FounderFold service privacy policy

1. Who the controller is

Network Place S.L., which operates FounderFold. NIF B40203689. C/ Pablo Freire, 10, local 3, 28918 Leganés (Madrid), Spain. Registered in the Madrid Commercial Registry, sheet M-467773, section 8.

Contact for anything relating to your data: privacy@founderfold.com. We have not appointed a data protection officer because we are not required to.

2. Two different roles

a) Controller. We decide why and how this data is processed:

• your account and your access;
• the security of the service;
• the commercial relationship with, and billing of, your organization;
• the measurement of AI consumption;
• service notices;
• support and the enquiries you send us;
• the data of other people who appear incidentally on the public pages the Explorer reads, and the key people of candidate companies (section 10);
• and, only if your organization turns them on, the FounderFold Expert improvement signals (section 9).

b) Processor. Your organization decides what it keeps in FounderFold and why, and we process it only on its instructions, under the data processing agreement under Article 28 of the GDPR that it signs with us. This includes:

• portfolios, ideas, projects, experiments, records, documents and logos;
• conversations with FounderFold's AI (including those with FounderFold Expert and the screenshots you attach to them) and reports;
• your organization's own agents and instructions;
• the Explorer's configuration (criteria, notes and exclusion lists), its rounds, its records and its memory of what it has already seen, except for key people (section 10);
• the sending of reports to people outside your organization;
• the activity log: work actions, who performed them and when;
• AI usage: each time you, or an agent at your request, use the AI, with the project, the agent, the type of task and the date. It lets your organization control its spending and, if it enables the per-person breakdown, lets owners see each member's usage. Your user is removed from these logs after 12 months or when you leave the organization;
• the usage log, only in organizations where proactivity is enabled: which sections of the panel you open and which searches and filters you apply in the list of ideas, with your user and the time. Only you can see it. It allows FounderFold to suggest improvements to the way you work, and it is deleted after 180 days.

For this data, the controller is your organization. If you wish to exercise your rights over it, contact your organization. If you write to us, we will pass your request on to it within a maximum of 5 working days and help it to respond to you.

What your colleagues see. Within your organization, the other members see your name, your email and your role, the work actions you perform and your conversations with the AI, with the screenshots you attach while they are retained, including those you have with FounderFold Expert. People with access to a portfolio see what the Explorer has saved in it and who requested each round. All members see the organization's AI usage by project, by agent and by type of task, as a number of uses and a percentage of the month's limit; in small teams, these figures may reveal each person's usage. You can always see your own. If an owner enables the per-person breakdown, from that moment owners also see each member's usage, and the panel tells the whole team so. Only you can see your usage log. If your organization asks us for an export of its data (clause 13 of the terms), the copy received by the owner who requests it includes the full activity log, also each person's usage log, and the AI consumption of each call with who made it, while they are retained.

3. What data we process as controller, why and on what basis

Required data. Your email is required to have an account: without it we cannot give you access. The rest of your profile data is optional.

We do not make automated decisions about you that have legal effects or that significantly affect you (art. 22 GDPR).

4. FounderFold's artificial intelligence

• FounderFold's agents (FounderFold Expert, the Explorer and the other agents in the room) are artificial intelligence systems. Their replies, drafts, proposals, records and reports are generated by an AI model and may contain errors.
• To generate them, our server sends the model only what is needed for that request: your message and the screenshots you attach, the history of that conversation (with its screenshots, while they are retained), the agent's instructions and the information of your organization that you have access to and that is needed to respond (for example, a project's records or the portfolio's configuration). The model keeps no memory for other requests, except for short-lived technical caches within your organization, and it does not mix data from different organizations.
• The model is from Anthropic, which acts as our sub-processor and may not use this data to train its models. We explain this in section 6.
• The AI proposes; people decide. FounderFold does not change records, launch tasks or make decisions without a person approving them. The records the Explorer proposes come in as a “proposal” and are reviewed by a person.

