Who processes FounderFold customers' data
List as of October 31, 2026. Version 1.1.
This page lists the providers (sub-processors) that process, on behalf of Network Place S.L. (FounderFold), the data our customers store in the FounderFold panel. It is appendix 3 of the data processing agreement, always up to date.
The essentials: customers' database and files are stored in the European Union (Ireland). The other providers process only what they need for their function, and the table says what each one sees and how long it keeps it. Anthropic cannot train its models on what we send it.
| Sub-processor | What for | What data it sees | Does it keep it? | Where | Safeguard if data leaves the EEA |
|---|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore). Data processing agreement · Sub-processors | Database, authentication, files and backups | Everything the panel stores | Yes, this is where the data is stored, for the duration of the contract. When it ends, the data is deleted within a maximum of 90 days | European Union (Ireland). Its group may access it from outside the EEA to provide support | Standard contractual clauses of the European Commission |
| Railway (Railway Corporation, US). Trust centre and sub-processors | Runs the panel's server | Data passes through its server while it responds to each request | It does not keep records, documents or conversations: the panel has no database or disk of its own there. It does keep technical logs (IP address, date, path, browser and server error messages) for up to 30 days. An error message may exceptionally capture some data | The server runs in the European Union (Amsterdam). Railway states that its primary operations are in the US, so logs may be processed there | Standard contractual clauses of the European Commission |
| Anthropic (Anthropic Ireland, Limited, Ireland). Data processing agreement · Sub-processors | AI model of the agents, web search of the Explorer and, if the organization activates this feature, reading portfolio company documents | What each request needs. The text of portfolio company documents arrives pseudonymized. Conversations, records, reports and the configuration do not | Temporarily: according to Anthropic, it deletes it within 30 days; longer only if the law requires it or if a request is flagged as violating its usage policy (up to 2 years). It does not train on it | US and other countries, through its group and its sub-processors. For web search it uses search providers located in the US (as of October 31, 2026: Brave Search, TurboPuffer and Parallel Web Systems, Inc., US) | Standard contractual clauses of the European Commission, in its data processing agreement |
| Resend (Plus Five Five, Inc., US). Data processing agreement · Sub-processors | Sends the service's emails | The destination address, the subject and the text of the email. We do not attach reports, records or documents | 30 days, and its backups, 7 days. It then deletes them | US | EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft (Microsoft Ireland Operations Limited, Ireland). Data processing agreement | Email for hello@founderfold.com and privacy@founderfold.com | The emails sent and received at those addresses | Yes, in those mailboxes, for as long as needed | It may transfer data to the US or to the countries where Microsoft or its sub-processors operate | Standard contractual clauses applied by Microsoft and the EU-US Data Privacy Framework (Microsoft Corporation) |
Changes. Before adding or replacing a sub-processor we notify the owners of each organization, by email and in the panel, at least 15 days in advance. They can object in writing within those 15 days at privacy@founderfold.com (data processing agreement, clauses 5.2 and 5.3). If a provider gives us shorter notice of a change in its own chain, we notify as soon as we know. Our providers' sub-processors appear in their lists, linked in the table. We also notify the changes they communicate to us about that chain, and you can object to them in the same way; if there is no other solution, we switch off the affected function for your organization.
History of this list.
| Date | Change |
|---|---|
| October 31, 2026 | Anthropic: added reading the pseudonymized text of documents, if the organization activates this feature |
| October 30, 2026 | First version published |
Where the infrastructure is and how we protect data against access by foreign authorities
FounderFold's database is in the European Union (Ireland). The panel server runs in the European Union (Amsterdam), but its provider states that its main processing takes place in the United States. The AI model, the Explorer's web search and email sending may process data in the United States, as the table shows. If an authority from outside the EU asked us for access to the data:
- we would only comply if there is a valid legal basis in the law of the Union or of Spain;
- we would notify the Customer first, unless the law prohibits it;
- and we would provide only the minimum data necessary.
Our providers describe their commitments in their data processing agreements, linked above.