Privacy Policy

The First Ten (“the platform”) is operated by The First Ten Ltd (company number 17155442), a company registered in England and Wales. We are the data controller for the personal data described in this policy. Contact: hello@thefirstten.io.

When you use The First Ten, we collect the following personal data:

• Email address — for authentication and account communication
• Session progress and responses — to save your work and write your documents, including anything you note at the start of a session about what has changed since the last one
• Diagnostic responses — to suggest the programme and session that fit where you are. If you took the diagnostic through a team link, your result is counted anonymously in that team’s programme split, and only once at least five people have taken it (see section 5)
• Your programme and session dates — the programme you are on (chosen by you, bought, or set by your employer), and any day you pick for your next session, so we can email you that morning
• Payment information — processed by Stripe; we do not store card details
• Employer seat details — if your employer gave you a seat: your work email, the organisation, your role in its programme, which programme you are on, and the dates of your seat (see section 5)
• Call bookings — if you book a call with us: your name, work email, company, team size, anything you write in the booking form, and the time you chose
• Sections you choose to share — a copy of any parts of your documents you decide to share with your employer (see section 5)
• Emails you send to your manager — a record of who you sent them to, which sections, and when (see below)

Sending sections to your manager. At the end of a session you can email chosen sections of your document to your manager. Nothing is sent unless you choose the sections, see the email and press send. We send it through our email provider, Resend, with your name as the sender and your email address for replies. We keep the recipient’s email address, the names of the sections you sent and the date, so you can see what you have sent. We don’t keep the text of the email. An email can’t be recalled once sent, so what your manager does with it is up to them. Your manager’s address and your name are also remembered in your browser to save you typing them again.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Your data is used solely to deliver the service: authenticating your account, saving your progress, generating AI-powered insights, processing payments, sending the emails you ask for (such as the one on the day you picked for a session) and, if your employer gave you a seat, running their programme as described in section 5. Your session responses are passed to the AI within prompts to generate personalised feedback and are not used to train AI models.

The First Ten sessions involve guided self-reflection that may lead you to share information about your personal beliefs, emotional state, interpersonal relationships, and career anxieties. While we do not require you to disclose special category data (as defined by UK GDPR Article 9), the nature of the exercises means that your session responses may contain sensitive personal information.

By voluntarily entering this information into the platform, you explicitly consent to its processing for the purpose of generating your documents. Your session responses are processed only to deliver the service and are never used for profiling, marketing, or any purpose beyond writing your documents and saving your progress.

Some people use The First Ten through a programme paid for by their employer. If that is you, this section explains what your employer can and can’t see.

What your employer gives us. Your work email address, so we can invite you, and details of the programme: which organisation you belong to, whether you run the programme or take part in it, and when your seat starts and ends.

What the people running the programme can see. Whether you have accepted your invite and started, which programme you are on, how many of its sessions you have finished, and whether you have picked a day for the next one. They can ask us to send you a reminder if you haven’t touched the programme for ten days (at most one a week); the reminder comes from us and says they asked. They also see counts across the whole group of which skills came up and which programme people’s answers fit, but only once at least five people have finished, so that no one’s result can be worked out by elimination. The people running the programme get a weekly email with the same counts.

What they can’t see. Your diagnostic answers, the skill or programme your answers pointed to, which sessions you take outside your programme, anything you write in a session, and your documents. This is enforced in our database, not by a setting your employer can change.

Sharing is your choice. At the end of a session you can choose sections of your document to share with the people running the programme. Nothing is shared unless you choose it. When you do, we store a plain-text copy of just those sections as they were at that moment; later changes to your document are not shared unless you share again. Your manager and colleagues do not see shared sections unless they run the programme. You can change what you have shared, or stop sharing, at any time, and stopping deletes the copy. Whether or not you share has no effect on your seat.

A record of who looked. Each time someone at your employer opens the sections you shared, we record who opened them and when. You can ask us for that record at any time.

If you leave. When your seat ends, your employer loses access to anything you shared. Your account and documents stay yours, and you can keep using, downloading or deleting them.

We process your personal data on the following legal bases:

• Contract performance — to deliver the sessions and documents you have purchased, or that your employer has arranged for you
• Explicit consent — for the processing of sensitive self-reflection data within sessions, and for non-essential product analytics (which you can opt out of via the cookie banner)
• Consent — to share sections of your documents with your employer, which you give each time you share and can withdraw by stopping sharing
• Steps before a contract — to arrange a call you have booked and follow up about it
• Legitimate interest — to improve the service and prevent abuse, and to run an employer’s programme (invitations, seat management and the participation information described in section 5)

We use the following third-party services to deliver The First Ten. Each processes personal data on our behalf:

Where data is transferred outside the UK/EEA, we rely on the provider’s Standard Contractual Clauses (SCCs) or equivalent safeguards.

Essential cookies: We use essential cookies for authentication session management. These are strictly necessary and do not require consent.

Product analytics: We record first-party product events (such as session starts, recommendation clicks, and completion steps) to improve the service. These are non-essential and require your consent, which you can give or refuse via the cookie banner shown on your first visit, and change at any time via the “Cookie settings” link at the bottom of our pages. No third-party tracking cookies are used.

We retain your data for the following periods:

• Account and session data — retained for the lifetime of your account, or until you request deletion. This includes your programme and any session dates you pick
• Diagnostic responses — retained for 12 months from completion, then automatically deleted. A team’s programme split only ever holds counts, never who answered
• Payment records — retained for 7 years as required by UK tax law
• Product analytics — retained for 12 months, then automatically deleted
• Call bookings — deleted automatically 30 days after the call, or straight away if the call is cancelled
• Sections shared with an employer — kept until you stop sharing them or delete your account; your employer loses access when your seat ends
• Records of emails sent to your manager — the recipient, section names and date, kept until you delete your account; the text is not kept
• Employer seat details and access records — kept for as long as your employer’s programme account exists, or until you request deletion

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and notify affected users without undue delay, in accordance with GDPR Articles 33 and 34.

Under GDPR and UK data protection law, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing in certain circumstances
• Port your data to another service
• Object to processing based on legitimate interest
• Withdraw consent at any time (without affecting the lawfulness of prior processing)

To exercise any of these rights, email hello@thefirstten.io. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

For privacy-related enquiries, contact us at hello@thefirstten.io.