5. Who processes data on our behalf (processors and sub-processors)

The essentials:

• Your organization's database and files are stored in the European Union (Ireland).
• We do not sell your data or disclose it to third parties, unless the law requires it.
• Each provider processes it only for its function, on our behalf and under contract.
• Anthropic, our AI provider, cannot train its models on what we send it.
• Some providers are in the United States or may process data there. The table says, for each one, what it sees, what it keeps, for how long and under which safeguard.

The full, up-to-date list of those who process your organization's data, with planned changes, is at founderfold.com/subprocessors.

International transfers. When a provider processes data outside the European Economic Area, in a country without an adequacy decision, or may access it from there, the safeguard in the table applies. The standard contractual clauses are those of the European Commission (GDPR art. 46.2.c). In the case of Anthropic, we contract with its Irish company. Its data processing agreement incorporates those clauses and requires it to impose equivalent protection obligations on its sub-processors, including its search providers, and to be liable for them. You can ask us for a copy of the safeguards at privacy@founderfold.com.

6. Anthropic, our AI provider

• Training: under its commercial terms, Anthropic cannot train models on the content we send it.
• What it receives: what is described in section 4, only when someone uses an AI feature, and, in Explorer rounds, the search queries the system writes from the portfolio configuration. It does not receive your password, your billing data or the security logs. Nor does it receive your 👍/👎 rating of answers, which stays in FounderFold.
• What for: only to generate the answer or run the search and return it to us.
• What is pseudonymized and what is not: the text of portfolio company documents is pseudonymized (below). Conversations with the agents, screenshots, records, reports, the configuration and Explorer queries are not pseudonymized: they arrive as written, because the model needs them to respond. That is why we ask you not to include personal data in them that is not needed.
• Retention: according to Anthropic, it deletes the inputs and outputs of its API within 30 days. It may keep them longer if the law requires it or if a request is flagged as violating its usage policy: in that case, for up to 2 years, and its safety scores for up to 7 years. We do not have a zero retention agreement.
• Web search: Explorer searches are run by Anthropic's web search tool, which reads public pages and in turn uses search providers located in the United States. Search queries also reach those providers. Anthropic does not publicly detail what data from each query they receive or how long they keep it. FounderFold does not receive the full text of the pages: only their address, their title and brief quotes.
• Who and where: we contract with Anthropic Ireland, Limited, in Ireland. Anthropic may process data in the United States and other countries, through its group and its sub-processors. The safeguards for processing outside the EEA are those of its data processing agreement.

This information is published by Anthropic and may change. If it changes in a way that affects what we say here, we will update this policy and notify your organization.

Portfolio company documents with AI. If your organization activates this feature, the text of the documents you upload is sent to the Anthropic API to read it and extract its figures. That processing takes place outside the European Union (United States or global), with the standard contractual clauses as the safeguard, and Anthropic keeps what it receives for the periods in this section. Before sending it, our server replaces the identifiers of people, their contact details and their tax data that it detects with pseudonyms, and restores them when it receives the response. The correspondence table is stored encrypted, per organization, and expires 30 days after its last use. Automatic detection is not perfect, and figures, company names and business content are not pseudonymized. Documents are kept until your organization deletes them; if it deletes the portfolio company, they are deleted after 30 days. Each access is logged. This feature is also governed by the annex to the data processing agreement.

7. Cookies and storage in your browser

They are strictly necessary to provide the service you request, which is why they do not ask for consent (art. 22.2 LSSI). The panel does not use analytics or advertising cookies. Local storage is not sent to us.

8. People who do not use FounderFold

Your organization's records, documents and reports may contain data about other people (for example, a project's contacts or a report's recipients). Your organization processes it as controller, and we process it on its behalf. Informing those people and having a legal basis for it is your organization's responsibility. If one of those people writes to us, we will pass their request on to the organization. What the Explorer reads on public pages, including the key people of candidate companies, has its own regime, in section 10.

9. Improving FounderFold with questions to FounderFold Expert

When it applies. Only if the owner of the organization for which you use FounderFold has enabled “Help improve FounderFold”, and as long as you do not object.

