Figure First (www.figure-first.com, "the directory", "we", "us") is a business directory run by Nexcee, S-1, 2nd Floor, Olway House, Nr Navneet Press, Gurukul Rd, opp. Bank of Baroda, Ahmedabad, Gujarat 380052, India. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and how you can see, correct or delete it. It applies to the website https://www.figure-first.com/ and the owner dashboard.
Questions or requests: info@nexcee.com (subject "Privacy").
1. Who this covers
- Visitors who browse and search the directory.
- Account holders: business owners and visitors who create an account.
- Business owners who connect their Google Business Profile, Facebook Page or Instagram account so their business appears on the directory.
- People who appear in business content, such as the author of a Google review shown on a business page.
2. Data we collect
2.1 When you browse
- Searches: the words, city and filters you search with.
- Approximate location, only if you press "Near me". It is sent with that search to sort results by distance and is not stored with your account.
- Technical data our server records for every request: IP address, browser type, the page asked for and the time. We use it for security and to fix errors.
2.2 When you create an account
- Your name, email address and, if you give it, mobile number.
- Your password, stored only as a one-way hash. We can never see it.
- Your account type (business owner or visitor).
- If you sign in with Google or Facebook: your name, email address, profile picture and the account ID that Google or Facebook gives our app. We do not receive your Google or Facebook password.
2.3 When a business owner connects Google Business Profile
With your permission (the Google "Manage your Business Profile" permission), we read the Business Profile accounts and locations you manage, and only for the businesses you choose to show:
- Business details: name, categories, address, phone number, website, opening hours, holiday hours, description, opening date and map location.
- Google reviews of the business, with each reviewer's public display name, profile photo, rating, text, date and your reply.
- Photos and posts (updates, offers and events) on the Business Profile.
- Performance figures that only you see in your dashboard: profile views, call clicks, direction requests, website clicks and the searches that showed your business.
When you write a reply to a review in the dashboard, we send it to Google to post on your Business Profile.
2.4 When a business owner connects Facebook and Instagram
With your permission, we read the Facebook Pages you manage and the Instagram business account linked to each Page, and only for the Pages you link to one of your businesses:
- Facebook Page: name, username, category, price range, contact email, follower count, and recent posts (text, image, link, and reaction, comment and share counts).
- Instagram: username, follower and following counts, number of posts, and recent posts (caption, photo or video, link, like and comment counts).
We do not read private messages, and we never post on your Facebook Page or Instagram account.
2.5 What business owners post in the dashboard
Articles, events, press releases and job openings you write, with any images or PDFs you upload.
3. How we use it
- To show business listings on the directory: only the businesses their owner chose to show and confirmed they own or manage.
- To keep listings up to date with the connected Google, Facebook and Instagram accounts.
- To show business owners their own insights and reviews waiting for a reply, and to post their replies on Google.
- To run your account: sign-in, password reset, account settings and account deletion.
- To keep the service safe: blocking repeated failed sign-ins and misuse.
- To answer your messages and tell you about important changes to your account or this policy.
We do not sell personal data, use it for advertising, or build advertising profiles.
3.1 What is public and what is private
- Public on a business page: the business details, Google rating, reviews, photos, posts, Facebook and Instagram follower counts and posts, and the owner's articles, events, press releases and jobs.
- Private: your account details (email, mobile number), your insights, and your connection details. Only you and our authorised staff can see them.
4. Google user data
Figure First's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google data only to provide the features described in section 3 that you can see and use.
- We do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or sale with your notice.
- We do not use it for advertising, and we do not let people read it except with your permission, for security, to comply with the law, or when it has been aggregated and anonymised for internal operations.
- We do not use Google data to develop, improve or train generalised artificial intelligence or machine-learning models.
You can remove Figure First's access to your Google account at any time from myaccount.google.com/permissions.
5. Who we share it with
- Visitors to the directory see the public listing information in section 3.1.
- Other directories run by Nexcee: public listing information may also be shown on other business directory websites operated by Nexcee as part of the same service. Private data is never shared with them.
- Google and Meta, when you sign in with them, connect them, or ask us to post a review reply.
- Service providers who host and run the website for us, under contracts that require them to protect the data and use it only on our instructions.
- Content providers whose images, fonts and maps the pages load (for example Google Fonts, Google user content, Unsplash, OpenStreetMap and cdnjs). They receive your IP address when your browser loads their content.
- Authorities, when Indian law requires it.
6. Where data is stored
Our servers may be located in or outside India. Google and Meta process data in many countries. Wherever data is stored, we protect it as described in this policy and as required by the Digital Personal Data Protection Act, 2023.
7. How long we keep it
- Account data: until you delete your account.
- Data from connected Google, Facebook and Instagram accounts: while the account stays connected. It is refreshed regularly; a listing that cannot be refreshed for 30 days is hidden. Disconnecting deletes that platform's data from the directory.
- Posts you write: until you delete them or your account.
- Server logs: up to 90 days.
8. Security
- The website uses HTTPS.
- Passwords are stored as one-way hashes.
- Google and Facebook access tokens are encrypted before they are stored and are never sent to your browser.
- Repeated failed sign-ins are blocked, and only authorised staff can open the admin area.
9. Cookies
We use only the cookies the service needs:
- Sign-in cookies that keep you signed in (for up to two weeks if you choose "Keep me signed in").
- A short-lived security cookie (15 minutes) while you sign in or connect with Google or Facebook.
We do not use advertising or tracking cookies.
10. Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- see the personal data we hold about you and how we use it;
- correct or update it (most of it directly in Account settings);
- withdraw consent, by disconnecting an account or deleting your account;
- have it deleted (see section 11);
- nominate someone to exercise these rights for you;
- complain to our Grievance Officer, and then to the Data Protection Board of India.
11. Deleting your data
- Disconnect a platform: in your dashboard, Connected accounts, press Disconnect. That platform's data is deleted from the directory straight away and our access is removed.
- Remove one business: in your dashboard, Your businesses, press Remove.
- Delete your account: in Account settings, Delete your account. Your businesses, posts, connections and account are deleted.
- Removed our app in Facebook? We delete your Facebook and Instagram data automatically and give you a confirmation code.
- By email: write to info@nexcee.com with the subject "Delete my data". We delete it within 30 days and confirm by email.
More detail: How to delete your data.
12. Children
The directory is meant for adults. You must be 18 or older to create an account. We do not knowingly collect personal data from children; if you believe a child has given us personal data, write to us and we will delete it.
13. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change affects how we use your data, we will tell account holders by email or in the dashboard before it applies.
14. Contact and Grievance Officer
Grievance Officer, Nexcee
Nexcee, S-1, 2nd Floor, Olway House, Nr Navneet Press, Gurukul Rd, opp. Bank of Baroda, Ahmedabad, Gujarat 380052, India
Email: info@nexcee.com
We reply within 7 days and resolve complaints within 30 days.