Privacy policy

Last updated September 26, 2026

This policy explains what personal data FirstReplyPro ("we", "us") collects, why we collect it, how long we keep it, and who we share it with. It applies to the FirstReplyPro service and to this website.

FirstReplyPro is operated by Samgar Abdikozha, a sole proprietor, 430 Grand Cypress Dr Apt 740, St. Johns, FL 32259, United States.

Pilot status: FirstReplyPro is running as a pilot. Pros with an account (currently by invitation) connect their own Thumbtack business and choose whether first replies are only drafted or sent automatically. It uses Anthropic’s API to generate the first reply based on the available lead details and conversation. Pros can also turn on an optional follow-up assistant, which prepares the next messages in a conversation — a question about a missing detail, an estimate calculated from the Pro’s own price list, appointment times, or an appointment confirmation. Each of these is sent only after the Pro approves that exact message.

Who the data belongs to

Two groups of people are involved. Pros are the service professionals who sign up for FirstReplyPro and connect their Thumbtack account. Customers are the people who contact a Pro through Thumbtack. We hold data about both, and we treat customer data as belonging to the customer and to the Pro they contacted, never to us.

What we collect

From a Pro when they sign up: name and email address, plus either a password (we store only a one-way argon2 hash, never the password itself) or, if they choose “Continue with Google”, the Google account identifier, name and verified email address that Google shares with us. We also keep the Pro’s settings (on/off, drafts or sending, the questions to ask for each service, reminder timing, working hours), the price list they enter (services, prices and time estimates), their booking preferences (time kept free between jobs, how far ahead to book, days off), and a security log of sign-ins and account changes (time, type of event and IP address; no passwords or message content).

From Thumbtack, once a Pro connects their account and approves access: the business profile associated with that account, and for each lead the Pro receives — the customer's name, the city or area they are in, the job address and preferred times if supplied, the details they entered about the job, and the messages exchanged in that conversation. Thumbtack's notification may also include the customer's phone number and the lead price; we do not store these or send them to our AI provider. We also receive and store access and refresh tokens issued by Thumbtack so the service can keep working without the Pro signing in again.

If a Pro turns on the follow-up assistant, we also create and store, for each conversation it works on: which of the Pro’s services and quantities the customer asked for, together with the customer’s own words they were matched from; the messages proposed to the Pro; whether the customer accepted or declined an estimate; the appointment times offered; and any appointment the Pro approves (its date, time, expected length and the job address).

From this website: operational request and error metadata where logging is enabled. Logs exclude OAuth credentials, authorization headers, callback query strings, and token response bodies. We use only strictly necessary, secure cookies: a sign-in session cookie for Pros that lasts up to 12 hours (access expires after 60 minutes without activity, and the cookie is removed when they log out), and short-lived cookies that protect forms and the Google and Thumbtack sign-in steps (one hour or less) or show a one-time message (two minutes). We do not use advertising trackers, analytics cookies or third-party pixels.

Why we collect it

Lead and message data is used to identify a new lead, generate a relevant AI-written first reply and send it into that Thumbtack conversation (or keep it as a draft, if the Pro chooses), and prevent duplicate replies. If the Pro turns on the follow-up assistant, it is also used to prepare follow-up messages for the Pro to approve: questions about missing details, estimates calculated only from the Pro’s own prices, appointment times based on the Pro’s availability, and appointment confirmations. The AI does not set prices; estimates are calculated from the Pro’s price list, and an appointment exists only once the Pro approves it. Account data is used to operate the Pro's account and contact them about the service.

We do not use customer data to build profiles, to train models for anyone else's benefit, or to market anything to customers.

Who we share it with

We do not sell personal data. We do not share a Pro's leads with any other Pro. We disclose data only to the following:

• Thumbtack, when we post a first reply, or a follow-up message the Pro approved, back to a conversation on the Pro's behalf.
• Our hosting provider, Hetzner Online GmbH, which stores the data on a server we control located in Ashburn, Virginia, United States.
• Resend, Inc., which delivers our emails to Pros (email confirmation, password reset, reminders that a customer is waiting, notices that a follow-up or an appointment is waiting for the Pro’s approval, and service problems). It receives the Pro’s email address and the message; reminders, approval notices and problem notices contain no customer names, addresses or message text.
• Google LLC, only for Pros who choose “Continue with Google”, to confirm their identity. We do not send lead or customer data to Google.
• Anthropic, PBC, through its API, to generate the first reply and to check it before it is sent. If a Pro turns on the follow-up assistant, also to identify which of the Pro’s services the customer is asking for and to understand the customer’s answer to an estimate or to offered appointment times; for this we send the conversation, the names of the Pro’s services (not their prices), today’s date and the times offered. We send only the project details and relevant conversation needed for these tasks. These may include the customer’s name, job description, location or job address, and preferred times when included in the inquiry. We do not send Thumbtack access or refresh tokens to Anthropic. Anthropic does not use commercial API inputs or outputs to train its models by default; processing is subject to its commercial terms and retention policies. See Anthropic’s API data-use information.
• Law enforcement or a regulator, where we are legally required to.

If FirstReplyPro is ever acquired, personal data may transfer to the acquirer. We will notify Pros by email before that happens.

How long we keep it

Lead and message data, including follow-up proposals and appointment details, is retained for 24 months from the date of the conversation, then deleted. Pro account data is retained for as long as the account is open; a business’s price list and booking preferences are kept while that business is connected. Sign-in sessions are deleted when they expire, email links a day after they are used or expire, and the security log after 12 months. Server logs are kept for no more than 30 days, then deleted automatically. Encrypted backup snapshots taken when we update the service are kept for at most 14 days.

When a Pro disconnects their Thumbtack account, we stop receiving new data immediately, remove our webhook at Thumbtack, and delete the stored tokens, that business’s settings (including its price list and booking preferences) and its lead, reply, follow-up and appointment history. When a Pro deletes their account in the dashboard, we also delete the account itself right away. Only security-log entries (which contain no customer data) and the backup snapshots described above remain until they expire.

How we protect it

Data is encrypted in transit using TLS. Thumbtack tokens are stored encrypted, are readable only by the service itself, and are never written to logs. Reply drafts, follow-up messages, the customer’s words they were matched from, and appointment addresses are stored encrypted as well. Server access requires SSH key authentication with password login disabled, and the hosting account is protected with two-factor authentication.

Your rights

You can ask us to give you a copy of the personal data we hold about you, correct it, or delete it. Depending on where you live you may also have the right to object to certain processing or to complain to a data protection authority.

Email privacy@firstreplypro.com and we will respond within 30 days. If you are a customer who contacted a Pro through Thumbtack and you want your data removed from our systems, write to the same address — you do not need to go through the Pro.

Children

FirstReplyPro is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes

If we change this policy in a way that materially affects how we handle your data, we will email Pros at least 14 days before the change takes effect and update the date at the top of this page.

Contact

privacy@firstreplypro.com
Samgar Abdikozha, 430 Grand Cypress Dr Apt 740, St. Johns, FL 32259, United States