Where the data comes from. From the questions you ask FounderFold Expert in your organization's account.

What we do. When you ask FounderFold Expert something, the same AI model that answers you classifies your question:

• what type of query it is: a question, something you cannot find, a request, a bug, a complaint or other;
• which part of FounderFold it is about;
• whether the reply resolved your question.

For requests and bugs, the model also adds a short sentence, in Spanish, describing the need. The model writes it in its own words, without copying your question, and it is designed not to contain names, emails, figures or data about your business. Before saving it, our server checks it and discards any that contain such data or repeat your question. Even so, the automatic check may not catch everything. If you rate the reply with 👍 or 👎, we also save that rating.

What we save. The classification, the sentence (when there is one), the rating, the organization, the week and the version of the manual. In this log we do not save the text of your question or of the reply, your name, your email or your user. We do not cross-reference it with your conversations or with other usage data. We separately save who enabled the setting in your organization and when, as proof of the authorisation.

What for. To learn which parts of FounderFold cause confusion, what is being asked for and what is failing, so that we can correct the manual and the screens and decide what to build. We analyse it as a whole, counting how many different organizations ask for the same thing. We do not use it to make decisions about you or your organization, for advertising or to train AI models. Nor do we sell it or disclose it to third parties.

Legal basis. Our legitimate interest in improving the service your organization contracts (Article 6.1.f of the GDPR). Before starting we check that your rights do not override it, and we document this. You can ask us for that assessment at privacy@founderfold.com.

Your right to object. You can object whenever you wish, without giving reasons:

• with “Don't use my questions to improve FounderFold” in your profile;
• or by writing to privacy@founderfold.com.

From that moment, the model stops classifying your questions. As for earlier signals:

• we delete those from weeks in which your organization had fewer than 3 members;
• for the rest, the log does not record who asked, and we cannot locate yours unless you give us details that allow it, such as the week and the topic. In that case we search for them and delete them. Otherwise, they are deleted automatically when the period ends.

Who processes them for us. Anthropic (it classifies the question in the same request in which it answers it), Supabase (it stores them in the European Union) and Railway (it hosts the server that writes them), with the safeguards in section 5.

How long.

• Each signal is kept for 12 months from the week of the question. It is then deleted.
• Only monthly counts remain, which group at least 3 organizations and do not allow any of them to be distinguished.
• We also keep, without the organization and only with the month, the sentence describing a request when at least 3 different organizations have asked for it, so as not to lose the history of what is being asked for.
• If your organization leaves FounderFold, its signals are deleted within 30 days.

10. The Explorer

What it is. The Explorer is an AI agent that searches the internet for companies, products and business ideas using a portfolio's criteria and leaves company records, with their sources, for a person to review. It searches only when a person with permission to edit the portfolio launches a round. It only searches for people to find out who has a role in each candidate company (the “key people”), and only in that role. It does not create records of people or assess them.

Two roles.

• What your organization enters (the criteria, notes and exclusion lists in the configuration, the conversation to configure it) and what the Explorer saves in the portfolio for your organization (the records, each round with who requested it, its detail and the memory of what it has already seen) we process as a processor, on your organization's behalf and under its data processing agreement (section 2.b), except for key people.
• The data of other people who appear incidentally on the public pages the Explorer reads (for example, the name of a journalist or a customer in a news article) we process as a controller, because we decide how they are searched for and how they are filtered. Except for key people, its only purpose is to be able to discard them.
• The key people of candidate companies (below, “Key people of each company”) we process as a controller, even though they appear within your organization's records and rounds.

Legal basis for what we process as a controller. Our legitimate interest, and that of the organizations to which we give access to the Explorer, in studying companies, products and markets to find business opportunities, and in knowing who runs, founded, is part of or owns the companies they study (Article 6.1.f of the GDPR). Before starting we check that the rights of those people do not override it, with the measures in this section, and we document this in our record of processing activities and in an impact assessment. You can ask us for that assessment at privacy@founderfold.com.

