Effective date: July 7, 2026
Data Fiduciary / Controller: Unscript AI Private
Limited (“FirstShow”, “we”,
“us”)
Registered office: 3rd Floor, No. 552, 14th Main, 22nd
Cross, Bengaluru, Bengaluru Urban, Karnataka 560102, India
Contact / grievance: contact@unscript.ai
This Privacy Policy explains how we collect, use, share, and protect personal data when you use the FirstShow apps (iOS, Android), and website (together, the “Service”). It is written to address India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), the EU/UK GDPR, US state privacy laws (including California CCPA/CPRA), and the disclosures required by the Apple App Store and Google Play.
FirstShow is operated by Unscript AI Private Limited. For the purposes of the DPDP Act we are a Data Fiduciary; under GDPR we are a data controller; under CCPA/CPRA we are a business.
| Category | Examples | Source |
|---|---|---|
| Account / identity | Name, phone number, email, chosen display name, profile picture (default avatar or, later, an uploaded photo) | You / your sign-in provider |
| Authentication | Sign-in method (phone OTP, Google, Apple, email/password) and provider identifiers, managed via Firebase Authentication | Firebase / Google / Apple |
| Date of birth | Day, month and year, asked once when you create an account | You |
| Preferences | Selected interests, followed creators, “My List”, onboarding answers | You |
| User-generated content | Promo clips you record; for creators, titles/episodes and related metadata | You |
| Payment-related | Purchase records, transaction IDs, amounts, coin balance and coin ledger; payment credentials are never seen or stored by us - on iOS they stay with Apple, on web/Android with Razorpay | You via Apple or Razorpay |
| Communications | Messages to support/grievance, feedback | You |
| Category | Examples |
|---|---|
| Usage / viewing | Titles viewed, watch progress, follows, searches, taps on shared promo links |
| Device / technical | Device model, OS version, app version, language, IP address, coarse region, network type |
| Diagnostics | Crash reports, error logs, performance data (via Sentry) |
| Cookies / local storage | On the website - see the Cookie Policy |
We do not seek precise GPS location, contacts, health data, or advertising identifiers for cross-app tracking. Camera and microphone are used only when you record a promo clip, with your permission, per the on-device permission prompts.
| Purpose | Data used | Legal basis (GDPR) | DPDP basis |
|---|---|---|---|
| Create and secure your account; authenticate you | Identity, authentication | Contract; legitimate interests (security) | Consent / performance of the service you request |
| Deliver and stream content; remember progress | Usage, viewing, device | Contract | Necessary for the service you request |
| Check you meet the minimum age and keep titles rated above your age out of your feed, search and playback | Date of birth | Contract; legal obligation | Necessary for the service and for age-rating obligations |
| Personalise the feed (interests, followed creators, recommendations) | Preferences, usage | Legitimate interests / consent | Consent |
| Process purchases and unlocks; prevent payment fraud | Payment-related, device | Contract; legal obligation; legitimate interests | Necessary for the service; legal obligation |
| Enable and moderate User Content; safety and abuse prevention | UGC, usage, reports | Legitimate interests; legal obligation | Necessary; legal obligation |
| Provide AI features (avatars, voice, lipsync, promo generation) | Content you submit for processing | Contract; consent (for likeness/voice) | Consent |
| Diagnose crashes and improve reliability | Diagnostics, device | Legitimate interests | Legitimate/legally recognised use |
| Communicate service messages and respond to requests | Contact info, communications | Contract; legitimate interests | Necessary; consent for marketing |
| Comply with law, enforce Terms, respond to legal requests | As relevant | Legal obligation; legitimate interests | Legal obligation |
Where we rely on consent (e.g., certain personalisation, likeness/voice for AI, marketing), you may withdraw it at any time (Section 9); withdrawal does not affect processing already carried out.
FirstShow uses AI to create and modify content, including AI avatars, AI voice, and lipsync, and AI-assisted promo generation. Where we process a real person’s likeness or voice, we do so on the basis of consent and the safeguards in the AI & Synthetic Media Policy.
