Privacy Policy

v1.2.0 — Effective October 20, 2026

This Privacy Policy describes how CoFounder.AI, Inc., a Delaware corporation ("CoFounder.AI," "we," "us," or "our"), collects, uses, and shares information when you use our AI-powered business planning and co-founder platform and related services (the "Service").

1. Information We Collect

Information You Provide:

• Account information: name, email address, phone number, organization name
• Founder profile information: business stage, business category, problem statement, target audience, and other onboarding inputs
• Payment information: processed securely by Stripe (we do not store card numbers)
• Projects, business plans, conversations, and AI-generated artifacts you create
• Documents, websites, and data you upload to or connect with the Service
• Voice and messaging content: when you use our voice or text-messaging features, the audio of your calls with the AI, recordings and transcripts of those calls, and the content of the text messages (including SMS and iMessage) you exchange with the Service
• Communications with us (support requests, feedback)

Information Collected Automatically:

• Device information: IP address, browser type, operating system
• Usage data: features used, projects created, pages visited, AI interactions
• Log data: access times, errors, performance metrics
• Cookies and similar technologies (see Section 7)
• Advertising data: if you reach us through an ad, the ad's click identifier (for example Google's gclid or Reddit's click ID) and the campaign parameters in the link (UTM tags), subject to your cookie choices (see Section 7)

Information from Third Parties:

• Authentication data from identity providers (Google, LinkedIn) when you use SSO
• Public profile data retrieved on your behalf from LinkedIn (via our enrichment provider) and from public websites you ask us to analyze, when you opt in to those features
• Connected account data: when you connect a third-party account or service (such as email, calendar, social media, storage, or analytics) through our integration provider, the information we access from that account at your direction to perform the tasks you request

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Generate AI-powered business plans, recommendations, and other outputs you request
• Process and transcribe voice calls and messages to operate and improve our voice and messaging features
• Access and act within accounts you connect, at your direction, to perform the tasks you request
• Process transactions and send related information
• Send technical notices, updates, and security alerts
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns to improve functionality
• Measure our advertising: learn which ads and campaigns lead to sign-ups and purchases, and report those conversions to the ad platforms that ran them (see Sections 3 and 7)
• Detect, prevent, and address fraud, abuse, or security issues
• Comply with legal obligations
• Send marketing communications (with your consent)

AI and Model Training:

We may use aggregated, de-identified data from your use of the Service to evaluate and improve our prompts, retrieval pipelines, and machine-learning components. This helps us improve recommendation quality, AI accuracy, and develop new features.

You may opt out of having your data used for these improvement purposes by contacting [email protected] or through your account settings. Opting out will not affect your access to the Service.

We do not use your private project content, founder profiles, uploaded documents, or other identifiable personal information to train third-party foundation models. When we send your inputs to third-party AI providers (e.g., OpenAI, Anthropic, Google) to generate responses, we do so under contractual terms that prohibit those providers from using your data to train their models.

Voice Calls and Recording Consent:

When you use our voice features, we and our voice and telephony providers record and transcribe your calls with the AI to provide, secure, and improve the Service. Some jurisdictions, including California, require all parties to a call to consent to its recording. By using the voice features and continuing a call after any recording notice, you consent to the recording and transcription of your calls with the Service, and you agree to obtain consent from any other participants you choose to include on a call.

Connected Accounts and Integrations:

When you connect a third-party account, the Service accesses and acts within that account only as needed to perform the tasks you direct or approve (for example, drafting or sending an email, or publishing a social post you authorize). You can review your connected accounts and disconnect them or revoke access at any time in your account settings or with the relevant provider. We do not use the contents of your connected accounts for advertising.

Legal Basis for Processing (GDPR):

• Performance of contract: to provide the Service you requested
• Legitimate interests: to improve and secure the Service
• Consent: for marketing communications, optional enrichment features, and analytics and marketing cookies
• Legal obligation: to comply with applicable laws

3. How We Share Your Information

We do not sell, rent, or trade your personal information for money. We may share your information with:

• Service Providers: Third-party companies that help us operate the Service (see Section 8).
• Advertising Partners: If you allow marketing cookies (or, where consent is not required, have not opted out), we share conversion events, such as signing up or starting a paid subscription, with the ad platforms that ran the ad you came from (Google Ads and Reddit Ads), together with the ad click identifier, the purchase value, and your email address so the platform can match the conversion to the ad. Google hashes the email address in your browser before it is sent. A marketing agency that manages our campaigns on our behalf has access to these measurements. These partners use this information to measure and improve our campaigns.
• Legal Requirements: When required by law, subpoena, or legal process, or to protect our rights, privacy, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred.
• With Your Consent: When you direct us to share information with third parties.

Under California law (and similar laws in other U.S. states), sharing information with advertising partners for ad measurement may count as "sharing" for cross-context behavioral advertising, or as a "sale," even though no money changes hands. You can opt out at any time; see Section 6.

