How FounderPulse handles and protects your data.

The data controller is Bouquet Kevan, sole trader, France (SIRET 994 483 956 00011). For any data protection question or to exercise your rights, write to support@founder-pulse.com or by post to the address above. The service is not required to appoint a data protection officer; requests are handled directly by the controller.

FounderPulse collects only the data the service needs:

• Account: email address, first name, password (stored as an irreversible hash) or Google sign-in, language and time zone.
• Business context you provide: offer, audience, stage, sector, goals, revenue and declared numbers, available time, blockers.
• Service usage: conversations with the AI Co-Founder, daily plans, missions, measured results, saved deliverables, scheduled follow-ups, usage consumed and reminder preferences.
• Co-founder memory: facts, commitments and habits kept between your conversations, visible and editable by you.
• Attached files (screenshots, PDF, CSV or Excel tables): analysed to answer your message, then not kept. Only the file name stays in the conversation.
• Integrations you enable: revenue read from your Stripe account (Stripe connection or read-only restricted key) or Lemon Squeezy, events from your Google or Outlook calendar, connected AI assistants (Claude, ChatGPT, Cursor). For sales, only the amount, currency and date are read, then grouped by day: never your customers' identity. Connection keys are encrypted and never shown again. Nothing is read without your explicit connection, which you can remove at any time.
• Your prospects: the people or companies you add, import or have the AI find (name, public business contact details, context, the public sentence where the person states their need and the date it was posted, drafted messages, status, the reason you dismissed them). For this data you are the controller and FounderPulse acts as a processor (GDPR Article 28): it is only used for your outreach and never reused for any other purpose.
• People found by the search (non-users): the search only reads public pages, through a search engine, and never logs into any account. Only what's needed for the first message is kept (public name or handle, link, published sentence and its date). Anyone can object to appearing in results, without an account, from the "Opt out" page (/opt-out): only a simplified version of the link is then kept, to exclude it from every future search.
• How you signed up (channel, campaign, tracked link), only if you accepted audience measurement.
• Testimonial (first name, activity, city, optional photo, rating and text), only if you submit it and consent to its publication.
• No-signup trial (home page): your website address or the description of your offer. The people found are shown in your browser; the request and how the search ran are logged for 30 days to fix errors.
• Website assistant (chat bubble on public pages): your questions are sent to the AI provider to generate the answer, then are not kept. Only a fingerprint of your IP address and the time are kept for 24 hours to limit abuse.
• Free diagnostic: your answers and, if you tick the box, your email address to receive the result and two follow-up emails.
• Technical data: IP address (security and abuse prevention, never stored in clear), browser, device, error logs, your notification subscription if you turn notifications on, and an anonymous visit counter (landing page, referrer, device type, no identifier and no cookie).
• Payment: FounderPulse stores no card details. Payments are collected by Link (Stripe), which only sends us the subscription status and billing references.
• Support conversations and requests to exercise your rights.

Each processing activity relies on a legal basis under Article 6 GDPR:

• Providing the service (account, AI Co-Founder, plans, reminders, follow-ups, integrations): performance of the contract.
• Payment and billing: performance of the contract and legal obligation (accounting).
• Service follow-up emails (recaps, inactivity nudges, useful updates): legitimate interest, with one-click unsubscribe in every email.
• Free diagnostic follow-up emails: consent (checkbox), which you can withdraw at any time.
• Reading your sales and managing your prospects: performance of the contract, at your request. You remain responsible for the lawfulness of your outreach: informing the people you contact, honouring their right to object and the e-marketing rules that apply to email.
• Personal message from the founder to sign-ups without a subscription, at most one every 5 days: legitimate interest, which you can object to by replying "stop" or through the unsubscribe link.
• Review invitations (Trustpilot): legitimate interest (hearing from real users), and you can object at any time.
• Publishing testimonials: consent, which you can withdraw at any time.
• Audience measurement of our pages: consent through the cookie banner; without consent, no event is sent.
• Anonymous benchmarks and community (statistics aggregated by stage and business model, relative ranking, founder pairing): legitimate interest for aggregated statistics; consent (opt-in) for ranking and pairing.
• Security, abuse prevention and bug fixing: legitimate interest.

The AI Co-Founder's recommendations are suggestions: no decision producing legal effects for you is made solely by automated means.

