Privacy Policy

FoundIn.ai is operated by Nexari B.V. (the "Controller", "we", "us"), a company registered in the Netherlands. References to "FoundIn.ai" in this policy mean Nexari B.V. acting as the controller for personal data processed through the foundin.ai website and product.

Contact for privacy matters: privacy@foundin.ai.

We only collect what we need to deliver and improve the service:

• Account data — email, name, hashed password (or Google OAuth subject), preferred language.
• Business data you give us — the URL, prompts, competitors, and settings you save in the dashboard.
• Usage data — pages viewed, features used, request logs, error traces. Tied to your account where you are signed in, anonymous otherwise.
• Billing data — held by our payment processor Paddle (see sub-processors). We receive a customer reference, plan, transaction ID, and the country / VAT identifiers required for invoicing.
• AI-engine outputs — text returned by ChatGPT, Gemini, Perplexity and Claude when we probe them on your behalf. We store these alongside your account so you can see your visibility over time.

• Contract (Art. 6(1)(b) GDPR) — delivering the product, running probes, sending account emails.
• Legitimate interest (Art. 6(1)(f)) — security logging, fraud prevention, product analytics from which we cannot identify you.
• Consent (Art. 6(1)(a)) — non-essential cookies, marketing emails. Withdrawable at any time from the footer or your account.
• Legal obligation (Art. 6(1)(c)) — keeping invoice records for the statutory retention period.

We do not sell personal data. We share data only with the sub-processors listed at /legal/subprocessors, each bound by a Data Processing Agreement that mirrors the protections in this policy.

Your data is processed primarily in the EU. Some sub-processors (e.g. AI engine APIs) process data in the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework.

• Account data — for as long as you have an account.
• Soft-deleted accounts — purged 30 days after deletion (you can cancel the deletion during that window from your settings).
• Probe history — rolling 24 months on paid plans, 90 days on free.
• Invoices and tax records — 7 years (Dutch tax law).
• Security logs — 90 days.

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. You can exercise each of these directly inside the app at Settings → Privacy (Export my data, Delete my account, Manage consent), or by emailing privacy@foundin.ai. We respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted, logged, and protected by two-factor authentication. Read more on our Security page.

See our Cookie Policy for the full table. You can change your choice anytime via the "Cookie preferences" link in the footer.

We'll notify you by email or in-app at least 14 days before material changes take effect. Older versions are kept in our changelog on request.