Privacy policy.
- We collect what we need to run Founder Layer for you. Nothing more.
- We never sell your data and never use it to train AI models.
- You can ask for an export of your data at any time.
- You can delete your account at any time. Your data is removed from our servers, including backups, within 30 days.
- You have full rights over your data: access, correction, deletion, portability, objection and more.
1. Who we are
Founder Layer FZCO ("Founder Layer", "we", "us") is a company registered with the International Free Zone Authority (IFZA), Dubai, United Arab Emirates. We are the controller of the personal data described in this policy.
Privacy contact: contact@founderlayer.ai
2. What this policy covers
This policy covers personal data we handle when you visit founderlayer.ai, request a free audit, book a call, start a trial, use the service or contact us.
Your content may include personal data about other people, for example contacts in your CRM, people mentioned in posts or names in contracts. For that data, you are the controller and we are your processor. We handle it only on your instructions, under our data processing agreement, which is available on request.
3. The data we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Audit and contact requests | Your email address, the website you share, whether you chose the founder or growing team view, the plan you looked at, whether you asked for updates, and basic visit context: browser language, time zone, device type, the page that referred you and any campaign tags in the link | You and your browser |
| Public information for the audit | Public information about the website you share and its presence in search, AI answers and social media | Public sources |
| Account data | Name, work email, company, role, login details, team members you invite | You |
| Billing data | Billing name and address, tax number, plan and invoices. Card details are held by our payment processor, never by us | You and our payment processor |
| Your content | Brand Wiki, documents, posts, drafts, corrections, approvals and the work the teams produce | You and the service |
| Connected account data | Access tokens and the data those accounts share with us, such as posts and performance figures, CRM records, accounting entries or documents, depending on which teams you use | The services you connect |
| Usage and device data | Pages visited, features used, IP address, browser, device, log and security records | Your browser and our systems |
| Communications | Emails, call bookings and notes | You |
We do not ask for special category data (such as health, religion or political opinions). Please do not include it in your content unless your business needs it and you have a lawful basis for it.
4. How we use it and why
Data protection law requires a lawful basis for each use of personal data. These are ours:
| Purpose | Lawful basis |
|---|---|
| Run the free audit you ask for, send you the report and follow up about it | Legitimate interests (answering your request) or steps before a contract |
| Create and run your account, provide the AI teams and publish the work you approve | Contract |
| Take payments, issue invoices and keep financial records | Contract and legal obligation |
| Answer your questions and help you use the service | Contract and legitimate interests |
| Keep the service secure, prevent fraud and abuse and fix problems | Legitimate interests |
| Improve the service using usage data, without using your content to train AI models | Legitimate interests |
| Send occasional updates about Founder Layer | Consent, if you tick the box on our audit form. For customers, legitimate interests. You can unsubscribe at any time |
| Non-essential cookies, if we ever use them (see section 13) | Consent |
| Comply with the law and respond to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 11).
5. AI and your data
- The models we use. The teams run on models from Anthropic (Claude), OpenAI and Google (Gemini), through their business services.
- No training. We do not use your content or personal data to train AI models. Our AI providers process your data only to produce the work you ask for, under business terms that do not allow them to train their models on it.
- Human approval. The teams prepare work and you approve it, or set the rules it runs within. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
- Your rules stay yours. Corrections you make are stored in your Brand Wiki and used only for your account.
6. Who we share it with
We never sell your personal data. We share it only with:
- Service providers who process it for us under contract:
- Cloudflare: website hosting, security and privacy-friendly website analytics;
- our cloud hosting provider for the Founder Layer platform;
- Anthropic, OpenAI and Google: the AI models that do the work;
- Zoho: our business email;
- Google: the records of audit requests (Google Sheets);
- Calendly: when you book a call;
- bundle.social: publishing to the social accounts you connect;
- our payment processor, once we take card payments. We will name it here before then.
- Services you connect, such as social platforms, your CRM, accounting software or e-signature tools, when you ask us to act on them. Their own privacy policies apply to what they do with the data.
- Professional advisers, such as lawyers, auditors and insurers, under confidentiality duties.
- Authorities, where the law requires it.
- A buyer or successor if our business is sold or merged, under the same protections. We will tell you before that happens.
7. International transfers
We are based in the United Arab Emirates and some of our providers are located in other countries, including the United States. When we transfer personal data from the European Economic Area or the United Kingdom to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or our providers' equivalent safeguards. You can ask us for a copy. We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
8. How long we keep it
| Data | How long |
|---|---|
| Account data, your content and connected account data | While your account is open. Removed within 30 days after you delete your account |
| Backups | Overwritten on a rolling basis. Deleted account data is gone from backups within 30 days |
| Invoices and payment records | 7 years, as UAE tax law requires |
| Audit requests from people without an account | 12 months, then deleted |
| Security and access logs | Up to 12 months |
| Contact details for updates | Until you unsubscribe or object |
| Emails and call notes | Up to 24 months after the conversation ends |
9. Taking your data with you
Your data is yours. Write to contact@founderlayer.ai and we will send you an export of your Brand Wiki, content history, drafts and approval log in common formats such as JSON, CSV and Markdown, within 30 days. This works at any time, including after you cancel your plan and until your account is deleted. You can also ask us to send your data directly to another provider where that is technically possible.
10. Deleting your account
You can delete your account at any time by writing to contact@founderlayer.ai. We recommend asking for an export first.
- Your account closes straight away. Publishing stops, your connected accounts are disconnected and we revoke our access to them.
- Your content and personal data are permanently removed from our servers, including backups, within 30 days.
- We ask our service providers to delete the data they hold for us within the same period.
- We keep only what the law requires, such as invoices, for the periods in section 8.
We confirm by email once the deletion is complete.
11. Your rights
Under the GDPR, the UAE Personal Data Protection Law and similar laws where you live, you have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct data that is wrong or incomplete;
- Delete your data;
- Restrict how we use your data in some cases;
- Port your data to another provider in a machine-readable format;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent at any time, where we rely on consent, without affecting earlier processing;
- Not be subject to decisions based solely on automated processing that have legal or similarly significant effects.
To use any of these rights, write to contact@founderlayer.ai. We reply within one month. If your request is complex, we may extend this by up to two more months and will tell you why. We may need to confirm your identity first. Using your rights is free.
If your request concerns data in a customer's content (where we are the processor), we will pass it to that customer and help them respond.
12. Security
We protect your data with encryption in transit, access limited to the people who need it, protected storage for connected account credentials, a log of the actions the teams take and regular backups. Our staff and contractors are bound by confidentiality. If a personal data breach puts your rights at risk, we will notify the relevant authority within 72 hours where the law requires it and tell you without undue delay.
13. Cookies
Today our website sets no cookies. It stores one preference in your browser (whether you chose the founder or the growing team view) so the page remembers it, and it uses Cloudflare's website analytics, which do not use cookies or track you across sites. We do not use advertising cookies.
The Founder Layer app uses essential cookies to keep you signed in and secure. If we ever add non-essential cookies, such as analytics or advertising cookies, we will ask for your consent first through a cookie banner, and you will be able to change your choice at any time.
14. Children
Founder Layer is a business service for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy. For material changes, we will tell customers by email or in the service at least 30 days before they take effect. The date at the bottom of this page shows the latest version.
16. Contact and complaints
Questions or requests: contact@founderlayer.ai
Founder Layer FZCO, International Free Zone Authority (IFZA), Dubai, United Arab Emirates.
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the data protection authority where you live or work, or where you think an infringement took place. In the UAE, that is the UAE Data Office. In the UK, that is the Information Commissioner's Office.