Data is kept only as long as necessary:

• Account with an active plan (subscription, trial or granted access): for the whole relationship, then under the rule below.
• Account without an active plan: deleted automatically 6 months after the last activity, after two email warnings (30 days, then 7 days before).
• Deletion on request: deleting your account from Settings erases your conversations, memory, plans, results and integrations.
• Co-founder memory: while the account exists; you can view, edit and delete it at any time from the coach ("Memory" button) or Settings.
• Attached files: not kept after analysis.
• Billing data: 10 years, as required by French accounting rules.
• Free diagnostic without an account: email kept until you withdraw consent, and at most 3 years after the last contact.
• Cookie choices: 13 months.
• Sales connections and daily sales: until you disconnect the source or delete your account.
• Prospects: as long as you keep them in your list, and at most until your account is deleted.
• Error logs: 90 days at most.
• Prospect search log (including the no-signup trial): 30 days.
• Anonymous visit counter: 400 days. Audience measurement with consent: 13 months.
• Support: 3 years after the last exchange.

Under the GDPR you have the following rights over your personal data:

• Right of access: obtain a copy of your data and information on how it is used.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure: request deletion of your data in certain cases.
• Right to restriction: obtain suspension of processing in certain situations.
• Right to portability: receive your data in a structured, commonly used format.
• Right to object: object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.
• Right to give post-mortem instructions regarding your data.

To exercise these rights, send a written request to support@founder-pulse.com. We reply within one month, extendable to two months for complex requests. Proof of identity may be requested.

You also have the right to lodge a complaint with the French supervisory authority, the CNIL, or with your local data protection authority.

United States residents. FounderPulse does not sell or share your personal information as defined by US state laws (including California) and does no cross-site advertising tracking. The site does not change how it works based on your browser's "Do Not Track" signal, since it does not track your activity on other sites. The rights described above (access, correction, deletion) are open to you in the same way, at the same address.

FounderPulse does not sell your data and shows no advertising. Your data is shared only with the providers the service needs, bound by contract:

• Supabase: database and authentication, data stored in Paris (France).
• Cloudflare, Inc. (United States): application hosting, site delivery and attack protection.
• Google (Gemini) and OpenAI (United States), through the OpenRouter, Inc. gateway (United States) or the Lovable Labs Incorporated AB gateway (Sweden): generating the AI Co-Founder's answers from your messages, your context and attached files. These providers do not train their models on data sent through their API offerings. FounderPulse commits to never using your data to train a model and to only working with providers whose terms rule it out.
• Exa Labs, Inc. (United States): the web search engine used for prospect search, missions and market research. Only the request and the business context it needs (offer, target) are sent, without your identity.
• Stripe Payments Europe, Ltd. (Ireland): payments and billing.
• Link, a Stripe service (United States): official reseller of subscriptions and extra usage ("Sold through Link"). For payments, Link acts as an independent controller under its own privacy policy.
• Resend (United States): sending and receiving emails.
• Lovable Labs Incorporated AB (Sweden): the tool used to build the service, and the technical gateway through which exchanges with Stripe, Resend and connected calendars pass.
• Trustpilot A/S (Denmark): review invitations. After a payment or two weeks of use, your email address, first name and an order reference are sent to Trustpilot, which sends you a single invitation. Leaving a review is optional; you can object at any time by writing to support@founder-pulse.com and no invitation will be sent.
• Sentry (Functional Software, Inc., data hosted in the European Union): technical error detection, with the internal ID of the account concerned.
• AI Co-Founder web research and site reading: search queries are sent to DuckDuckGo, and the public pages to read (including the website you give) are read through Jina AI, without your identity.
• Your browser's notification services (Google, Apple, Mozilla): delivering notifications if you turn them on.
• Services you connect (Stripe, Lemon Squeezy, Google Calendar, Outlook, Claude, ChatGPT, Cursor): exchanges limited to what you authorise. Processing by an AI assistant you connect falls under its own provider.

The Community module, if you turn it on, only shows other founders a pseudonym and a relative position, never your name or your numbers, and nothing for groups under 5 founders.

Account data is stored in the European Union. Some providers (Cloudflare, OpenRouter, Google, OpenAI, Exa, Resend) are based in the United States: transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's standard contractual clauses.

You can request a copy of the safeguards in place by writing to support@founder-pulse.com.

FounderPulse implements appropriate technical and organisational measures to protect your data:

• Encryption in transit (TLS 1.2+) and at rest.
• Secure authentication and session management.
• Restrictive access controls and data minimisation.
• Keys to third-party services encrypted and never shown again.
• Technical error monitoring and admin access logs.

In the event of a personal data breach likely to create a high risk to your rights and freedoms, FounderPulse will inform you within the legal deadlines and notify the competent supervisory authority.

The use of cookies is governed by the Cookie policy. Only strictly necessary cookies are enabled by default. Analytics and marketing require your explicit consent, collected through the cookie banner.

This privacy policy may change to reflect updates to the service, our sub-processors or applicable regulations. The last update date is shown at the bottom of the page. In case of a significant change, you will be informed by email or through an in-app notification.