This policy explains how FoundOne s.r.o. handles personal data as a controller when you use FoundOne, use the client portal, visit foundone.io or contact us, under the GDPR (Regulation (EU) 2016/679) and Czech Act No. 110/2019 Coll. For data about candidates that agencies keep in FoundOne, the agency is the controller (Section 2).
1. Who is responsible
The controller is FoundOne s.r.o., ID No. 05766567, Evropská 2758/11, Dejvice, 160 00 Prague 6, Czech Republic (“we”). Write to hello@foundone.io about anything in this policy. We have not appointed a data protection officer because the law does not require one.
2. If an agency keeps your details in FoundOne
Recruitment agencies use FoundOne to keep details of candidates and client contacts. The agency decides whose details it keeps, why, for how long and with which clients it shares them. It is the controller of that data and must have your consent; we only process the data on its behalf, under our Data Processing Addendum. The agency may use FoundOne’s AI features, including Find, to help match people to jobs; people at the agency make every decision. To see, correct or delete your details, to withdraw consent, or to ask how the agency uses AI, contact the agency. If you write to us instead, we forward your request to the agency and tell you which agency it is, where we can.
3. What we process and why
| Purpose | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Your account and sign-in | name, work email, account ID and photo from Google or Microsoft if you sign in with them, sessions, sign-in time, IP address and browser | Art. 6(1)(b) contract; Art. 6(1)(f) security | while the account exists; sessions until they expire or you sign out |
| Workspaces and team | membership, role, invitations (including the invited person’s email), mentions, tasks assigned to you, change history | Art. 6(1)(b); Art. 6(1)(f) for invited people | while the workspace exists; unaccepted invitations expire |
| Client portal | name, email, the agency that invited you, sign-in links, sessions | Art. 6(1)(f) letting the agency work with its clients | while the agency keeps you as a portal guest |
| Running the Service for agencies | candidate profiles, CVs, notes and other content agencies put in | as processor for the agency (Section 2) | as the agency decides, then deleted as our DPA describes |
| AI features | what you type, a job you attach and the content needed (for example a CV), sent to our AI provider; for Find, a person’s professional details without their name, contact details, links, ages, birth dates and phrases about family, health, origin or religion; counts of AI requests, searches and checks per workspace | Art. 6(1)(b); Art. 6(1)(f) Usage Limits and preventing abuse | sent to the AI provider only to produce the result; what a feature saves stays in the workspace (Find runs and their logs 12 months after the last change); counts up to 12 months |
| Billing and tax | company name, billing address, country, VAT ID, billing email, plan, number of users, Database Size and add-ons, number of people in the workspace, invoices, card brand and last four digits (the full card stays with Stripe) | Art. 6(1)(b); Art. 6(1)(c) VAT Act No. 235/2004 Coll. and Accounting Act No. 563/1991 Coll. | 10 years after the end of the year of the invoice |
| Error reports | the page, the error message, browser and time, without form contents | Art. 6(1)(f) keeping the Service working | up to 30 days |
| Support | your messages, name, email, files you send | Art. 6(1)(b) or (f) | 3 years after our last contact |
| Emails | email, name | Art. 6(1)(b) for service emails; Art. 6(1)(f) and Section 7(3) of Act No. 480/2004 Coll. for product news to customers | until you unsubscribe or your account ends |
| foundone.io and the waitlist | email and anything you write in our forms; page visited, referring site, country and device type, without IP addresses or identifiers | Art. 6(1)(a) consent for the waitlist; Art. 6(1)(f) for questions and statistics | waitlist until launch plus 12 months or until you unsubscribe; questions 3 years; statistics in aggregate |
| Security, abuse and legal matters | logs, IP addresses, complaints about data in a workspace, reports of illegal content (the reporter’s name and email), our decisions, correspondence | Art. 6(1)(f); Art. 6(1)(c) Digital Services Act | logs up to 30 days; records needed for legal claims for the limitation period plus one year |
We need your account and billing details to provide the Service; without them we cannot contract with you. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Where we rely on legitimate interests, you may object (Section 9).
