This Privacy Policy describes how Foundersi (“we”, “us”) collects, uses, shares and protects your personal data when you visit the website foundersi.pl (the “Website”). It covers the Website only - including the waitlist form, blog, contact channels and cookies. It fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

The Foundersi mobile application has a separate notice: Privacy Policy - App.

In short: on the Website we collect what you type into forms, technical data needed to run the site, and - only if you agree in the cookie banner - analytics. We do not sell your data and we do not use it for advertising networks.

Last updated: 10 September 2026

Version 2026-09

The controller of your personal data is:

• Name: Foundersi Sp. z o.o. (in the process of being formed), Poland
• Registered address: Poland
• Tax ID (NIP) and KRS: pending registration - contact: kontakt@foundersi.pl
• Privacy contact: kontakt@foundersi.pl

A Polish limited company (sp. z o.o.) is being formed. When it is registered in the KRS it will become the data controller and we will update this policy.

We have not appointed a Data Protection Officer. Send all data-protection matters to kontakt@foundersi.pl.

Child safety and reports of sexual exploitation of a child: dev@foundersi.pl.

We process your personal data for the following purposes and on the following legal bases (Article 6(1) GDPR):

• Contact and answering enquiries - Article 6(1)(b) GDPR (pre-contractual steps) or (f) (our legitimate interest in conducting correspondence).
• Running the Website, including the waitlist for the mobile app - Article 6(1)(b) GDPR (performance of a contract / steps prior to a contract).
• Sending a newsletter or similar marketing about Foundersi, if you have opted in - Article 6(1)(a) GDPR (consent), withdrawable at any time.
• Keeping the Website reliable and improving it on the basis of technical data needed to operate the service - Article 6(1)(f) GDPR (legitimate interest).
• Analysing use of the Website (Google Analytics 4, Vercel Analytics) - only after consent in the cookie banner - Article 6(1)(a) GDPR.
• Complying with legal obligations and establishing, exercising or defending legal claims - Article 6(1)(c) GDPR (legal obligation) and (f) (legitimate interest).

We do not sell your personal data. We do not share it with data brokers or use it for third-party advertising. We share it only in the following circumstances:

• With your explicit consent
• With trusted service providers (processors) listed in “Third-party services”, under a data processing agreement (Article 28 GDPR), and only as far as necessary
• When required by law, or to courts or public authorities
• To protect against fraud, security threats or illegal activities, or to prevent serious harm
• If Foundersi is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will update this policy if a different controller takes over.

We protect your data with encryption in transit (TLS), restricted administrative access, and organisational measures appropriate to a public website. No electronic transmission or storage system is 100% secure, so we cannot promise that unauthorised third parties will never be able to defeat our security.

We use cookies and similar technologies (including local storage) to operate the Website, remember your preferences, and - with your consent - analyse traffic. On your first visit we show a banner where you can accept all categories, reject optional cookies, or customise your settings. We do not embed advertising SDKs and we do not track you across other websites for advertising.

Under the GDPR you have the right to:

• Access your data and receive a copy
• Rectify inaccurate or incomplete data
• Erase your data (“right to be forgotten”)
• Data portability - receive your data in a structured, machine-readable format
• Restrict processing
• Object to processing based on our legitimate interests, at any time, on grounds relating to your particular situation
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (cookie banner; unsubscribe from marketing)
• Lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl

To exercise the rights above, write to kontakt@foundersi.pl. We respond without undue delay and at the latest within one month, extendable by two further months for complex requests, in which case we will tell you.

We retain your personal information only for as long as necessary to fulfil the purposes in this policy, unless a longer period is required or permitted by law. When we no longer need the data we delete it or anonymise it. If deletion is not immediately possible because the data is held in backups, we isolate it until deletion is possible.

We entrust processing of Website data to trusted providers acting as processors on our behalf:

• Vercel Inc. - website hosting (policy: https://vercel.com/legal/privacy-policy)
• Supabase Inc. - database for waitlist and site features (policy: https://supabase.com/privacy)
• Vercel Analytics - website traffic analytics (policy: https://vercel.com/legal/privacy-policy)
• Google LLC (Google Analytics 4) - website traffic analytics, only after cookie consent (policy: https://policies.google.com/privacy)

These providers have their own privacy policies. Links from the Website (including blog posts and store listings) are not covered by this notice - review the policy of any site you visit.

Our Website is hosted in the European Union where possible. Some providers (Vercel, Google, Supabase) may process data in the United States. Where data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards at kontakt@foundersi.pl.

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR that would produce legal effects concerning you or similarly significantly affect you.

The Website waitlist is intended for people who can use the Foundersi app, which is only for users aged 18 or over. We do not knowingly collect personal data from anyone under 16. If we learn that we have collected such data, we delete it. Reports of child sexual abuse material or exploitation: dev@foundersi.pl.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours in accordance with Article 33 GDPR and, where the risk to you is high, notify you under Article 34 GDPR.

We may update this Privacy Policy from time to time. The updated version is indicated by an updated “Last updated” date and takes effect when it is published on this page. When we make material changes we will notify you on the Website. Previous versions are available on request.

Questions about this Website Privacy Policy or our data practices:

Privacy and data protection: kontakt@foundersi.pl

Child safety: dev@foundersi.pl