4. Data Security

We implement industry-standard security measures to protect your information:

• TLS encryption for data in transit
• Encryption at rest for stored data
• Tenant isolation in our database
• JWT-based authentication
• Regular security audits and monitoring
• Access controls and authentication requirements

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: retained until account deletion
• Project content and conversation history: retained until you delete it or close your account
• Voice recordings, transcripts, and message content: retained until you delete them or close your account
• Application logs: retained for 90 days
• Ad-click cookie: 90 days in your browser; once you sign up, the ad click is kept with your account until account deletion
• Cookie consent choice: about six months
• Payment records: retained for 7 years (legal requirement)
• Support communications: retained for 3 years

Upon account deletion, we will delete or anonymize your data within 30 days, except where retention is required by law.

6. Your Rights and Choices

All Users:

• Access, update, or correct your personal information via account settings
• Delete your account and associated data
• Opt out of marketing communications
• Opt out of having your data used for Service improvement
• Export your data in a portable format

California Residents (CCPA/CPRA):

• Right to know what personal information we collect and how it's used
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information. We do not sell your data for money; to opt out of sharing with advertising partners, turn off marketing cookies in Cookie settings or enable Global Privacy Control in your browser, which we treat as an opt-out
• Right to limit the use of sensitive personal information
• Right to non-discrimination for exercising your rights

European Residents (GDPR/UK GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

To exercise these rights, contact us at [email protected].

7. Cookies and Tracking Technologies

We use cookies and similar technologies (such as local storage) in three categories. You can review and change your choices at any time in Cookie settings, which is also linked in the footer of our website.

Essential cookies are required for the Service to work and are always on: they keep you signed in, protect your account and our forms, and remember preferences such as your language and time zone.

Analytics cookies help us understand how the Service is used so we can improve it:

• PostHog (product analytics and session replay): records pages viewed, clicks, and feature usage, and can record your session in the product so we can see where people get stuck. Password and email fields are masked in recordings. Once you sign in, this activity is linked to your account email.
• Google Analytics 4 (web analytics, provided by Google LLC, loaded through Google Tag Manager): collects information such as your IP address (which Google truncates), device and browser type, referring URL, pages viewed, and time on page. We use it to analyze and improve the Service and do not use it to build advertising profiles about you.

Marketing cookies measure our advertising:

• When you arrive from an ad, a first-party cookie (cf_ads, kept for 90 days) remembers the ad's click identifier and campaign parameters. When you create an account, we store them with your account and your subscription records so we can tell which campaign led to a sign-up or purchase, even if you buy days later.
• Google Tag Manager, Google Ads and Reddit Ads tags report sign-ups and purchases back to the platform that ran the ad, as described in Section 3.

Where consent is required. If you visit from the European Economic Area, the United Kingdom, or Switzerland (or we cannot tell where you are visiting from), analytics and marketing cookies stay off until you accept them. Google Tag Manager is not loaded until you do.

Elsewhere, analytics and marketing cookies are on by default and you can turn them off at any time. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of marketing cookies and of sharing with advertising partners.

We remember your choice in a first-party cookie (cf_consent) for about six months, after which we may ask again. Changing your choice takes effect immediately; if you withdraw consent, we stop setting optional cookies and delete the ad-click cookie. Information already collected is handled as described in Section 5. You can also delete or block cookies in your browser settings, though blocking essential cookies will stop the Service from working. You can additionally opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on. For more about how Google uses data, see Google's Privacy Policy.

8. Service Providers

We use trusted third-party service providers to help us operate the Service, including providers for:

• Authentication and identity management (Google, LinkedIn)
• Cloud hosting, database, and storage services (Google Cloud Platform, MongoDB Atlas)
• Payment processing (Stripe)
• Transactional email delivery (Resend)
• AI and machine-learning capabilities (OpenAI, Anthropic, Google)
• Voice AI, telephony, and messaging (ElevenLabs, Twilio, Sendblue)
• Third-party account integrations you connect (Composio)
• Profile and website enrichment (EnrichLayer, Firecrawl)
• Product analytics and session replay (PostHog)
• Web analytics, tag management, and advertising measurement (Google Analytics 4, Google Tag Manager, Google Ads, Reddit Ads), and a marketing agency that manages our ad campaigns
• Content delivery and security (Cloudflare) and monitoring

These providers only access your information as necessary to perform services on our behalf and are contractually obligated to protect your data.

For enterprise customers, a complete list of sub-processors is available in our Data Processing Agreement (DPA). To request a DPA, contact [email protected].

9. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers are located. If you are located outside the United States, your information will be transferred to the U.S. in accordance with applicable data protection laws.

For transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission (and the UK Addendum, where applicable).

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at [email protected].

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. The "Effective" date at the top indicates when the policy was last revised.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

CoFounder.AI, Inc.
4065 Glencoe Avenue
Marina Del Rey, CA 90292
Email: [email protected]