legal
Privacy Policy
This Privacy Policy explains what personal data The Founder (operated by Enmaa Consulting, Dubai, UAE, at thefounder.ae) collects when you use the wizard, the AI tools, the operating system apps, and the website, why we collect it, where it is stored, who else can see it, and what choices and rights you have.
What we collect
Account data
Name, email address, and (if you sign in with Google) the basic profile details Google shares with us. If you set a password instead, we store a securely hashed version of it, never the password itself.
Business data
The answers, documents and content you enter into the wizard, the plan, the operating-system apps (Finance, CRM, Operations, Growth, Compliance, Team, Library, Hub) and the AI tools (advisor, Concept Studio, Name Check) — for example your sector, budget, team size, business idea, and the records you keep in the apps.
Billing data
Which plan you are on and your subscription status. We do not collect or store your card number, expiry date or CVC — payment happens on Stripe's own hosted checkout page, and Stripe is the party that holds your card details, not us.
Usage & technical data
Standard technical data your browser sends on every request (IP address, browser type, pages visited, timestamps), used for security, reliability and improving the product.
Communications
If you contact us (including via the contact form or by email), we keep the message and your reply-to details so we can respond and keep a record of the request.
How we use it
- To run the wizard, the AI tools and the operating-system apps, and to compute your plan.
- To create and secure your account, and to authenticate you when you sign in.
- To process payments and manage your subscription (via Stripe).
- To send service messages — for example a welcome email, a password reset, a billing receipt, or (only if you opt in) WhatsApp notifications.
- To respond to support and contact requests.
- To keep the service secure, prevent abuse, and meet our legal obligations.
- We do not sell your personal data, and we do not use it for third-party advertising.
Storage and processing
Your account and business data is stored in a Supabase-hosted Postgres database. Access is restricted with row-level security so that, in the normal course of the product, you can only read and write your own records; a small number of privileged operations (for example confirming a payment) run through a separate, tightly-scoped service key that end users and the browser never see.
Supabase's infrastructure runs on major cloud providers; exact data-residency (which region your data physically sits in) depends on the Supabase project configuration and has not yet been independently confirmed against a signed data-processing agreement — this is flagged as an open item for the pre-launch legal review, not something we are asserting here as already verified.
How long we keep it
We keep your account and business data for as long as your account is active, so the product keeps working the way you left it. If you ask us to delete your account, we will delete or anonymise your personal data within a reasonable period, except where we must keep certain records for longer to meet a legal, tax or accounting obligation (for example, billing records tied to a completed payment). Message content sent to us via the contact form is kept for as long as reasonably needed to handle the request and for a limited period afterwards for our own records.
Third parties we use
We share the minimum data needed with a small number of service providers who process it on our behalf:
- Supabase — database, authentication and file storage.
- Stripe — payment processing for paid plans. Stripe receives your payment details directly; we only receive confirmation of payment and your subscription status.
- Resend — delivery of transactional emails (welcome, password reset, receipts, and replies to messages sent through the contact form).
- Anthropic — the AI provider behind the wizard advisor, Concept Studio and Name Check. Relevant parts of your business inputs are sent to Anthropic's API to generate a response; this happens under Anthropic's own API terms, and is used to answer your request, not to train our own separate product.
- Google — if you choose "Sign in with Google", or if you separately opt in to connect Google Calendar (read-only), Google processes the relevant account/profile or calendar data for that feature only. We also use Google Maps/Places to power business-location tools when you use them.
- WhatsApp (Meta) — only if you opt in to WhatsApp notifications, your phone number and the relevant message content is sent via Meta's WhatsApp Business platform.
- Web-search providers — the Name Check tool queries a third-party search API with the business name/details you enter, to check availability across the web.
We do not sell any of this data, and we do not permit these providers to use it for their own advertising.
Your rights (PDPL)
Subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), you can:
- Ask what personal data we hold about you, and get a copy of it.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your account and personal data, subject to the retention exceptions above.
- Withdraw any consent you previously gave (for example, for WhatsApp notifications), at any time.
- Ask for your data in a portable format.
- Object to a specific processing activity, or ask us to restrict it.
To exercise any of these, contact us using the details below. We will respond within a reasonable time.
Children
The Founder is a business tool intended for adults setting up or running a company. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
Changes to this policy
We may update this policy as the product changes or as the professional legal review referenced above is completed. Material changes will update the "Draft prepared" date at the top of this page.
Contact us about your data
Email hello@thefounder.ae, or use the contact form. We are operated by Enmaa Consulting, Dubai, UAE.