Privacy Policy

Account data: email, name, password hash, and optional profile attributes (founder stage, function, team size, industry, acquisition source).

Billing data: handled by Stripe, Inc. We receive subscription status, plan, and last-4 of card; we do not store full card numbers.

Usage & telemetry: events such as note views, time on note, searches, filters applied, board interactions, CTA clicks, and feedback ratings.

Content you submit: saved notes, board messages, feedback, suggestions.

Device & log data: IP address, browser, OS, pages visited, referrer, timestamps.

• Provide, secure, and improve the Service.
• Process payments and manage subscriptions.
• Personalize content and recommendations.
• Send transactional and (with consent) marketing emails.
• Analyze product usage and aggregate trends.
• Comply with legal obligations and enforce our Terms.

• Contract: to provide the Service you requested.
• Legitimate interests: product analytics, fraud prevention, security, service improvement.
• Consent: non-essential cookies, marketing emails.
• Legal obligation: tax, accounting, lawful requests.

We share data with service providers acting on our behalf:

• Stripe, Inc. — payment processing.
• Lovable Cloud (Supabase infrastructure) — database, authentication, file storage, serverless functions.
• Email delivery provider — transactional and marketing email.
• Analytics — first-party product analytics stored in our own database.

We do not sell your personal information. We may disclose data if required by law, to protect rights, or in a corporate transaction.

We are based in the United States. If you access the Service from the EEA, UK, or other regions, your information may be transferred to and processed in the U.S. We rely on Standard Contractual Clauses and equivalent safeguards where required.

We retain account data while your account is active and for up to 24 months after closure for legal, tax, and dispute-resolution purposes. Aggregated, de-identified analytics may be retained indefinitely.

We use encryption in transit (TLS), encryption at rest, role-based access controls, row-level security on our database, and regular backups. No system is perfectly secure; you use the Service at your own risk.

Depending on your location, you may have rights to access, rectify, delete, port, restrict, or object to processing of your personal data, and to withdraw consent. See our GDPR Statement and CCPA/CPRA Notice. Submit requests to privacy@foundernotes.ai.

The Service is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We will post any changes to this Policy here and update the “Last updated” date. Material changes will be notified by email or in-app notice.

One Unicorn, LLC, 2234 N. Federal Hwy #1317, Florida, USA — privacy@foundernotes.ai.