Privacy policy

MohammadReza Mirafzal runs Foundation at getfndtn.com and is responsible for your personal data (the “controller” under the GDPR). For anything about your data, write to privacy@getfndtn.com. Our postal address is 4 rue des Mariniers, 75014 Paris, France.

• Your account. Your email address and a sign-in ID. Passwords and email verification are handled by our sign-in provider, WorkOS. We never see or store your password.
• Your projects. Everything you enter: business descriptions, costs, prices, staffing, assumptions, market sizes and competitor notes, and the results and plans generated from them.
• AI-drafted business plans. When you ask Foundation to draft a plan, we send your project’s figures and your description of the business to OpenRouter, which passes them to the AI model that writes the draft. Nothing is sent unless you ask for a draft.
• Connected AI agents. If you connect your own AI agent (for example Claude) to Foundation, it can read and change your projects on your behalf, after you sign in and approve it. What your agent does with that data is covered by your agent provider’s terms.
• Your cookie choices. A random ID, what you chose, when, and which version of the cookie policy you saw. If you were signed in, the choice is linked to your account. We don’t record your IP address with it.
• Visit statistics. On the home page, the documentation and these legal pages we count visits with Umami, a cookieless analytics service: the page, the site you came from, and your country, browser, device and language. It sets no cookies, doesn’t store your IP address and can’t identify you. It stays off if your browser sends Do Not Track.
• Technical data. To deliver pages, our servers process your IP address and basic browser information. We use it only to run and secure the service.

• To provide Foundation: your account, your projects, calculations and plan drafts. Legal basis: our contract with you.
• To keep the service secure and working, and to fix problems. Legal basis: our legitimate interests.
• To see how many people visit and where they come from, so we can improve the site. Legal basis: our legitimate interests. The statistics are anonymous and use no cookies.
• To remember your cookie choices, and to set optional cookies only if you allow them. Legal basis: consent.
• To meet legal obligations, for example answering a lawful request. Legal basis: legal obligation.

We don’t use your data for advertising, and we don’t make automated decisions about you.

We use a small number of providers. Each one only gets what it needs to do its job.

• OVHcloud: hosting. The app and its database run on their servers.
• WorkOS: sign-in, account security and email verification.
• Umami (Umami Software, Inc.): anonymous visit statistics, as described above. We use its EU region.
• OpenRouter and the AI model provider it routes to: drafting business plans, only when you ask for one.

Some of these providers are based in the United States. Where data leaves the UK or the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

• Your account and projects: until you delete them or ask us to delete your account.
• A project you delete is removed from our database straight away.
• Cookie choices: for as long as we need to show what you agreed to, and no longer than three years.
• Visit statistics: anonymous, kept as long as they help us understand how the site is used.
• Technical logs: for a short period, only as long as needed to run and secure the service.

Depending on where you live, you can ask us to show you the data we hold about you, correct it, delete it, give it to you in a portable format, or stop or limit how we use it. Where we rely on consent, you can withdraw it at any time, for cookies through the cookie settings.

To use any of these rights, email privacy@getfndtn.com. We answer within one month. If you’re in the UK or the EU and you’re unhappy with our answer, you can complain to your data protection authority.

California residents: you have the right to know what we collect, to delete it, and to correct it. We don’t sell or share personal information for cross-context behavioural advertising, and we honour the Global Privacy Control signal. We won’t treat you differently for using these rights.

All traffic is encrypted with HTTPS. Passwords are handled by WorkOS and never stored by us. Access to the database is restricted to the people who run the service.

Foundation is not meant for anyone under 16, and we don’t knowingly collect their data.

When we change this policy, we update the date at the top. If a change affects how we use your data in a meaningful way, we’ll tell you by email or in the app before it takes effect.