Privacy Policy

Foundbrew (“Foundbrew”, “we”, “us”, “our”) operates the Services and is the controller of the personal data described in this Policy. Foundbrew is a builder-run organisation that helps people find collaborators and build products together.

For any privacy question, or to exercise a right described in section 9, contact foundbrew@gmail.com. We aim to acknowledge requests within 5 business days and to resolve them within 30 days, extendable once by a further 60 days for complex requests, with notice to you.

We collect the following categories of data:

Data you provide

• Account and application data — name, email address, password (stored only as a salted hash), and the information you submit in an application: your background, the skills you offer, links you choose to share, availability, and what you want to build.
• Profile and content data — anything you add to your public profile, projects, ideas, insights, comments, or messages within the Services.
• Communications — messages you send to us or to other members through the Services, and support correspondence.

Data collected automatically

• Device and usage data — IP address, browser and device type, operating system, referring pages, pages viewed, and timestamps, collected through server logs and privacy-respecting analytics.
• Cookies and similar technologies — as described in our Cookie Policy.

Data from third parties

• Authentication providers — if you sign in with a third-party provider, we receive your name, email address and a provider identifier.
• Infrastructure and fraud-prevention vendors — limited signals used to keep the Services secure.

We do not intentionally collect special-category data (such as health, religion, or political opinions). Please do not submit it in free-text fields.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you may object as described in section 9.

We share personal data only as described here:

• With other members — the parts of your profile and content you have marked visible, so collaboration can happen.
• With service providers (processors) — hosting, database, email delivery, error monitoring and analytics vendors that process data on our documented instructions under written contracts.
• For legal reasons — where required by law, legal process, or to protect the rights, safety and property of Foundbrew, our members, or the public.
• In a corporate transaction — if Foundbrew is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred subject to the protections in this Policy, with notice to you.

We do not sell personal data, and we do not share it with advertising networks for cross-context behavioural advertising.

We and our service providers may process personal data in countries other than your own. Where we transfer data out of the UK or European Economic Area, we rely on an adequacy decision where one exists, or on Standard Contractual Clauses (and the UK Addendum) together with supplementary technical and organisational measures. You can request a copy of the relevant safeguards by contacting us.

We keep personal data only as long as necessary for the purposes in section 3:

• Account and profile data — for the life of your account, then deleted or anonymised within 90 days of verified closure, unless a longer period is required by law.
• Applications not approved — up to 24 months, so we can reconsider re-applications and defend against claims.
• Server and security logs — up to 13 months.
• Records needed for tax, accounting or dispute resolution — for the period required by applicable law (typically 6–7 years).

Content you posted publicly or contributed to shared projects may remain visible after your account closes, attributed to a removed member, where other members rely on it.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, least-privilege access controls, row-level database security, audit logging, dependency scanning and a documented incident response process. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security, and you are responsible for keeping your credentials confidential. We will notify you and any regulator of a personal-data breach where the law requires.

The Services are not directed to children. You must be at least 16 years old (or the age of digital consent in your country, if higher) to create an account. We delete data we learn was provided by a child below that age.

Depending on where you live, you may have the right to access a copy of your data; to correct inaccurate data; to delete data; to restrict or object to processing; to data portability; to withdraw consent; and to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner’s Office). If you are in California, you may have rights to know, delete, correct and limit use of personal information, and the right not to receive discriminatory treatment for exercising them.

To exercise a right, use your account settings where available or email foundbrew@gmail.com. We will verify your identity before acting. You may use an authorised agent where the law allows.

You can opt out of optional email at any time using the link in those messages or in settings; service messages cannot be opted out of while you hold an account.

We may update this Policy to reflect changes in our practices or the law. We will post the updated version with a new “last updated” date and, for material changes, give prominent notice (for example, by email or an in-product notice) before the change takes effect. Continued use of the Services after the effective date means you accept the updated Policy.