Foundersi is operated from Poland. A limited company is currently being formed; until it is registered, data-protection matters go to the contact below.

• Data controller: Foundersi Sp. z o.o. (in the process of being formed), Poland
• Company status: a Polish limited company (sp. z o.o.) is being formed. Registration in the KRS, and the NIP and REGON numbers, are pending. When the company is registered it will become the data controller and we will update this policy and notify you in the App.
• Privacy contact: kontakt@foundersi.pl
• Child safety contact: dev@foundersi.pl
• Data protection officer: we have not appointed a Data Protection Officer. Please send all data-protection matters to kontakt@foundersi.pl.

If you are in the European Economic Area or the United Kingdom, we process your data under the GDPR (Regulation (EU) 2016/679). This policy fulfils our information obligation under Articles 13 and 14 GDPR.

You must be at least 18 to use the App.

We do not knowingly collect data from, or market to, anyone under 18 years of age. By creating an account or signing in, you declare that you are at least 18; we record that statement with a timestamp together with your acceptance of the Terms of Service and this Policy. If we learn that a user is under 18, we deactivate the account and delete the associated data. Poland has set the age of consent for information-society services under Article 8 GDPR at 16; we set a higher product minimum (18) in the Terms of Service and do not operate a parental-consent process.

If you believe someone under 18 is using Foundersi, or you become aware of any content involving the sexual exploitation of a child, contact dev@foundersi.pl immediately.

To run the App, keep it safe, meet our legal obligations, and - only with your consent - to send you marketing.

We process your information to:

• create and operate your account and verify your phone number;
• show your profile to other users and show you theirs;
• rank and filter the discovery feed, including by distance;
• deliver matches, chat and direct messages;
• send push notifications about likes, matches and messages, according to your notification preferences;
• keep the service safe - moderation, reports, blocks, content filtering and anti-abuse measures;
• diagnose crashes and improve reliability;
• demonstrate that consents were given;
• send you marketing messages about Foundersi, if you have opted in;
• establish, exercise or defend legal claims.

We do not sell your personal data. We do not use your data for third-party advertising or ad profiling, and we do not share it with data brokers.

Mostly to perform our contract with you; consent for location and marketing; legitimate interests for safety and reliability.

• Create and operate your account, verify your phone number - phone, email, sign-in identifiers, verification attempts - performance of a contract, Art. 6(1)(b) GDPR.
• Show your profile to other users and show you theirs - profile data, photo - performance of a contract, Art. 6(1)(b).
• Rank and filter the discovery feed, including distance - profile data, location, app activity - performance of a contract, Art. 6(1)(b).
• Show distance to other users - precise location - consent, Art. 6(1)(a) (device permission), withdrawable at any time.
• Deliver matches, chat and direct messages - messages, matches, activity - performance of a contract, Art. 6(1)(b).
• Send push notifications about likes, matches and messages - push token, device data, preferences - performance of a contract, Art. 6(1)(b); consent for the OS-level permission.
• Keep the service safe: moderation, reports, blocks, content filtering, anti-abuse - reports, blocks, profile and message content, verification attempts - legitimate interest, Art. 6(1)(f) (safety of users and the platform); legal obligation, Art. 6(1)(c).
• Fix crashes and improve reliability - diagnostic data - legitimate interest, Art. 6(1)(f).
• Prove that consents were given - consent records - legal obligation, Art. 6(1)(c) (accountability, Art. 5(2)).
• Send marketing messages about Foundersi - email, phone - consent, Art. 6(1)(a), withdrawable at any time.
• Establish, exercise or defend legal claims - relevant records - legitimate interest, Art. 6(1)(f).

With other users (the parts of your profile you choose to show), with the service providers that run the App for us, and with authorities where the law requires it.

Other users see the profile data, photo and messages you choose to share with them. Your phone number is never shown to other users.

Service providers. We share personal data with providers who process it on our instructions under a data processing agreement (Art. 28 GDPR), and only as far as necessary:

• Supabase Inc. - database, authentication, file storage, realtime chat delivery, server functions - all account, profile, message and activity data.
• Vonage (via Supabase Auth) - sending verification codes - phone number, one-time code.
• Google LLC / Google Ireland Ltd. - Google Sign-In; Firebase Cloud Messaging for Android notifications; Google Maps SDK on Android to display event maps - sign-in identifier, name, email, profile picture; push token; map display.
• Apple Inc. - Sign in with Apple - sign-in identifier, name, email (or Apple relay email).
• LinkedIn Ireland / Microsoft - LinkedIn sign-in (OIDC) - name, email, profile picture, profile link.
• Expo (650 Industries, Inc.) - push notification delivery, app builds and updates - push token, message title/preview, device metadata.
• Sentry (Functional Software, Inc.) - crash and error reporting - diagnostic data, device metadata, technical identifiers.
• Komoot GmbH (Photon) / OpenStreetMap data - city search autocomplete - city search text, coordinates.

Authorities. We may disclose data to public authorities, courts or law enforcement where we are legally required to do so, or where it is necessary to prevent serious harm - for example, when reporting suspected child sexual abuse material in line with our internal CSAM procedure.

Business transfers. If Foundersi is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you in the App before your data becomes subject to a different privacy policy.

If you sign in with Google, Apple or LinkedIn, we receive a limited set of profile details from them - not your password.

The App lets you register and sign in using your Google, Apple or LinkedIn account. When you do, we receive from that provider: a provider user ID; your name; your email address (with Apple, this may be a private relay address if you choose to hide your email); and, where the provider supplies it, your profile picture and, for LinkedIn, your public profile link.

