FirstFiveMin
---
FirstFiveMin serves two different people, and this policy speaks to both.
If you are a business using FirstFiveMin — a contractor, agent, clinic, or practice — you are our customer. Sections 1–6 describe how we handle your account and your business information.
If you are someone who contacted one of those businesses and we called, texted, or emailed you on their behalf, you are a consumer, and this policy matters most to you. Sections 7–12 are written for you. In that relationship the business you contacted decides what happens to your information; we act on their instructions. If you want your information deleted or want to stop hearing from them, you can tell either of us — see §11 — and we will act on it either way.
---
Account and contact details; your business's legal name, address, and EIN where required for carrier registration; the phone numbers you provision or port in; staff names, emails, and mobile numbers you enter; your settings, greeting scripts, and coaching notes; billing information; and security records such as session IP addresses and device identifiers.
Sensitive items are encrypted at rest, including your EIN, port-out PINs, Letter of Authorization details, staff mobile numbers, and unsaved form drafts.
Subscription billing is processed by Stripe. We store Stripe's opaque identifiers and, for refunds, a keyed one-way fingerprint of the payment card so a refunded instrument can be matched later. We never store your full card number.
Provide the service; register your numbers with carriers; place and receive calls and messages on your behalf; bill you; keep security and audit records; and meet legal obligations.
If you connect a calendar, we use it only to schedule.
Google. We read free/busy intervals so the assistant never offers a time you already have taken — this tells us that a time is busy, never what the event is — and we create and update the appointments we book for you. We request calendar.events.owned and calendar.freebusy. calendar.events.owned lets an app see, create, change and delete events on Google calendars you own. FirstFiveMin uses it only to add, change and cancel the appointments it books for you. To check when you are free we use calendar.freebusy, which shows busy times without event details. FirstFiveMin's use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it except to provide this feature or as required by law, and do not allow humans to read it except with your explicit permission, to resolve a support issue you raised, for security, or where required by law.
Microsoft / Outlook. Outlook's permission model has no read-only free/busy option that also allows creating an appointment, so connecting Outlook grants FirstFiveMin read and write access to your calendars. What we do with that access is the same as above — read availability, write the appointments we book — and we do not read the contents of your other events.
Disconnecting a calendar stops all access.
Consumer and staff personal data is encrypted at rest against a maintained registry that records, column by column, what is encrypted and why anything is not. Phone numbers are stored encrypted and searched through a keyed one-way index rather than in plaintext. Personal data is masked before it is written to audit logs. Access to recordings is restricted to permitted storage hosts and fails closed.
No system is perfectly secure, and we do not claim otherwise.
When your subscription ends, your data becomes read-only for 30 days so you can export it. After that window closes, we delete it, with the narrow exceptions in §10 — which exist because deleting them would harm consumers, not because they help us.
---
You gave it to a business — a form, a call, a text — and that business uses FirstFiveMin to respond quickly. We act on that business's instructions. We do not have our own relationship with you, we did not buy your information, and we do not sell or share it.
If the business's staff cannot respond within a short window, an AI assistant may call or text you on their behalf. The assistant identifies itself as automated at the start of the call. It cannot place the call at all unless that disclosure is present — that is enforced in our software, not left to a setting.
If you message a business on Facebook, Instagram or WhatsApp and that business uses FirstFiveMin, we receive your message, the name the platform shows, and the ID the platform assigns you, so the business can reply. If a business turns on lead-quality reporting, we send Meta the lead ID Meta assigned to a lead-form lead and the stage it reached (for example, "Appointment Booked"). We do not send Meta names, phone numbers or email addresses.
When our AI assistant calls you, the call is recorded, and you are told so at the start of the call before anything else happens. The recording cannot proceed without that notice.
From that call we keep:
The business you contacted can listen to the recording and read the transcript. So can our staff, but only to operate or fix the service, to investigate a security or abuse problem, or where the law requires it.
If you would rather not be recorded, tell the assistant or the business, and ask to be contacted another way.
Your name, phone number, email, and what you asked about; your consent record — when, where, and how you agreed to be contacted, including the page you were on and your device information; text messages you send and receive; and, if you are booked, the appointment.
Your phone number is stored encrypted, never in plaintext.
Most of what we hold about you is deleted when the business's account is closed and its 30-day export window ends. Recordings are deleted on their own 730-day schedule.
Three things deliberately outlive that, and you should know why:
Depending on where you live you may have the right to know what we hold, to receive a copy, to correct it, to delete it, to opt out of sale or sharing, to limit use of sensitive information, and not to be treated differently for asking. We do not sell or share personal information, and we do not use consumer data for targeted advertising.
