Privacy Policy
What personal data Founderboard collects, why, on what legal basis, and what rights you have.
1. Controller
IntoApps Holding B.V., Tilburg, The Netherlands, is the controller for the personal data described here.
Privacy contact: privacy@founderboard.ai
We have not appointed a Data Protection Officer; we are not required to.
2. What we collect
You give us:
| Data | Where it comes from |
|---|---|
| Email address, password (hashed), name | Registration and sign-in |
| Profile photo | Optional upload |
| WhatsApp number | Optional, if you enable WhatsApp notifications |
| Venture data — company and project names, descriptions, industry, stage, team size, founder background, challenges | Onboarding and project settings |
| Working tool content — customer profiles, interview notes, outreach, competitor and market research, value proposition and other tool entries | The tools you use |
| Chat messages with AI board members | Your conversations |
| Questions you ask the board on our homepage before you have an account | The chat on the homepage. Sent to Google (Gemini API) for an answer and not stored by us; your browser keeps the conversation until you leave the page |
| Your name and email address, if you leave them in the homepage chat — and the conversation, only if you tick that it goes along | The form the board may offer in the homepage chat. Emailed to the Founderboard team and stored nowhere else; never sent to the AI model |
| Dropboard items — notes, links, uploaded files | Quick capture |
| Meeting notes you capture | Founder meetings feature |
| Outreach contacts — the names, roles, organisations and work addresses of people you choose to reach, the status of each conversation, and the messages you log or send to your venture's pipeline address | The outreach tools, Prospecting, and mail you deliberately CC, BCC or forward to that address. We never read a mailbox — only what is sent to the address arrives |
| A Google Ads connection — the Google account address you connect with, an access grant to the ad account you pick (stored encrypted), and the campaigns you launch from Founderboard with the numbers Google reports for them | Connecting Google Ads on the Google Ads board. The grant is revoked at Google when you disconnect, when the venture is deleted for good, or when you delete your account |
| Survey answers — what a person answers through a survey link a venture sends them, linked to that person; when they opened, started and finished it; and anything they chose to tell about themselves at the end. Through a venture's open link — one link anyone who has it can answer — the answers are linked to nobody unless the person gives a name or an email address at the end | The person answering, through their own link. Founders choose whom to ask (or, for an open link, whom to share it with) and cannot change an answer |
We generate:
- AI output — board member replies, board meeting summaries, audio briefings, news commentary, reports and readiness assessments;
- progress data — XP, level, streak, badges, activity and completion signals;
- usage and diagnostic data — AI model usage and token counts, error logs, request metadata.
We collect automatically:
- technical data needed to serve the site — IP address, browser and device type, timestamps — processed in server and security logs;
- with your consent only, analytics data via Google Analytics 4 (see the Cookie Policy);
- with your consent only, the Google Ads click id of the ad that brought you to Founderboard. If you then create an account it is kept with it, and we tell Google Ads — by that click id alone, never your name or email — that the ad led to an account, and later whether you came back to use it.
We do not ask for special categories of personal data. Please do not put them into the tools or the chat.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account; authentication | Performance of a contract (6(1)(b)) |
| Providing the AI board, tools, meetings, reports and other features you use | Performance of a contract (6(1)(b)) |
| Sending service email — magic links, meeting notifications, message notifications | Performance of a contract (6(1)(b)) |
| Web push and WhatsApp notifications | Consent (6(1)(a)) — you enable them, and can turn them off |
| Analytics cookies | Consent (6(1)(a)) |
| Measuring our own ads (marketing cookies, and reporting a signup to Google Ads) | Consent (6(1)(a)) |
| Following up on the name and email you left in the homepage chat, and reading the conversation if you sent it along | Consent (6(1)(a)) — you fill in the form and choose whether the conversation goes along |
| Marketing email and product updates | Consent (6(1)(a)), or legitimate interest for existing users on closely related updates (6(1)(f)) |
| Security, abuse prevention, rate limiting, debugging | Legitimate interest (6(1)(f)) in keeping the service safe and working |
| Improving the product using aggregated and pseudonymised usage data | Legitimate interest (6(1)(f)) |
| Supporting founders and guiding future development: our staff can see which boards a venture used, how far it got, when, and which of its founders did the work — never what was written in them | Legitimate interest (6(1)(f)) in supporting the people using Founderboard, keeping it working and deciding what to build next |
| Running a survey a venture sends to people it chose, or shares as an open link, and keeping the answers linked to each person — or, through an open link, to nobody unless they say who they are | Legitimate interest (6(1)(f)) of the venture in learning from its customers, and ours in providing the tool; answering is voluntary, a name and an email address are optional, and a respondent can withdraw their answers at any time |
| Giving accelerator staff a read on enrolled ventures | Performance of a contract (6(1)(b)) with the program, and legitimate interest (6(1)(f)) of the program in running it |
| Meeting legal and accounting obligations | Legal obligation (6(1)(c)) |
Where we rely on consent you may withdraw it at any time, without affecting processing already carried out. Where we rely on legitimate interest you may object — see section 8.
4. AI processing
Your prompts, chat messages and the venture and tool content needed for context are sent to Google (Gemini API) to generate responses. Audio briefings additionally use ElevenLabs for speech synthesis.
- Content is sent to these providers only to produce the output you asked for.
- We use paid API tiers under terms that do not permit your content to be used to train the providers' models.
- We log AI requests and responses to our own self-hosted observability system (Langfuse) for debugging, quality and cost control. That system runs on our own infrastructure.
- AI output can be wrong. It is not professional advice, and no automated decision with legal or similarly significant effects is taken about you (GDPR Art. 22 does not apply).
