Privacy Policy

1. Who we are

FounderRoute is operated by Rachid Elharrak, an individual based in Tangier, Morocco. For applicable privacy laws, the operator is generally the controller of account, product, and community data.

When a business customer places personal data about its own contacts, interview participants, team members, or customers into FounderRoute, the business customer may be the controller and FounderRoute may act as its processor. The Data Processing Terms address that relationship.

2. Data we collect

Depending on how you use FounderRoute, we process:

• Account and identity data: name, email address, profile image, authentication identifiers, and account-security events managed with Clerk.
• Contact and support data: name, email address, request topic, optional startup name, message, and technical anti-abuse data submitted through the contact form.
• Startup workspace data: onboarding answers, projects, stages, plans, decisions, evidence, goals, metrics, notes, tasks, marketing drafts, expenses, runway information, and support requests.
• AI data: prompts, relevant startup context, model selections, generated responses, token and cost estimates, usage credits, errors, and safety metadata.
• Startup Memory data: files you upload, extracted text, source chunks, AI-proposed facts, citations, processing status, and the consent record for AI analysis.
• Community data: community profile fields, startup profiles, posts, comments, reactions, follows, reviews, reports, blocks, notifications, and content you choose to publish.
• Private-message data: encrypted message bodies and images, public encryption keys, wrapped message keys, conversation participants, timestamps, edits, reactions, and read status.
• Integration data: connected Typeform identifiers, access credentials, linked forms, response content, and synchronization events when you enable that integration.
• Newsletter data: email address, consent status, consent version, source, and subscription or unsubscription timestamps.
• Billing data: plan, subscription status, order and customer identifiers, billing period, refund status, and related records received from Polar. FounderRoute does not receive full payment-card details.
• Technical data: IP address, browser and device information, request logs, security events, cookie identifiers, and diagnostic information generated when you use the service.

3. How and why we use data

We use data to provide and secure accounts; save and organize startup work; generate requested AI analysis; process files; operate community and messaging features; provide integrations; administer plans and AI credits; send requested service or newsletter emails; prevent fraud and abuse; troubleshoot; comply with law; and improve reliability and usability.

Our legal bases, where required, include performing our contract with you, pursuing legitimate interests such as security and product reliability, complying with legal obligations, and consent for optional processing such as newsletters and AI analysis of uploaded files.

FounderRoute may analyze de-identified operational statistics, such as feature usage, latency, errors, and model cost. We do not use your prompts, files, AI chats, private messages, or private workspace content to train FounderRoute models.

4. AI processing

FounderRoute sends the information needed for a requested AI task to OpenRouter and an eligible downstream inference provider. Depending on the feature, this may include your prompt, recent chat history, startup snapshot, Startup Memory context, stage deliverables, evidence, uploaded-file extracts, images, or expense information.

FounderRoute configures OpenRouter requests to deny provider data collection and require eligible zero-data-retention routes. This means prompt and response content is not retained by the selected inference endpoint for later use or training. OpenRouter may retain request metadata such as model, token counts, latency, and cost. Model availability and the infrastructure provider serving a model can change.

Do not submit passwords, API keys, payment-card data, government identifiers, health information, or other regulated or unnecessary sensitive personal data. AI outputs can be inaccurate and must be checked before important decisions.

5. Public and private areas

Your startup workspace, unpublished decisions, evidence, uploads, and AI chats are private to the relevant account and project. Community profiles, startup information entered into community features, posts, comments, and published testimonials are visible to other users or the public as indicated in the interface.

One-to-one direct-message bodies are encrypted in the browser. FounderRoute stores ciphertext and delivery metadata but does not hold the private key needed to read message bodies. Participants can still copy, screenshot, or disclose messages, so encryption does not control what a recipient does after reading them.

6. When we share data

We disclose data only as needed to operate FounderRoute, follow your instructions, complete payments, protect the service, or comply with law. Recipients can include the providers listed on the Subprocessors page, other users when you publish or communicate with them, professional advisers under confidentiality, authorities when legally required, and a successor if the service is reorganized or transferred.

We do not sell personal data. We do not share private customer content for third-party advertising.

7. Retention and deletion

We retain account and workspace data while your account is active and as needed to provide the service. You can delete individual files, memory fields, messages, community content, and eligible projects through available controls.

When you delete your account, active account and workspace data will be removed or de-identified without undue delay. Residual copies may remain in protected backups for up to 30 days. Limited billing, fraud-prevention, dispute, security, and legal records may be kept longer when required by law or reasonably necessary to establish or defend legal claims. Polar may retain transaction records under its own legal obligations.

8. International processing

FounderRoute is operated from Morocco and uses service providers in other countries. Primary application data is stored with Supabase in East US (Ohio), United States. Authentication, hosting, AI, email, integration, and billing data may also be processed in the United States and other countries where the listed providers operate.

Where required, we rely on provider data-processing agreements, contractual safeguards, approved transfer mechanisms, and other lawful measures. International transfers remain subject to applicable Moroccan CNDP requirements and the laws that protect the relevant user.

9. Your choices and rights

We provide all users with a way to request access, correction, export, deletion, restriction, or objection where relevant. You can update many details directly, export Startup Memory, delete content, cancel a subscription, and unsubscribe from marketing through the links provided in each email.

Authenticated users can submit privacy requests through FounderRoute’s in-app support channel or email privacy@founderroute.app. We may verify identity before completing a request. You may also complain to the privacy authority that applies to you, including Morocco’s CNDP where relevant.

10. Age requirement

FounderRoute is for people aged 18 or older. We do not knowingly offer the service to children or intentionally collect children’s personal data.

11. Changes to this policy

We may update this policy as FounderRoute, its providers, or applicable laws change. We will update the date shown on the page and provide additional notice when a change materially affects your rights or how private content is used.