4. Where the data comes from
From you; from a colleague or agency who invites you to a workspace or the client portal; from Google or Microsoft when you sign in with them; from Stripe about the status of your payments; and from our systems as you use the Service.
5. Who receives it
We use the providers below to run FoundOne. They process data on our instructions under data processing agreements.
| Provider | What for | Where the data is |
|---|---|---|
| Cloudflare, Inc. | hosting, databases, file storage, email sending, bot protection, logs | stored in the EU; global network, USA |
| Anthropic, PBC | AI models behind the AI features | USA |
| Stripe Payments Europe, Ltd. | payments, invoices, tax calculation | Ireland, USA |
| Voitas Ventures s.r.o. (Tandmade) | hosting of foundone.io, its forms and visit statistics | EU, global network |
Stripe also acts as an independent controller for fraud prevention and its own legal obligations. Google and Microsoft are independent controllers when you choose to sign in with them. We also share data with professional advisers bound to confidentiality, with authorities when the law requires it, and with a buyer or successor in a merger or acquisition, who will be bound by this policy. We do not sell personal data.
6. Transfers outside the EU
Workspaces, files and accounts are stored in the EU. Some providers process data in the USA, in particular our AI provider when an AI feature is used. We transfer it on the basis of the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) with additional safeguards where needed. Write to us for a copy of the relevant safeguards.
7. AI and your content
We do not use your content, or candidates’ data, to train AI models, and our AI provider processes it under commercial terms that do not allow training on it. AI features help people at the agency read, write and search; they do not make decisions about anyone. When an agency uses Find, the AI that turns its request into search conditions sees only the agency’s messages and the job, never a profile. To check a person against the checklist the agency approved, the AI gets their professional details (role, place, notice, skills, languages, career, education, certificates), without the name, contact details, links, ages, birth dates, photos, the agency’s notes or phrases about family, health, origin or religion. Find does not search by protected characteristics, does not send people whose consent has ended, and quotes the text behind every answer. People at the agency make every decision.
8. Cookies and similar technologies
| What | Purpose | Type | Duration |
|---|---|---|---|
| App session | keeps you signed in | strictly necessary | until you sign out or it expires |
| Client portal session | keeps a portal guest signed in, only on portal pages | strictly necessary | until you sign out or it expires |
| Sign-in helpers | complete a sign-in link, an invitation or a sign-in with Google or Microsoft securely | strictly necessary | minutes to hours |
| Bot check (Cloudflare Turnstile) | protects sign-in from automated abuse | strictly necessary | for the check |
| Interface preferences (local storage) | remember language and the view you last used | strictly necessary | until you clear them |
| Payment pages (Stripe) | fraud prevention during checkout | strictly necessary | set by Stripe |
We use only strictly necessary technologies, which Section 89(3) of Act No. 127/2005 Coll. allows without consent. We use no analytics or advertising cookies. foundone.io counts visits without cookies.
9. Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests — including, at any time and without giving reasons, to direct marketing. Where we rely on consent, you can withdraw it at any time; this does not affect earlier processing. Write to hello@foundone.io. We reply within one month, which we may extend by two months for complex requests, and may need to verify your identity. For data an agency keeps about you, see Section 2. You can also complain to the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or to the authority in your EU country.
10. Security
We protect data with measures appropriate to the risk, including storage in the EU, a separate database for each workspace, encryption in transit and at rest, passwordless sign-in, roles checked on the server, rate limits and logging. Annex II of our DPA describes them in more detail. No system is completely secure; we notify agencies and the authorities of a breach as the law requires.
11. Children
FoundOne is a professional service for adults. We do not knowingly process data of children under 16.
12. Changes
We may update this policy. We will tell you about material changes by email or in the app before they take effect. The date at the top shows the current version.