We share personal data with the following categories of recipients, under contracts requiring appropriate protection. We do not sell personal data.
| Subprocessor | Role | Data shared | Location / notes |
|---|---|---|---|
| Google - Firebase Authentication | Sign-in / identity | Phone, email, provider IDs | Google Cloud; see Google privacy terms |
| Google / Apple | Social & platform sign-in | Provider account identifiers, name/email if you allow | Per provider policies |
| Cloudflare Stream | Video hosting and delivery (signed playback) | Streaming requests, device/IP, tokens | Global CDN |
| Apple | In-app purchase of coins (iOS) | Transaction identifiers and receipts we verify to credit coins; Apple holds the payment details | Per Apple privacy terms |
| Razorpay | Payment processing outside the iOS app | Payment details, order data, contact | India; PCI-DSS scope on Razorpay |
| Microsoft Azure | Cloud hosting / infrastructure | Application and stored data | US (Azure East US 2) |
| Sentry | Crash / error / performance monitoring | Diagnostics, device, limited identifiers | Sentry SaaS (US region) |
We may also disclose data (a) to comply with law, court orders, or lawful government requests (including, in India, within the timelines set by the IT Rules, 2021); (b) to enforce our Terms or protect rights, safety, and property; and (c) in a merger, acquisition, or asset sale, with notice as required by law.
FirstShow serves users in India and globally, and our subprocessors may process data outside your country (e.g., in the US, EU, or other regions). Where we transfer personal data internationally, we use appropriate safeguards, such as Standard Contractual Clauses (for GDPR/UK transfers) or equivalent measures, and we transfer only to jurisdictions permitted under the DPDP Act and applicable law.
We keep personal data only as long as needed for the purposes above or as required by law:
| Data | Indicative retention | Notes |
|---|---|---|
| Account data | While your account is active; deleted or anonymized within 30 days of account deletion, subject to residual copies in backups | |
| Date of birth | While your account is active; deleted with your account | Held as day, month and year, never shown to other users |
| Viewing / usage | While your account is active (powers your watch history and recommendations); deleted with your account | |
| Purchase / tax records | 7 years or as required by tax/accounting law | Legal obligation |
| Coin wallet and coin ledger | Retained with purchase records (7 years) | Deleting your account ends access to any balance; it is not recoverable and not transferable to a new account |
| Diagnostics (crash/error reports) | 90 days | |
| Support / grievance records | Until resolved, then up to 3 years for audit and dispute purposes | |
| Backups | Rolling cycle; expired copies are purged within 60 days |
Where a longer period is required by law (e.g., tax, accounting, or dispute resolution), we retain only what is necessary for that purpose.
Depending on where you live, you have some or all of the rights below. To exercise any right, contact contact@unscript.ai or use in-app settings; we will verify your identity and respond within the legally required time (e.g., DPDP: within a reasonable period; GDPR: within one month; CCPA: within 45 days). Where required by applicable law, we also honour recognised universal opt-out preference signals (e.g., Global Privacy Control).
We will not discriminate against you for exercising these rights.
FirstShow is not directed to and is not intended for children. Under the DPDP Act, a child is anyone under 18, and processing a child’s data requires verifiable parental consent; the Act also prohibits tracking, behavioural monitoring, and targeted advertising directed at children. We require account holders to be at least 18, we do not knowingly collect children’s data, and we do not run behavioural advertising to anyone. If we learn we have collected a child’s data without the required consent, we will delete it. Parents/guardians who believe a child has provided data may contact contact@unscript.ai.
We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), signed and token-gated video playback (Cloudflare Stream), access controls, scoped per-user data access (reviewed for IDOR/injection), hardened payment-webhook verification, and monitoring. No system is perfectly secure; in the event of a personal-data breach we will notify the Data Protection Board of India and affected individuals as required (the DPDP framework contemplates reporting to the Board, with detailed reporting expected within short statutory timelines), and comply with GDPR (72-hour) and other applicable breach-notification laws.
The FirstShow website uses cookies and local storage for essential functionality, security, and limited analytics. See the Cookie Policy. The mobile apps use device/local storage rather than browser cookies.
Complaints are acknowledged within 24 hours and resolved within 15 days under the IT Rules, 2021; data-protection grievances are handled within the period required by the DPDP Act.
We may update this Policy and will post the new version with a revised effective date; for material changes we will provide reasonable notice. Continued use after the effective date constitutes acceptance where permitted by law.
Questions or requests: contact@unscript.ai, or write to Unscript AI Private Limited, 3rd Floor, No. 552, 14th Main, 22nd Cross, Bengaluru, Bengaluru Urban, Karnataka 560102, India.