Legal
Privacy Policy
What we collect, why we collect it, and how to get it back or deleted.
Last updated 8 September 2026
1. Who is responsible
Riyad Bakhshiyev, Wroclawska 53M, 30-011 Kraków, Poland, is the data controller for personal data processed through FundedBy. Contact us at hello@fundedby.app.
2. What we collect
| Data | When | Why |
|---|---|---|
| Email address, display name | You create an account | To sign you in and contact you about your account |
| Email address | You join the waitlist | To tell you when we launch |
| Product details, logo, links, X handle | You list a campaign | To display your campaign publicly |
| Company name, website, description, logo, X handle | You sponsor a campaign | To display your placement publicly |
| Claim records: campaign, time, hashed IP, delivery email | You claim a benefit | To deliver it and to prevent abuse |
| Stripe connected-account ID and transfer status | You connect Stripe | To transfer founder earnings |
| Page views, sponsor clicks, share clicks | You browse a campaign | Aggregate counts shown to founders and sponsors |
| Page views and whether you are currently online, keyed by a one-way hash of your IP address and browser that changes every day | You browse the site | The public “online now” and total view counts; no cookie or device storage is used, and the hash cannot be linked across days |
We never see your card details. Payments go directly to Stripe, which acts as its own controller for that data.
We do not store raw IP addresses for claims. Your IP is hashed with a secret key before it is written, so it can be compared against other claims but not read back or reversed to identify you.
3. Cookies
We use a session cookie to keep you signed in, and a first-party identifier cookie to help spot abusive claiming. We do not run advertising or cross-site tracking cookies, and we do not sell your data.
Logos shown next to companies are loaded from a third-party favicon service, which means that provider can see your IP address when a page loads.
4. Why we are allowed to process it
- Contract — running your account, campaigns, sponsorships, claims and payouts.
- Legitimate interests — preventing fraud and abuse, keeping the service secure, and producing aggregate statistics.
- Legal obligation — keeping financial and tax records.
- Consent — the waitlist, and any marketing email. You can withdraw it at any time.
5. Who we share it with
- Supabase — database, authentication and file storage.
- Vercel — hosting and request logs.
- Stripe — sponsor payment processing, founder identity checks and founder transfers.
- Founders — if you claim a benefit, the founder sees what they need to deliver it.
These providers may process data outside your country. Where that happens, transfers rely on the safeguards those providers publish, such as standard contractual clauses. We do not sell personal data.
6. How long we keep it
- Account data — until you delete your account.
- Claim records — kept after a campaign ends so abuse limits still work; hashed IPs are not personally readable.
- Payments, invoices and the revenue ledger — retained as long as accounting and tax law requires, typically several years. These are never deleted on request.
- Waitlist emails — until you unsubscribe or we launch and delete the list.
7. Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it elsewhere in a portable form. Email hello@fundedby.app and we will respond within one month.
If you are in the EU or UK and think we have got something wrong, you can also complain to your national data protection authority.
8. Security
Data is encrypted in transit. Internal tables are protected by row-level security so one account cannot read another’s records, and financial operations run server-side only. No system is perfectly secure, but we will tell affected users promptly if a breach puts their data at risk.
9. Children
FundedBy is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes
We will update this page when our practices change, and note the date at the top.