Privacy policy

Who is responsible

The controller for this website and platform is Kaan Özyilmaz, Simon-Dach-Str. 10, 10245 Berlin, Germany.

You can contact us by email at hello@founda.app.

Which data we process

Your account: your email address, name and password. We store only a verification value for the password, never plain text. If you sign in with Google, we receive your email address and name from Google.

Your businesses: everything you and the AI agents create, including ideas, conversations, websites, products, files, emails and your businesses’ customer data.

Payments: you pay for plans and credits through Stripe. We do not see or store your card details.

Technical data: when you visit, the server processes your IP address, the time and the requested address. This is necessary to deliver the page and defend against attacks. For regional page content, we derive an approximate country from your IP address locally on our server, without sending the IP address to a geolocation service.

Waitlist: when you join, we store your email address, idea and selected plan. Your place counts only after you open the link in our email. We use it only to contact you about the waitlist and launch. You can leave at any time using the email link, after which we delete these details.

How we use the data

We use the data to provide the platform, carry out your tasks, bill for them and operate the platform securely.

The legal bases are our contract with you (Article 6(1)(b) GDPR), our legitimate interest in secure operation (Article 6(1)(f) GDPR) and statutory retention obligations (Article 6(1)(c) GDPR).

Cookies

Technically necessary cookies keep you signed in and protect connected services. We host the fonts ourselves.

Optional Google Analytics cookies are set only after you consent. You can change your choice at any time using Privacy settings. We store your selection for up to six months.

Usage statistics

We count page sections, defined user actions and confirmed steps such as created accounts, published websites and activated subscriptions. This helps us identify errors and improve the platform.

Statistics use pseudonymous identifiers. Names, email addresses, IP addresses, passwords, conversation contents and form text are not included. The data stays on our server and is accessible only to the operator team.

For anonymous browser events, a random identifier is kept in the tab’s session storage. Browser measurement respects Do Not Track and Global Privacy Control. Analysis covers at most 90 days. Older statistics events are regularly removed.

Technical error observation

For troubleshooting, we also record limited technical events: the current setup step, form starts, submissions, leaving a started input and the server result of a user action. The additional browser identifier remains only in the memory of the open tab. We set no additional cookies for this and store no input text, full URLs, device fingerprints or IP addresses. Do Not Track and Global Privacy Control are respected.

These events stay on our server for at most seven days. In the access-protected admin area, we can view them alongside already saved account details, the submitted business idea and the actual task status. Browser abandonment events are indications, not conclusive evidence of their cause.

Technical error reports and limited AI assessments contain fixed workflow identifiers, error codes and technical states, not private messages, names, email addresses, passwords or payment details. Technical error reports are retained for up to 30 days and may be sent to the notification address configured by the operator.

Google Analytics

With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Measurement includes page sections, public campaign identifiers, device information, registrations and confirmed Founda purchases. A pseudonymous browser identifier connects these steps for analysis. Names, email addresses, ideas, conversation contents and form text are not sent to Analytics.

Google also processes technical data such as your IP address when connecting. Processing in the United States is possible. Information about Google is available at https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites. Google signals, advertising personalization and automatic form capture are disabled.

The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Do Not Track and Global Privacy Control prevent browser measurement. Withdrawing consent stops new Analytics events from this browser and removes its server-side association. Data already transmitted is not automatically deleted. The server-side association expires after 30 days and is renewed only with valid consent. Analytics cookies and your consent expire after six months at the latest.

Who receives data

The AI agents work with services we commission or that you connect yourself. Each service receives only the data it needs for its task.

Payments: Stripe. Email sending: an email delivery service. AI models: language model providers process the contents of your tasks so the AI agents can work.

Only if you connect or use them: Google for sign-in, Telegram for approvals, Meta and X for your business’s posts and ads, and a registrar for domain purchases.

Some of these services are based in the United States.

Your job application

When you apply to Founda, we process your name, contact details, desired role and region, start date, cover letter and resume. You may optionally include salary expectations and a portfolio link.

We use the documents to decide on your application and communicate with you. The form sends them through our email service Resend to hello@founda.app. They are not stored in your product account or used for marketing. Access is restricted to the team handling your application.

The legal basis is deciding whether to establish an employment relationship under section 26(1) BDSG. After the application process ends, we delete the documents within six months at the latest, unless legal grounds require longer retention. If you are hired, the necessary details are transferred to your personnel records.

Send questions about your application or deletion of your documents to hello@founda.app.

Your businesses’ customers

You are responsible for your business’s customer data. We process it on your behalf and only to operate your business.

How long we retain data

We retain your data for as long as your account exists. We delete your account and data at your request.

We retain invoice data for as long as required by law.

Your rights

You have rights of access, rectification, erasure, restriction of processing, data portability and objection.

You can complain to a data protection supervisory authority. In Berlin, this is the Berlin Commissioner for Data Protection and Freedom of Information.

Last updated: October 2026.