Privacy policy
This policy explains what personal data FOUNDLY Radar processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The controller is FOUNDLY – Liam Valica, Au bei Turnau 33, 8624 Au bei Turnau, Austria, represented by Liam Valica. Privacy questions and requests: liam@foundly.us.
2. If you use Radar (customers)
| Data | Why | Legal basis |
|---|---|---|
| Email, password (stored only as a hash), mobile number, country (taken from your number's country code), terms acceptance | Your account and login, and which country's businesses you see | Contract (Art. 6(1)(b)) |
| Name, business name, postal address, phone, payment link, logo URL | Shown on your mockups, proposals and emails, as the law requires senders to identify themselves | Contract |
| Plan, credits, invoices, Stripe customer ID | Billing | Contract; legal obligation for invoices (Art. 6(1)(c)) |
| Leads, notes, consent records, opt-outs, mockups, proposals, team membership | Providing the service | Contract |
| Technical logs (IP address, browser, time) | Security and preventing abuse, kept by our hosting provider for a short time | Legitimate interest (Art. 6(1)(f)) |
Cookies: we only use cookies that are strictly necessary to keep you logged in. We use no analytics, advertising or tracking cookies, so no cookie banner is needed.
Payments are processed by Stripe; we never see or store your full card number.
3. If your business is listed in Radar
Radar contains public information about businesses — name, category, address, business phone and email, and public social media handles — from the Foursquare Open Source Places dataset (Apache License 2.0). Where a business is run by a single person, some of this can be personal data. We don't collect private addresses or private numbers on purpose and we hold no sensitive data.
- Purpose: letting web designers and agencies find businesses without a website, or with a website that needs improving, and offer them website services.
- Website checks: if your business has a website, we may visit its public homepage once in a while (like a search engine would) and store a quality score and a short list of issues, such as “not made for phones” or “no https”. We don't store the page content or anything about your visitors.
- Legal basis: our and our customers' legitimate interest in offering services to businesses (Art. 6(1)(f)). We limit the data to public business details, show it only to logged-in customers, make each contact cost a credit, and make it easy to object.
- Your right to object: use the opt-out link in any message you receive, or our removal form, or email liam@foundly.us. We hide your business from all Radar users, usually within 7 days, and keep a minimal record so it isn't added again on the next data update.
- Who sees it: Radar customers who unlock your business's contact details. Each of them is an independent controller for how they contact you and must follow our Acceptable use policy.
4. If you open a mockup or proposal link
When you open a website preview or proposal someone sent you, we record that it was opened, when, and whether it was on a phone or a computer, and show this to the sender. We don't store your IP address for this and set no cookies. Legal basis: the sender's legitimate interest in knowing whether their offer was seen (Art. 6(1)(f)). The page has a link to stop all further messages.
5. Visitors of websites built by our customers
Websites our customers build for their clients can include a small FOUNDLY script. It counts page views and taps on phone, WhatsApp, email, map and booking links, and whether the device is a phone or a computer. It sets no cookies and we store no IP address or other identifier, so individual visitors can't be recognised. The counts are shown to the website's owner and their web designer. Raw counts are deleted after 25 months.
4a. If you ask us for a website preview
When you fill in the “Get my free preview” form on our homepage, we store your business name, city, phone number and/or email, the plan you chose, your message and your country (from your connection). We use them only to build your preview, send it to you and talk with you about a website. Legal basis: steps at your request before a contract (Art. 6(1)(b)). If we don't start working together, we delete the request within 12 months. We send you one confirmation email; you won't get marketing emails unless you also sign up for the newsletter.
5a. Newsletter
If you sign up for our checklist and newsletter, we store your email address, the page you signed up on, your country (from your connection) and the time you confirmed. We use double opt-in: nothing is sent until you click the link in our confirmation email. Legal basis: your consent (Art. 6(1)(a)). Every email has a one-click unsubscribe link; after unsubscribing we keep only a record that you opted out. Emails are delivered by Resend, Inc. (USA, covered by the EU Standard Contractual Clauses).
5b. Google Maps data
When a customer checks a business's rating, Radar sends the business's name and address to Google's Places API and shows the result live. We store only Google's place identifier, not ratings or reviews. Google's privacy policy applies: policies.google.com/privacy.
6. Service providers
- Supabase (database and login; data stored in the EU)
- Vercel (website hosting)
- Stripe (payments; also an independent controller for fraud prevention)
- Google (Places API, only for rating checks)
- Resend (sending confirmation and newsletter emails)
- Anthropic (Claude API — writes websites in the AI builder from the business details you enter; by default Anthropic does not use API inputs or outputs to train its models)
Some providers are based in the USA. Transfers are covered by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the EU Standard Contractual Clauses.
7. How long we keep data
- Account data: while your account exists, then deleted within 30 days.
- Invoices and payment records: as long as tax law requires (up to 10 years).
- Mockup and proposal view records: 24 months.
- Website preview requests: up to 12 months if no contract follows.
- Business listings: until removed or no longer in the source dataset. Removal records are kept so a removed business stays removed.
8. Your rights
You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. Email liam@foundly.us. You can also complain to a data protection authority, for example Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria or the authority where you live.
9. Security
Data is encrypted in transit, access is restricted by row-level security in the database, and contact details are released only to customers who unlock them.
10. Changes
We'll update this policy when our processing changes and show the date at the bottom of the page.
Last updated: 25 October 2026