How we handle information.

Information you give us. Name, firm, email, message content, and topic when you submit the inquiry or triage form; name and email when you subscribe to The Firm Brief or download a resource. We do not ask for privileged matter data through this site; do not paste privileged content into free-text fields.

Information collected automatically. Standard server logs (IP address, user agent, timestamps) for security and abuse prevention, and privacy-first analytics (Plausible) that do not use cookies and do not build cross-site profiles.

To respond to your inquiry or triage request, deliver the resources you asked for, send the newsletter you subscribed to, and improve the site. Live-incident inquiries are routed to incident@hackfirstaid.com; all other topics route to hello@hackfirstaid.com. We do not sell your information and do not share it with advertisers.

Where GDPR or UK GDPR applies, we rely on: your consent for newsletter and resource downloads (withdrawable anytime), legitimate interests for responding to inquiries and running the site securely, and legal obligation for retaining records where required.

We use a short list of subprocessors, each under a data-processing agreement:

• Supabase — form submissions and subscriber records (database).
• Cloudflare — site hosting, DDoS protection, and server logs.
• Plausible Analytics — cookieless, EU-hosted analytics.
• Google Workspace — email delivery for inquiry replies and newsletters.

The site does not use tracking cookies. A small number of functional cookies may be set by the framework to remember UI state; none are used for advertising.

Inquiry submissions are retained for 24 months so we can honor follow-ups and audit trail. Newsletter subscribers are retained until unsubscribe. Server logs are retained for up to 90 days for security investigation.

You may request access, correction, deletion, or export of your personal data at any time. Email privacy@hackfirstaid.com and we will respond within 30 days. To unsubscribe from the newsletter, use the link in any email. Residents of the EEA, UK, and California have additional rights under GDPR, UK GDPR, and CCPA/CPRA respectively; we honor all of them.

Submissions are transmitted over TLS and stored encrypted at rest with our subprocessors. Access is limited to the operator and named contractors under confidentiality obligations. No system is perfectly secure; report a suspected issue to security@hackfirstaid.com.

The site is not directed to children under 16, and we do not knowingly collect their data.

Material changes will be noted at the top of this page with an updated date. Continued use of the site after the update constitutes acceptance.