Data Processing Terms

1. Scope and roles

These Data Processing Terms form part of the FounderRoute Terms of Service for a business customer (“Customer”). They apply only to personal data that Customer submits to FounderRoute for processing on Customer’s behalf (“Customer Personal Data”). Customer is the controller or processor, as applicable. FounderRoute is the processor or subprocessor. FounderRoute remains an independent controller for account administration, security, service usage, and billing data described in the Privacy Policy.

2. Instructions and compliance

FounderRoute will process Customer Personal Data only to provide, secure, support, and improve the service as documented in the agreement; follow Customer’s lawful feature choices and support requests; and comply with law. Customer instructs FounderRoute to perform that processing and is responsible for its notices, lawful basis, data accuracy, and instructions. FounderRoute will inform Customer if an instruction appears to violate applicable data-protection law unless legally prohibited from doing so.

3. Processing details

• Subject: providing the FounderRoute founder workspace, AI features, memory processing, community, integrations, support, and related security.
• Duration: the account term plus the deletion and backup period described in the Privacy Policy.
• Nature: collection, storage, organization, retrieval, analysis, generation, transmission, deletion, and other processing initiated by Customer’s use.
• Data subjects: Customer users, founders, team members, contacts, interview participants, prospective or actual customers, and other people whose data Customer lawfully submits.
• Data: identity and contact data, account data, startup notes, interview responses, business records, files, communications, usage records, and other content selected by Customer.
• Sensitive data: not intended or permitted. Customer must not submit regulated health data, payment-card data, government identifiers, passwords, secrets, or other special-category data unless FounderRoute has expressly agreed in writing.

4. Confidentiality and security

FounderRoute will restrict Customer Personal Data to people and providers that need it for the service and are subject to appropriate confidentiality duties. FounderRoute will maintain reasonable technical and organizational safeguards appropriate to the risk, including the measures summarized on the Security page. Customer acknowledges the service’s documented security boundaries and is responsible for secure account configuration and lawful content.

5. Subprocessors

Customer gives general authorization for the subprocessors listed on the Subprocessors page. FounderRoute will require processors to protect Customer Personal Data consistently with applicable contractual and legal duties. Material additions will be posted at least 15 days before the new provider begins routine processing where reasonably possible. Customer may object during that period on reasonable data-protection grounds by emailing privacy@founderroute.app; if no reasonable alternative exists, Customer may stop using the affected feature or terminate the service.

6. Rights, assessments, and audits

Taking into account the nature of processing and available information, FounderRoute will reasonably assist Customer with verified data-subject requests, security inquiries, impact assessments, and regulator consultations required by applicable law. FounderRoute may satisfy audit obligations using current documentation, provider reports, written responses, and other proportionate evidence. Any additional audit must be legally required, coordinated in advance, limited to relevant systems, protect other customers, and be at Customer’s reasonable cost unless it reveals a material breach.

7. Security incidents

FounderRoute will notify Customer without undue delay after confirming a breach of Customer Personal Data where notification is required, and will provide available information reasonably needed for Customer’s obligations. Unsuccessful attacks and events that do not compromise Customer Personal Data are not security incidents under these terms.

8. Return and deletion

During the account term, Customer may use available export and deletion controls. On account deletion or termination, FounderRoute will delete or de-identify Customer Personal Data from active systems without undue delay and from protected backups within 30 days, except data that law requires to be retained or that is reasonably needed for security, fraud prevention, disputes, or legal claims.

9. International transfers

Customer authorizes processing in Morocco, the United States, and other locations used by approved subprocessors. The primary Supabase project is in East US (Ohio). Where a restricted transfer requires a specific mechanism, the parties will rely on applicable standard contractual clauses, approved addenda, provider data-transfer frameworks, or another lawful mechanism. These terms do not replace any CNDP filing or authorization required for Customer’s or FounderRoute’s processing.

10. Order of priority

If these Data Processing Terms conflict with the Terms of Service on the handling of Customer Personal Data, these Data Processing Terms control. Mandatory data-protection law controls over both. Liability remains subject to the Terms of Service except where applicable law prohibits that limitation.