Privacy Policy

1. Overview

Founder Copilot (“we”, “our”, or “us”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use our AI-powered investor and grant matching platform.

2. Information We Collect

2.1 Information you provide directly:

• Email address (used for authentication via magic link)
• Google account information (name, email, profile picture) if you sign in with Google
• Startup pitch content, company description, sector, stage, and location
• Any other information you submit during the onboarding flow

2.2 Information collected automatically:

• Usage data such as pages visited and features used
• Device and browser information
• IP address and general geographic location
• Session identifiers and authentication tokens

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Founder Copilot service, including AI-based investor and grant matching.
• Authenticate your identity and maintain your account.
• Send you magic link emails for passwordless sign-in (if enabled).
• Improve the accuracy and relevance of our matching algorithms.
• Communicate with you about product updates, new features, or support.
• Detect and prevent fraud, abuse, or security incidents.

We do not sell your personal data to third parties. We do not use your pitch or company data for advertising purposes.

4. AI Processing

When you submit a pitch or company description, we process this text using AI models (including large language models) to generate investor matches, grant recommendations, and insights. Your data may be processed by third-party AI providers under data processing agreements that prohibit training on your data.

Vector embeddings of your pitch are stored in our database to enable semantic search and matching. These embeddings do not allow direct reconstruction of your original text by third parties.

5. Google User Data

When you connect your Google account, Founder Copilot requests access to specific Google services under the principle of least privilege. This section explains exactly what data we access, how we use it, with whom we share it, and how you can revoke access.

5.1 What Google user data we access

• Google Drive (drive.readonly) — file metadata and contents (Docs, Sheets, Slides, PDF, DOCX, XLSX) inside a single Drive folder you explicitly select through the Google Picker. We do not scan your entire Drive.
• Google Calendar (calendar.events) — events on your primary calendar (title, time, attendees, description, RSVP status).
• Gmail (gmail.send) — send-only access. We do not read, list, or store any messages from your inbox.
• Basic profile — name, email address, and profile picture (for account identification).

5.2 How we use Google user data

• Drive data is indexed into your private knowledge base and used to ground AI-generated responses (investor updates, grant drafts) in your own documents.
• Calendar data is used to check availability before proposing meeting times and to create, update, or cancel investor meetings when you explicitly confirm them in the app.
• Gmail is used solely to send outreach emails you have reviewed and approved inside Founder Copilot. Every send is triggered by an explicit user action.

5.3 Sharing, transfer, and disclosure

We do not sell, rent, or share your Google user data with third parties for advertising or marketing purposes. Google user data is disclosed only to the following categories of service providers, strictly to operate Founder Copilot: cloud hosting (Vercel), AI language model inference (Anthropic, OpenAI) under agreements that prohibit training on your data, and transactional email delivery (Resend). We may disclose data if required by law or valid legal process.

Founder Copilot does not use Google Workspace API data to develop, improve, or train generalized AI/ML models.

5.4 Data protection

• All Google user data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• OAuth access and refresh tokens are stored encrypted at the database column level.
• Access is restricted to your isolated workspace via row-level access controls.
• Employee access to production data is limited by the principle of least privilege and requires audited approval.
• We perform periodic dependency scanning and security reviews.

5.5 Retention and revocation of Google user data

• Indexed Drive content is retained while your account is active and the Drive integration remains connected.
• You can disconnect Google access at any time via Integrations → Google Drive → Disconnect . Disconnecting immediately revokes and deletes stored OAuth tokens and purges all indexed Drive content within 30 days.
• Deleting your Founder Copilot account removes all Google user data within 30 days.
• You can also revoke Founder Copilot's access directly from myaccount.google.com/permissions.

6. Data Storage and Security

Your data is stored in a PostgreSQL database with industry-standard encryption at rest and in transit. We use Redis for temporary job queue data, which is not persisted long-term. Authentication sessions are managed securely via NextAuth.js.

While we take reasonable technical and organizational measures to protect your data, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your account and pitch data for as long as your account is active. If you request deletion of your account, we will remove your personal data within 30 days, except where we are required to retain it for legal or compliance purposes.

8. Third-Party Services

We use the following third-party services to operate the platform:

• Google OAuth — for sign-in authentication
• Resend — for sending magic link emails
• Vercel — for hosting and deployment
• Anthropic / OpenAI — for AI language model inference

Each of these providers has their own privacy policy and processes data according to their terms. We only share the minimum necessary data with each provider.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Portability — receive your data in a machine-readable format
• Objection — object to certain types of processing

To exercise any of these rights, contact us at kyrydz.nestor@gmail.com.

10. Cookies

We use strictly necessary cookies for session management and authentication. We do not use third-party tracking or advertising cookies. You can disable cookies in your browser settings, but this may prevent you from signing in or using the Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. We encourage you to review this page periodically. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at kyrydz.nestor@gmail.com.