We never receive your password for those services. We use this information only to create and authenticate your Foundersi account and to pre-fill parts of your profile, which you can then edit or remove. Your use of Google, Apple and LinkedIn is governed by their own privacy policies - we recommend you review them to understand what they collect and how they use it.

Disconnecting a social login does not delete your Foundersi account; to delete the account, see the last section of this policy.

Links out of the App are not covered by this policy.

The App contains links to third-party websites - including news articles, which are read in full on the publisher’s own site, and links other users put in their profiles or messages. We are not responsible for the content, safety or privacy practices of any third-party site, and this Privacy Policy does not apply to them. We do not control, and are not responsible for, what those sites collect about you. Review the privacy policy of any site before providing information to it.

The App uses on-device storage to keep you signed in and remember your settings. It contains no advertising or cross-app tracking SDKs.

The App does not use cookies in the way a website does. It stores data locally on your device to: keep you signed in (authentication tokens, held in the device’s secure keystore); remember your preferences, such as app language and notification settings; and cache content so that the App loads quickly.

We do not embed advertising SDKs, we do not use the Android Advertising ID or Apple’s IDFA for advertising, and we do not track you across other apps or websites. The only third-party SDKs that receive data about your use of the App are those listed as service providers above, and they act as our processors.

You can clear locally stored data by signing out or uninstalling the App. Note that uninstalling the App does not delete your account - see the last section.

Our infrastructure is in the EU; some providers are in the US, covered by approved safeguards.

Our primary infrastructure is hosted in the European Union (AWS eu-west-1, Ireland). Some of the providers listed above are established in the United States. Where data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards at kontakt@foundersi.pl.

For as long as you have an account, plus the periods the law requires.

• Account, profile and photos - until you delete your account.
• Messages - until you delete your account or the conversation is removed. A message you sent remains visible to the recipient in their own copy of the conversation until they delete it.
• Consent records - for the life of the account and 6 years after deletion (limitation period for claims under Polish law).
• Reports, blocks and moderation records - up to 12 months after the case is closed, to detect repeat offenders.
• Diagnostic and crash data - 90 days.
• Verification attempt counters - short-term, for rate limiting only.

Accounts that never complete phone verification are removed automatically.

When we have no ongoing legitimate need to process your information, we either delete it or anonymise it. If deletion is not immediately possible because the data is held in backups, we isolate it and protect it from further processing until deletion is possible.

Organisational and technical measures - but no system is perfectly secure.

We protect your data with:

• encryption in transit (TLS) and encryption at rest on our infrastructure;
• row-level security in our database, so each account can only read the records it is entitled to;
• authentication tokens stored in the device’s secure keystore (Android Keystore / iOS Keychain);
• phone verification and rate limiting on verification attempts;
• restricted, logged administrative access to production data.

No electronic transmission or storage system is 100% secure, so we cannot promise that hackers, cybercriminals or other unauthorised third parties will never be able to defeat our security. You should access the App within a secure environment.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours in accordance with Article 33 GDPR and, where the risk to you is high, notify you directly under Article 34.

We screen profiles and messages automatically for prohibited content. A person makes the final call on any account sanction.

Profile fields (name and bio) and message content are automatically screened against lists of prohibited terms covering harassment, sexual abuse material and hate speech:

• Severe content is blocked at the point of submission. The profile change or message is rejected and not delivered. The outcome is immediate and reversible - you can edit the text and try again.
• Less severe content may be delivered but flagged for review by our moderation team.

Reported and flagged content is reviewed by a person, not by an algorithm alone. Where we decide to warn, suspend or ban an account, that decision is made by a person and you may contest it by writing to kontakt@foundersi.pl.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The ordering of profiles in your discovery feed is based on your stated preferences, distance and activity; it affects which profiles you see first, and you can change it by changing your filters.

You can access, correct, export and delete your data, object to some processing, and withdraw consent at any time.

Under the GDPR you have the right to:

• access your data and receive a copy;
• rectify inaccurate or incomplete data - you can edit most profile data directly in the App;
• erase your data (“right to be forgotten”) - see the last section;
• restrict processing;
• object to processing based on our legitimate interests, at any time, on grounds relating to your particular situation;
• data portability - receive your data in a structured, machine-readable format. The App provides a self-service export: Profile → Settings → Export my data, which returns a JSON file containing your profile, location, consents, matches, feed activity, reports and blocks;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Withdrawing consent. Turn off location permission in your device settings; turn off marketing consent in Profile → Settings. You can also unsubscribe from our marketing messages at any time using the unsubscribe link in the message itself. We will still send you service messages necessary to operate your account, such as verification codes.

To exercise any of these rights, write to kontakt@foundersi.pl. We respond without undue delay and at the latest within one month of receiving your request, extendable by two further months for complex requests, in which case we will tell you.

You also have the right to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.

Foundersi helps you find business contacts, but we do not verify the accuracy of profile claims, company affiliations or credentials beyond phone verification. Use your own judgement before sharing sensitive business information, signing agreements, transferring money or meeting in person.

You can block or report any user from their profile or your conversation. Blocking takes effect immediately. Reports are reviewed within 24 hours and decided within 72 hours.

Yes, when the law or the App changes.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last updated” date and will take effect as soon as it is accessible. When we make material changes, we will notify you in the App or by email before the changes take effect, and - where the law requires it - ask for your consent again. Previous versions are available on request. We encourage you to review this policy periodically.

Reviewing and updating. You can view and edit most of your data directly in the App under Profile → Settings, and download a copy under Profile → Settings → Export my data.

Foundersi, Poland.

Privacy and data protection: kontakt@foundersi.pl

Child safety and CSAM reports: dev@foundersi.pl