | 90 days. |
When a retention period ends we delete the information or render it anonymous.
9. How we protect it
We use encryption in transit and at rest, access controls that limit staff access to what their role requires, logging of access to member records, and regular review of our providers. No system is perfectly secure, and we do not claim otherwise.
If a breach creates a real risk of significant harm, we will report it to the Privacy Commissioner of Canada and notify affected people as PIPEDA requires.
10. Your rights
You can ask us to:
- confirm whether we hold personal information about you, and give you access to it;
- tell you how it has been used and who it has been disclosed to;
- correct anything inaccurate or incomplete;
- delete your account and the information attached to it, subject to what we must keep;
- give you a copy in a portable format;
- withdraw consent.
Write to caelen@truemeridianai.com. We respond within 30 days, and will tell you if we need an extension and why. Access is free in ordinary cases; if a request needs unusual effort we will tell you the cost before doing the work. We may need to verify your identity first. Where the account belongs to someone under 16, a guardian on file can make these requests.
11. Complaints
If you are unhappy with how we have handled your information, write to our Privacy Officer at caelen@truemeridianai.com. We will investigate and reply in writing.
If you are still not satisfied you can complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec, K1A 1H3, or through priv.gc.ca.
12. Cookies
Our use of cookies and similar technologies is described in the Cookie Policy.
13. Changes
We may update this policy. If a change materially affects how we handle your information we will give notice by email or in the app before it takes effect, and where the law requires it we will ask for fresh consent. The date at the top shows when this version was published.
14. Contact
Privacy Officer, True Meridian AI
caelen@truemeridianai.com