Privacy Policy

FoundOne is run by FoundOne s.r.o., Evropská 2758/11, 160 00 Praha 6 – Dejvice, Czech Republic (company ID [to be added]). Write to hello@foundone.io about anything in this policy.

Your account. When you or your team use FoundOne, we decide how your account data is used. For that data we are the controller, and this policy explains it.

The people your agency keeps in FoundOne: candidates, client contacts, and what clients answer in the portal. Your agency decides why and how they are kept; we keep and process them only on its instructions. For that data the agency is the controller and we are its processor, under the Data Processing Agreement. If you are a candidate and want to know what an agency holds about you, ask that agency; we help it answer.

• Account: your name, work email, the workspace you belong to and your role in it.
• Sign-in: sessions, the time of sign-in, your IP address and browser type. Sign-in is by emailed link or Google / Microsoft; we never hold a password.
• Client portal guests: name, email, the agency that invited you, and your sessions. Your answers and notes belong to the agency’s data (see above); notes you mark “only me” are shown to no one else.
• Running the service: daily usage counts (to apply fair-use caps), error reports from the app (page path and error message, no form contents), and what you write to us.
• Billing, once paid plans start: the plan and invoices. Card payments are handled by Stripe; we never see or store card numbers.

• To provide FoundOne to you and your team: performing our contract (GDPR Art. 6(1)(b)).
• To keep it secure and fair: sign-in protection, rate limits, abuse prevention and error logs. Our legitimate interest in a safe service (Art. 6(1)(f)).
• To keep accounting and tax records: a legal obligation (Art. 6(1)(c)).

• No advertising, no selling or renting of data, no tracking across other sites.
• We don’t use your agency’s data, or candidates’ data, to train AI models.
• No analytics or marketing cookies.

Only what sign-in needs:

• a session cookie for the app, set when you sign in;
• a separate session cookie for the client portal, only on its pages.

The app also remembers interface choices in your browser’s local storage (language, which view you last used). It never leaves your device.

FoundOne runs on Cloudflare. Each agency’s workspace (its candidates, searches, notes) is kept in its own database in Cloudflare’s EU jurisdiction; uploaded CVs and the account directory are stored in the EU as well. Emails are sent through Cloudflare.

When someone uses an AI feature (writing a pitch, reading a CV), the text or file needed for that request is sent to Anthropic. Anthropic currently processes it in the United States under the EU Standard Contractual Clauses and does not use it to train its models. [Before launch: confirm the EU processing option we are arranging and update this paragraph.]

The full list of service providers is in the Data Processing Agreement.

• Account data: while your account exists, then deleted within 30 days of closing it.
• Sign-in links: they expire within minutes (portal links within days) and work once.
• Usage counts: 7 days. Error logs: as long as Cloudflare keeps Workers logs [confirm the period].
• Invoices: as long as Czech accounting law requires.
• Your agency’s data: as the agency decides. It is deleted when the agency deletes it, and within 30 days after the agency closes its workspace [confirm backup retention].

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to receive it in a portable form, and you can object to processing based on our legitimate interest. Write to hello@foundone.io; we answer within a month.

You can also complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz), or to the authority where you live.

If this policy changes in a way that matters, we tell account owners by email before it takes effect. The date of the current version is at the top of the final document.