5. Who we share it with
We do not sell personal data. We share it with the sub-processors needed to run the Service — the complete, current list, with what each one processes and where, is on the sub-processor page.
We also share data:
- with an accelerator or program, where your venture is enrolled in one, as described in section 6;
- with people you invite to your project, who can then see that project's content;
- with anyone holding a public share link you generate, limited to the venture overview snapshot — regenerating the link revokes the old one;
- with professional advisers, insurers, or authorities, where legally required;
- with an acquirer, in the event of a merger or sale, subject to this policy.
6. Accelerator and coach access
If your venture is enrolled in a program, that program's coaches and directors can see your board and tool content, progress metrics and activity signals, and AI-generated reports derived from them.
They cannot see your conversations with your AI board members. Chat content is excluded from every coach-facing surface and from every generated report, by design.
A program can also publish articles and videos to its ventures in an Academy. We record which pieces you open, so that the program sees how many of its ventures have opened each one — never who.
The program is a separate controller for what it does with the data it sees. Ask the program for its own privacy notice.
7. International transfers
Our infrastructure is hosted in the EU where the provider offers it. Some sub-processors — notably Google and ElevenLabs — may process data outside the EEA, including in the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses, and where applicable the EU-US Data Privacy Framework, together with the providers' technical and organisational safeguards. You can ask us for a copy of the relevant safeguards at privacy@founderboard.ai.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict processing in certain circumstances;
- data portability — receive your data in a structured, machine-readable format;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw consent at any time.
You can exercise the most common ones yourself:
- Export — download a machine-readable copy of your account and venture data from your profile page.
- Delete — delete your account from your profile page.
- Cookies — change or withdraw your cookie consent from the "Cookie settings" link in the footer.
- Notifications — turn email, push and WhatsApp notifications on or off in your profile.
For anything else, email privacy@founderboard.ai. We respond within one month, and will tell you if we need longer (up to two further months) for a complex request. We may ask you to confirm your identity.
If you answered a survey a venture sent you, your link is how you exercise your rights without an account: it offers withdraw and delete my answers for as long as it holds any, even after the survey has closed, and a withdrawal deletes every answer and anything the survey filled in about you. The founders can also withdraw your answers on your behalf; they cannot change them. Or write to privacy@founderboard.ai. The founders can download the answers, with your name and email address, as a spreadsheet: a copy made before you withdraw is theirs to delete — a withdrawal cannot reach it. A tag they gave you because of your answers is taken off with them. A venture may quote what you answered in material it shares, such as a pitch deck — never with your name or anything that could identify you, and only from answers given after the survey page told you so; a quote already shared that way may stay where it was shared after you withdraw. If you answered through an open link, the browser you answered in keeps your own link, so coming back to the open link there resumes your answers and still offers the withdrawal; a name or email you left is deleted with them, and so is the contact the venture got from your email, unless it has since been used for something else.
If you are unhappy with how we handled your request you can complain to the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl) or to the supervisory authority where you live or work.
9. Retention
| Data | How long |
|---|---|
| Account data | While your account is active |
| Venture, tool and chat content | While your account is active, or until you delete the project |
| Earlier versions of a board | A copy of each version, so a board can be put back, for 90 days after it was last on the board. Deleting a person from the venture deletes every earlier version that names them; the list of who changed what stays, without the copies |
| Outreach contacts and their threads | With the venture: until a member removes the person, or the project is deleted |
| Survey answers | With the venture: until the person withdraws them (deleted at once), a founder withdraws them at the person's request, or the project is deleted. If a founder deletes the person, what they answered stays without their name as part of what the venture learned — unless the founder chooses to delete it too. A quote a venture already shared without anything that identifies the person (a published pitch deck) stays where it was shared |
| Deleted projects | Removed from every surface immediately. An owner can restore one for 7 days after deletion; after that it is not recoverable by you or by us, and it is purged from the database within 90 days |
| Deleted accounts | Identifiers are erased or anonymised immediately; residual records are purged within 90 days |
| Backups | Rolling backups are overwritten within 30 days |
| Name, email and conversation left in the homepage chat | In our team's mailboxes for as long as we are in touch, and at most 12 months; sooner if you ask us |
| Server and security logs | Up to 12 months |
| AI observability traces | Up to 12 months |
| Analytics data | Up to 14 months (Google Analytics retention setting) |
| The ad click id on your account | Erased with your account; Google Ads matches conversions only within 90 days of the click |
| Invoices and accounting records | 7 years, as Dutch tax law requires |
What deleting your account does
Deleting your account signs you out everywhere, removes your sessions, push subscriptions and notification records, removes you from every project you are a member of, and erases or anonymises your identifiers — email, name, photo, WhatsApp number, password and the ad click id — and revokes any Google Ads connection you made. Projects where you were the sole owner are deleted along with their content, and the 7-day restore window does not apply to them — including any project you had already deleted and could still have restored. Erasing your account ends that window rather than deferring it. Where you shared a project with other people, that project keeps running for them, and your past contributions to shared project content remain attributed to a deleted user rather than to you.
If you want a full purge of everything associated with you, including shared project content, email privacy@founderboard.ai and we will handle it manually.
10. Security
We protect data with encryption in transit (TLS), encryption at rest at our infrastructure providers, hashed passwords (bcrypt), least-privilege access for staff, and access controls that scope every request to your projects. No system is perfectly secure. If a breach is likely to result in a high risk to you, we will notify you and the supervisory authority as the GDPR requires.
11. Children
The Service is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us personal data, contact privacy@founderboard.ai.
12. Changes
We may update this policy. Material changes will be announced in the product or by email. The version and effective date at the top of this page identify the current version.
13. Contact
IntoApps Holding B.V. Tilburg, The Netherlands privacy@founderboard.ai