Privacy Policy

The data controller is Ludovic Courbin, operating as an individual, 64000 Pau, France. For privacy requests contact hello@founderhood.app.

What we collect

Business submissions

When you (or an agent acting with your consent) submit a listing via the website, API, or MCP tools, we collect the fields you provide, including:

• Business name, description, category, country, and optional city
• Website URL (HTTPS)
• Optional founder name and email (used to notify you about review status)
• Optional social links (Twitter handle, LinkedIn profile URL)
• Optional cofounder preferences (open_to_cofounder, cofounder note)
• Optional “how did you hear about us” text

Submissions are stored in our database while pending review and, if approved, published on the public directory. Rejected or spam submissions may be deleted or retained briefly for abuse prevention.

City email alerts

If you sign up for city alerts on a city page, we store your email address, city slug, and city name in our database to send notifications when that feature is enabled.

First-party usage analytics

On production, we record privacy-oriented events in our own database (not sold to ad networks). This includes page views, directory clicks, outbound link clicks, share clicks, search queries, filter use, and CTA clicks. Each event may include page path, optional label, referrer URL, and UTM parameters if present in the URL. We do not record analytics on /admin pages, on localhost, or when an admin “do not track” cookie is set.

Vercel Web Analytics

On Vercel deployments we load Vercel Web Analytics (@vercel/analytics), which collects aggregated performance and usage metrics. Admin routes are excluded via our client configuration. See Vercel's analytics privacy documentation.

Technical data

Like most websites, our host and CDN process IP addresses, user-agent strings, and request logs for security and operation. For submission and tracking endpoints we apply rate limits; submit rate limits may use a hashed client IP stored in our database (Supabase) to prevent abuse.

Why we use your data (legal bases — GDPR)

• Contract / steps at your request — processing submissions, sending transactional emails about your listing, and operating the public directory you asked to join.
• Legitimate interests — securing the service, preventing spam and abuse, understanding aggregate site usage via first-party analytics, and improving the product, balanced against your rights.
• Consent — where required for optional features (e.g. city email alerts) or non-essential cookies/analytics where applicable; you may withdraw consent by contacting us.
• Legal obligation — retaining information where law requires (e.g. tax or regulatory records for the operator).

Retention

• Approved listings — until you ask for removal or we remove them for policy reasons.
• Pending / rejected submissions — typically up to 12 months unless longer retention is needed for disputes or abuse investigation.
• Analytics events — typically up to 24 months, then aggregated or deleted.
• Email alert subscriptions — until you unsubscribe or we delete inactive records.
• Server logs — according to our host's default retention (see processors below).

Your rights

If you are in the EEA, UK, or another region with similar laws, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. You may also lodge a complaint with your local supervisory authority. To exercise rights, email hello@founderhood.app from the address associated with your submission when possible.

Processors and infrastructure

We use vetted service providers who process data on our instructions. Main processors identified in our codebase and deployment:

• Supabase, Inc. — PostgreSQL database for listings, analytics events, email subscribers, coworking imports, directory scores, and rate-limit counters. Project region: eu-central-1 (Frankfurt, Germany, EU).
• Vercel Inc. (United States) — hosts the Next.js application, runs serverless API routes and cron jobs in Frankfurt (fra1) per our project configuration, and serves static assets through its global CDN. Vercel also provides Web Analytics. International transfers rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) where applicable under Vercel's Data Processing Agreement.
• Resend, Inc. — sends transactional email (submission received, listing approved) to addresses you provide.
• Slack Technologies, LLC (optional) — if configured, receives internal webhook notifications about new submissions or operational alerts; content is limited to business metadata for staff review, not marketing to users.
• Ahrefs Pte. Ltd. — monthly API access to public Domain Rating scores for startup directory domains; no personal user profiles are sent.
• OpenStreetMap / public Overpass API instances — geospatial queries to import coworking space listings; no personal data from users is sent in those queries.

Public listing pages may link to third-party sites (founders' websites, social networks). Their privacy practices are their own.

International transfers

Primary personal data storage is in the EU (Supabase Frankfurt). Application logic and CDN delivery may involve processing in the United States and other countries through Vercel. Where required, we rely on SCCs and similar mechanisms offered by our providers.

Children

Founderhood is aimed at founders and businesses. We do not knowingly collect data from children under 16.

Changes

We may update this policy. Material changes will be reflected on this page with a revised date. See also our Legal notice.