Because we act on the business's instructions, the fastest route is usually to ask them. But you can also ask us directly at privacy [arroba] firstfivemin.com, and we will act on it or pass it to them and tell you which. We do not require you to figure out which company to ask.
We acknowledge requests within 10 business days and respond within 45 calendar days, extendable once by a further 45 with notice.
To stop messages immediately: reply STOP to any text. A plain sentence works too — "please stop calling" is honored the same as the word STOP. To stop calls: say so on the call, or tell the business. Any channel, any wording.
If you tell the assistant you don't want to be recorded, the recording of that call is deleted from our systems promptly, and purged from our vendor's systems within 30 days at the latest — and future calls to you are not recorded. Any wording works, in English or Spanish, and the call simply continues — asking not to be recorded never affects your appointment or your place in line.
Model training by our processors. Two of our AI processors are contractually barred from training their models on your information, and we state the third's position plainly rather than rounding it up:
FirstFiveMin is used by some medical and dental practices. Where a practice is a HIPAA covered entity and we handle protected health information on its behalf, we act as a business associate under a Business Associate Agreement, and that agreement governs in place of anything inconsistent here.
If no such agreement is in place, that practice should not be sending us protected health information, and we do not knowingly accept it.
---
| Processor | What it does | What it sees |
|---|---|---|
| Twilio | calls, texts, phone numbers, carrier registration | phone numbers, call and message content, recordings |
| Retell AI | the AI voice assistant | live call audio, transcripts, summaries |
| Anthropic | AI model services | conversation content where used |
| Stripe | subscription billing | business billing data only — no consumer data |
| SendGrid | transactional email | email addresses and message content |
| Google / Microsoft | calendar scheduling | availability, and appointments we create |
We keep this list current. If we add a processor that handles consumer data, we update it here.
Advertising measurement on our public website. On firstfivemin.com's public pages (the marketing pages and the sign-up page — never the signed-in dashboard, and never a business's lead or consent pages) we use the Meta Pixel so we can tell which of our own ads brought a visitor here and whether they asked for a demo call or created an account. We do not send Meta your name, phone number or email. It sends Meta the pages you view on our public site, and if you are logged in to Facebook or Instagram, Meta can connect that to your account. We do not pass it your name, email, or phone number. Meta uses this under its own privacy policy. You can limit it with your browser's tracking settings or through Meta's ad preferences.
We also keep our own count of how visitors reach our public pages — for example, from one of our ads — and whether the visit led to a demo call or a new account. This count does not store your IP address or details about your device. To make that count, our site sets one small cookie of its own that remembers how you first arrived (for example, which ad), for up to 30 days. It does not identify you and is not shared with anyone.
We also count, in the same way, which parts of our pages are used — for example how far a page is scrolled, whether our video is played, which buttons and links are tapped, and at which step of signing up or setting up an account a visit stops. We never record what you type, and this count is not tied to your name, email or phone number.
Referral links. A FirstFiveMin customer can share a link that refers another business to us. If you open one, our site sets two small cookies of its own: one remembers which link you came from, for up to 30 days, and one holds a random code, for up to 12 months, that we use only to tell whether a business is referring itself. A customer's own browser gets the second cookie when they view their referral link. Neither cookie identifies you by name, and neither is shared with anyone.
FirstFiveMin is for businesses. We do not knowingly collect information from anyone under 16. If you believe we have, contact us and we will delete it.
Primarily in the United States. Our service providers may process data in other locations, under agreements that hold them to the commitments described in this policy.
We will post changes here and update the date below. If a change materially affects how we handle consumer information, we will say so plainly rather than quietly revising.
FirstFiveMin 2834 Hamner Ave #1019 Norco, CA 92860 privacy [arroba] firstfivemin.com
Last updated: October 6, 2026
De la misma manera, también contamos qué partes de nuestras páginas se usan — por ejemplo, hasta dónde se desplaza una página, si se reproduce nuestro video, qué botones y enlaces se tocan y en qué paso del registro o de la configuración de una cuenta se detiene una visita. Nunca registramos lo que usted escribe, y este conteo no está vinculado a su nombre, correo electrónico ni número de teléfono.
Consent is not a condition of purchase. Message and data rates may apply. Message frequency varies with your inquiry. Reply STOP at any time to stop messages, or tell us to "stop calling" during any call and we stop calling too. Reply HELP for help.
Mobile opt-in data (your number and your consent to receive messages) is NOT shared with third parties or affiliates for marketing or promotional purposes. We share data only with the service providers that make the communication possible (telephony, messaging, email), and only to deliver it.
Solicitudes de privacidad (acceso, eliminación, baja), preguntas sobre reembolsos o cualquier otro tema. Respondemos por correo.