FounderPilot ("we," "us," or "our") operates founderpilot.co (the "Service"), an AI growth automation SaaS platform for founders. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service.

We are operated from India and are committed to compliance with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Personal Information Protection and Electronic Documents Act (PIPEDA), Lei Geral de Proteção de Dados (LGPD), and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data We Collect

1.1 Account Information

• Email address — provided at registration
• Password — stored as a bcrypt hash; we never store plaintext passwords
• Profile/project data — business name, URLs, descriptions you provide for lead scanning and outreach

1.2 API Keys You Provide

You may supply third-party API keys (Gemini, Reddit, Brevo, Twitter/X, HikerAPI, DataForSEO) to enable platform features. All API keys are encrypted at rest using AES-256 encryption before storage.

1.3 Usage & Analytics Data

• Feature usage events (e.g., scans triggered, replies generated)
• Timestamps, IP address (truncated/anonymized where feasible)
• Browser type, device type, and operating system

1.4 Payment Data

Payments are processed by Razorpay. We do not store your full card number or bank details. We may receive a transaction ID, plan type, and billing status from Razorpay.

2. How We Use Your Data

• Provide and operate the Service — executing lead scans, generating AI replies, sending outreach emails, submitting to directories, and enabling Autopilot/Engagement OS features
• Improve the product — analyze aggregated, anonymized usage patterns to enhance features and fix bugs
• Security & fraud prevention — detect unauthorized access, abuse, or violations of our Terms of Service
• Communication — send transactional emails (account confirmation, billing receipts, security alerts)
• Legal compliance — respond to lawful requests from authorities

3. Legal Basis for Processing

Purpose	Legal Basis
Providing the Service you signed up for	Contract performance
Product improvement & analytics	Legitimate interest
Security monitoring	Legitimate interest
Marketing communications (if any)	Consent (opt-in)
Legal obligations	Compliance with law

Under the Indian DPDP Act, processing is based on your consent provided at the time of account creation and your continued use of the Service.

4. Data Retention

• Your data is retained for the duration of your active account.
• Upon receiving a deletion request, we will erase your personal data within 90 days, except where retention is required by law.
• Anonymized, aggregated analytics data may be retained indefinitely as it cannot be linked back to you.
• Razorpay payment records are retained per their own policy and Indian financial regulations.

5. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate or incomplete data
• Erasure ("Right to be Forgotten") — Request deletion of your personal data
• Data Portability — Receive your data in a structured, machine-readable format
• Restriction of Processing — Request that we limit how we use your data
• Objection — Object to processing based on legitimate interest
• Withdraw Consent — Withdraw consent at any time without affecting prior processing

CCPA-Specific Rights (California Residents)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt-out of the sale of personal information — We do not sell your personal data
• Right to non-discrimination for exercising your privacy rights

LGPD-Specific Rights (Brazil Residents)

• Confirmation of the existence of processing
• Anonymization, blocking, or deletion of unnecessary data
• Information about shared data with third parties

DPDP Act Rights (India Residents)

• Right to access information about personal data processing
• Right to correction and erasure of personal data
• Right to grievance redressal
• Right to nominate another person to exercise rights in case of death or incapacity

To exercise any of these rights, contact us at founder@founderpilot.co. We will respond within 30 days (or as required by applicable law).

6. Cookie Policy

We use minimal, essential cookies only:

• Session cookie — maintains your authenticated session (expires on logout or after inactivity)
• CSRF token — protects against cross-site request forgery attacks

We do not use third-party tracking cookies, advertising cookies, or analytics cookies from external providers. No cookie consent banner is required as we only use strictly necessary cookies.

7. Third-Party Services

Service	Purpose	Data Shared
Supabase	Database (PostgreSQL)	All account and project data (encrypted at rest)
Railway	Application hosting	Application runtime data
Razorpay	Payment processing	Email, plan selection, transaction data
Google Fonts	Font delivery (Inter, Space Grotesk)	IP address (via font request)

Each third-party service operates under its own privacy policy. We only share the minimum data necessary for each service to function.

8. International Data Transfers

Your data is stored in Supabase-managed infrastructure (AWS regions). Data may be transferred to and processed in regions outside your country of residence, including the United States.

For transfers from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission
• Adequacy decisions where applicable
• Supabase and Railway's compliance with applicable data protection frameworks

9. Children's Privacy

FounderPilot is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a user is under 18, we will promptly delete their account and associated data. If you believe a minor has provided us data, please contact us immediately at founder@founderpilot.co.

10. Security Measures

We implement industry-standard security measures to protect your data:

• AES-256 encryption — all API keys are encrypted at rest
• bcrypt hashing — passwords are salted and hashed, never stored in plaintext
• HTTPS/TLS — all data in transit is encrypted
• JWT authentication — secure, stateless session tokens with expiration
• Row-Level Security (RLS) — database-level access controls via Supabase
• Principle of least privilege — minimal access permissions across infrastructure

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Article 33)
• Notify affected users without undue delay if the breach is likely to result in a high risk to their rights
• Document the breach, its effects, and remedial actions taken

12. No Sale of Personal Data

We do not sell, rent, or trade your personal data to third parties for monetary or other valuable consideration. This applies to all users regardless of jurisdiction. For CCPA purposes: we have not sold personal information of consumers in the preceding 12 months.

13. Automated Decision-Making

Our Service uses artificial intelligence and automation for:

• Lead scanning — AI identifies relevant conversations on Reddit, Instagram, Hacker News, and DEV.to based on your project keywords
• Reply generation — AI generates suggested responses for your review before posting
• Autopilot mode — automated engagement based on your configured rules and preferences

These automated processes operate on publicly available third-party content and your configured project parameters. No automated decisions are made that produce legal effects or similarly significant effects on you. You retain full control over what content is posted on your behalf and can disable automation at any time.

14. Data Protection Officer / Contact

For all privacy-related inquiries, requests, or complaints:

FounderPilot
Email: founder@founderpilot.co
Location: India

We aim to respond to all legitimate requests within 30 days. In complex cases, we may extend this by an additional 60 days, with prior notification.

15. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority:

• India: Data Protection Board of India (once constituted under the DPDP Act)
• EU/EEA: Your local Data Protection Authority (e.g., CNIL, ICO, BfDI)
• California: Office of the Attorney General of California
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• Canada: Office of the Privacy Commissioner of Canada

We encourage you to contact us first so we can attempt to resolve your concern directly.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date, and where required, via email notification. Continued use of the Service after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: founder@founderpilot.co
Website: https://founderpilot.co