How we protect those people.

• Filter before saving. Before saving anything, our server runs an automatic filter that discards the names of people (except key people, who go in a separate field with their source), emails and telephone numbers, and sets aside any company whose name looks like that of a person (a self-employed professional may use their own name as a company name). Filters are not exact.
• Key people of each company. For each candidate company we save, at most, 10 people who have a role in it and whom a public source presents as such: its directors, its shareholders where the source identifies them as such (sole shareholder, founder and shareholder, or with their published stake), its founders, its executives, the team and the board the company itself presents, individual investors announced by the company or the press and, if the company is a self-employed professional, that professional. We save their name, their role, the public source of each item of data (for example, the Official Gazette of the Commercial Registry, the company's website or the press) with its date and, if the search engine returns it and we check that it is the same person, the link to their public professional LinkedIn profile. We also cite, with a short excerpt, LinkedIn posts by the company itself or by those people that talk about the company; those of the people are deleted along with the rest of their data. We do not save their personal contact details, or data about their health, their beliefs or their private life, or their debts or past records, or opinions about them. We do not access LinkedIn or other social networks with our own tools. Of any other person who appears on the pages, we save nothing.
• Short quotations. From each source, FounderFold receives only the address, the title and quotations of up to 150 characters. We do not receive the full text of the pages.
• Forums and communities. If the Explorer finds open forums or communities, it only counts how many conversations deal with the same problem. It does not save what anyone writes, or usernames, or links to profiles: at most, the link to the conversation. It does not search forums where people talk about their health, religion, politics, trade union membership, sexuality or ethnic origin. On those topics it only uses forums of professionals and companies in the sector, from a list we review, to learn about their business problems, and it discards conversations it recognises as being about a specific person.
• Excluded domains. We maintain a list of websites the Explorer does not consult.
• No decisions about people. We do not use this data to make decisions about anyone or to create profiles.

What is saved and for how long.

Anything the filter does not recognise may remain in those logs for those periods. If we detect it, we delete it.

Who sees it and who processes it. What is saved can be seen by people with access to the portfolio in which the search was run, including in the PDFs they download. If your organization shares a PDF outside FounderFold, that sharing is its responsibility. It is processed for us by Anthropic (the model and web search, with its search providers in the United States), Supabase and Railway, with the safeguards in section 5.

Your right to object. If you are a person whose data may appear on a public page, you can object to this processing or ask us to erase your data by writing to privacy@founderfold.com, stating the name, website or link concerned. We search for it in the memory of what has been seen, in the detail of rounds and in the records of all organizations, we delete it and, if the website is yours and you object, we add it to the list of websites the Explorer does not consult. If you object, we make a note of you so as not to save your data again in any search. We reply within one month at most. If you contact a FounderFold customer organization about any of this data, that organization passes your request on to us within a maximum of 5 working days and we deal with it. You can also exercise the other rights in section 11.

What we ask of your organization. Do not enter other people's data in the Explorer's configuration: only companies, sectors and criteria. Do not use it to search for people in their own right. You may use key people to evaluate the company and to deal with it; if you contact one of those people on the basis of what you see in FounderFold, tell them in that first contact that their data comes from public sources through FounderFold and link to the privacy policy of founderfold.com. Do not use them for mass commercial mailings or for purposes unrelated to the company. If you see data about any other person in a record or a round, do not copy it or use it outside FounderFold, and let us know at privacy@founderfold.com so that we can delete it.

11. Your rights

For the data of which we are the controller, you can request access, rectification, erasure, restriction and portability, and you can object to processing based on legitimate interest. Write to privacy@founderfold.com stating what you are requesting. We will reply within one month at most (extendable by two more months in complex cases, with notice to you). We may ask you to prove your identity if there are reasonable doubts.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD) (www.aepd.es) or to the data protection authority of your country.

12. Changes

If we change this policy in a relevant way, we will give notice in the panel and by email to the owners of each organization before it applies. Earlier versions remain available at founderfold.com/service-privacy/versions.