Privacy notice

• Consent under Article 6(1)(a) GDPR for voluntary features.
• Contract and pre-contractual steps under Article 6(1)(b), especially for requested product functions, account communications and agreed investor pipeline digests.
• Legal obligations under Article 6(1)(c).
• Legitimate interests under Article 6(1)(f), especially secure and reliable operation, data-minimised product usage measurement and optional profile-maintenance reminders.

Preview, account and authentication

We process the signed preview-access state, language preference, email address, non-readable password representation, full name, workspace type, confirmation state and technical session data.

Investor and startup enquiries

When you use an enquiry form, we process your name, work email, organization or startup, optional website and message, selected need and enquiry source. We use this information only to answer the enquiry and prepare possible pre-contractual steps; submitting the form does not subscribe you to marketing email.

Workspace and product data

Depending on your role, we process organization and profile data, websites, roles, startup and investment criteria, mandates, notes, evaluations, decisions, evidence, release states, matching requests and messages.

Evaluation and AI feedback

We process company information, URLs, materials links, decision questions and results that you provide. Pitch-deck links are technically checked and stored with the result. When you request AI feedback, the required text is sent to OpenAI with store: false.

Billing and profile maintenance

For paid accounts, we process plan, billing interval, payment and invoice status, customer and transaction references, billing address and, where supplied, tax identification. Stripe processes full payment-card details; FoundMatter does not store them. For startup profiles, we also process the latest freshness confirmation and derive a visible maintenance and freshness state.

Functional product notifications

We use email address, language, workspace association, notification preferences and the necessary profile or pipeline status to generate and deliver functional profile-maintenance reminders and the weekly pipeline digest configured in an investor account. These messages contain no confidential profile text, investment criteria or token-bearing URLs. Non-essential reminders and digests can be disabled in settings. Required security, account and billing communications remain separate and unaffected.

Data-minimised product usage measurement

To assess activation, return use and use of existing paid functions, we record only closed, predefined server-side product events, their time, the technically necessary user and organization association, and a small number of non-confidential status values. Events contain no profile text, pitch content, email addresses, investment criteria or URLs. Internal reporting is aggregated and restricted to authorised platform roles. We use no tracking pixels and do not track email opens.

Operations and security

IP address, time, requested URL, referrer, browser, device and error data may be processed in server and security logs.

Vercel Inc.

Hosting, content delivery and technical logs.

Supabase Inc.

Authentication and session management and, depending on the deployed environment, database or storage infrastructure.

ALL-INKL.COM – Neue Medien Münnich

Email delivery and receipt, including internal notifications about investor and startup enquiries, functional profile-maintenance reminders and weekly investor pipeline digests.

OpenAI Ireland Ltd.

User-requested pitch-readiness critique. API data is not used to train models by default unless the customer explicitly opts in to share it.

Stripe Payments Europe, Ltd.

Payment processing, recurring billing, invoices, customer portal and fraud prevention, including payment, billing, tax and technical transaction data.

FoundMatter currently uses only technically necessary cookies for preview access, language and authentication. No advertising, analytics, heatmap or session-recording cookies are used. Server-side product usage measurement uses no additional cookies, local storage or tracking pixels and does not track email opens. See the cookie policy.

Where providers process data outside the EU or EEA, transfers rely on an adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. The specific infrastructure region depends on project configuration.

• Preview access: up to 7 days; language preference: up to 1 year.
• Enquiry data: generally up to 12 months after the last substantive contact unless longer retention is required for pre-contractual or legal purposes.
• Account and workspace data: until account deletion or as required to provide the service.
• AI critiques: until deleted with the relevant workspace data or account.
• Product events and reminder, digest and delivery receipts: no more than 12 months; they are then deleted or aggregated without personal reference.
• Business records: for applicable statutory periods, commonly up to 7 years.
• Technical logs: under the necessary security and retention periods of the hosting provider.

Subject to the GDPR, you may request access, rectification, erasure, restriction, portability and object to processing, and may withdraw consent for the future. You can also disable non-essential profile-maintenance reminders and investor pipeline digests in settings. Required security, account and billing communications remain unaffected. Contact paul@foundmatter.com to exercise your rights.

You may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

FoundMatter provides research, readiness, evaluation and matching guidance. It does not make solely automated decisions under Article 22 GDPR that produce legal or similarly significant effects. Results support, but do not replace, human judgment.

Data is transmitted over TLS and access to private workspace data is restricted. We update this notice when law, functions or providers change and will communicate material changes appropriately.

We operate a LinkedIn company page to share information and respond to voluntary enquiries. We see profile details, comments and messages you choose to share. This communication is based on legitimate interests under Article 6(1)(f) GDPR; specific contract enquiries are handled under Article 6(1)(b). The enquiry retention periods and rights above apply.

LinkedIn Ireland Unlimited Company also processes usage and device data under its privacy policy. We are joint controllers for the creation of Page Insights under the Page Insights agreement; LinkedIn provides aggregate statistics. You can exercise your rights with LinkedIn or us. LinkedIn may process data outside the EEA. We use no LinkedIn tracking pixels or embedded social plugins on foundmatter.com.