Privacy Policy

1. Information We Collect

1.1 Information You Provide to Us

Account Information: When you register for an account, we collect your email address and name. If you sign up using Google authentication, we receive your name, email address, and profile picture from Google.

Payment Information: If you subscribe to a paid plan, our payment processor Stripe collects your payment card details. We do not store your full card number—only a reference to your Stripe customer record and the last four digits of your card for display purposes.

User Content: We collect the content you create and input into the Services, including:

• Project names and descriptions
• Persona configurations and details
• Interview questions and conversations
• Any other data you input into the Services

Communications: If you contact us directly, we may receive additional information about you such as your name, email address, and the contents of your message.

1.2 Information Collected Automatically

Usage Data: We automatically collect certain information when you access the Services, including:

• Pages and features you access
• Time spent on pages
• Actions you take within the Services
• Referring URLs

Server-side Product Analytics: For signed-in users, we send pseudonymous product-lifecycle events to PostHog's EU service. We associate these events only with your Supabase user ID. We do not send any project, research-job, persona, interview, share-link, payment, Stripe, or other database ID to PostHog. Depending on the action, an event may contain your sign-up provider; booleans; counts; duration ranges; credit costs; or controlled source, origin, outcome, plan, pack, term, and action labels. These events do not contain your name, email address, User Content, research or interview content, file contents, URLs, share tokens, payment identifiers, or authentication tokens. This server-side processing does not set a cookie and takes place independently of your browser cookie choice.

Consent-based Browser Analytics: If you accept analytics in our cookie banner, PostHog also receives page-view and page-leave events, redacted page paths and referring URLs, and technical fields added by its browser SDK (such as browser, operating-system, device, session, and library information). For signed-in users, we associate this stream with the same Supabase user ID. We disable automatic click collection, dead-click collection, session replay, and console recording. The browser SDK uses memory-only storage, so Clien.ai does not set a PostHog cookie or retain a PostHog browser identifier in local or session storage.

Device and Browser Information: We may collect information about your device, including IP address, browser type, operating system, and device identifiers.

Cookies and Similar Technologies: We use cookies and similar tracking technologies to collect information. See our Cookies Policy for more details.

2. How We Use Your Information

We use the information we collect to:

• Provide the Services: Create and manage your account, process your transactions, and deliver the features you request
• Improve the Services: Analyse usage patterns, diagnose technical issues, and develop new features
• Communicate with You: Send service-related emails, respond to your enquiries, and provide customer support
• Process Payments: Handle billing, invoicing, and subscription management
• Ensure Security: Detect, prevent, and respond to fraud, abuse, or security incidents
• Comply with Legal Obligations: Meet our legal and regulatory requirements

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

Exa: When we run market, competitor, and audience research for your validation reports, we send search query terms derived from your User Content to Exa (exa.ai), a US-based search provider. These query terms describe your product idea, its competitors and market, and — for audience research — the typical roles, seniority, and archetypes of the people who might use your product (for example, "the typical roles and seniority of people who would use a product for [your idea]"). The query terms we send to Exa are descriptions of roles and markets; they are not the names, dossiers, or profiles of specific individuals.

For audience research, Exa returns professional-profile data from its own index. Before that data is used, we reduce it to anonymous, count-only statistics within our own systems: we require at least ten profiles behind any figure we derive, keep only aggregate distributions (such as the mix of seniority levels across an audience), and never store or display anything that identifies a specific individual. We do not build or retain profiles of named people, and we do not use this data to contact anyone.

Unlike Anthropic and Google (see Section 4.2), Exa's Terms of Service give it a licence to use the query terms we send, and the results it returns, to provide, develop and improve its products, which can include training its models. We use Exa's self-serve plan, which does not include zero data retention; Exa does not publish how long it keeps query data on that plan. Exa processes these query terms under its Data Processing Addendum, which forms part of Exa's Terms of Service, includes the EU Standard Contractual Clauses, and requires Exa to delete personal data at our written direction when the service ends, and under its own privacy policy.

Stack Exchange: To find public questions and answers that show how people describe a problem, we send up to six search keywords to the public Stack Exchange API. In validation research, the keywords are taken from your product idea. When you ask us to generate a persona through our MCP tools or API, they are taken from the role, industry, and brief you give for that persona. We never send your project details or your files, and we send your idea only as these keywords (for a very short idea, that can be every word of it). We do not have a data processing agreement with Stack Exchange. It handles these requests under its own privacy policy.

OpenAI: We use OpenAI's API in two ways. First, to measure whether later interviews in a validation run are still surfacing new themes, we send short theme statements taken from the AI interview findings to OpenAI's embeddings service. Second, when our Reddit community-evidence search is enabled for a run, we send search requests to OpenAI's web search, limited to reddit.com. Each of those requests contains search terms taken from your product idea and project details (which can come from files you upload). Depending on the search, that can be the text of your product idea itself, a short excerpt of your project details, or a search phrase our AI writes from them. OpenAI processes this data under its own terms and privacy policy.

E2B: Validation research runs in isolated cloud sandboxes provided by E2B. The inputs to a run — your product idea, project details, and text from files you upload — are sent into the sandbox, where our research agent processes them and calls the AI and search providers described above. Our E2B sandboxes run in the United States. E2B processes this data under its own terms and privacy policy.

Public websites: During research, our AI agent also searches the web and opens public web pages (for example, Hacker News search) to find evidence. The search terms and page addresses it uses may be derived from your product idea, and the sites it visits receive those requests under their own policies.

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

3.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

3.4 With Your Consent

We may share your information for other purposes with your explicit consent.

4. AI Data Processing

4.1 How AI Processes Your Data

When you use the Services, your User Content (including project details, persona configurations, and interview conversations) is sent to third-party AI providers for processing via their APIs: Anthropic (Claude models, for persona generation, interviews, validation research, and reports), Google (Gemini, for persona avatar images, using limited persona fields), and OpenAI (text embeddings of interview themes and, when enabled for a run, Reddit search). Our search and retrieval providers (Exa and Stack Exchange) and our research sandbox provider (E2B) are described in Section 3.1.

4.2 Model Training

We do not use your User Content to train AI models. Our AI providers' own positions on training are:

• Anthropic: API data is not used to train models by default. See Anthropic's Privacy Policy.
• Google: Gemini API data is not used to train models when using paid API tiers. See Google's AI Data Policies.
• OpenAI: Our OpenAI organization has sharing data with OpenAI for model training turned off, and our Reddit search requests ask OpenAI not to store them. OpenAI still keeps abuse-monitoring logs for up to 30 days. See OpenAI's Privacy Policy.

Exa is different: it may use the search query terms we send it to train its own models (see Section 3.1).

4.3 Data Retention by AI Providers

AI providers may temporarily retain data for abuse prevention and operational purposes:

• Anthropic: Deletes API inputs and outputs within 30 days by default; content flagged for a trust and safety review may be retained for up to 2 years
• Google: Retention periods vary; see their documentation for current policies
• OpenAI: Retention is governed by OpenAI's API terms and data controls; see their documentation for current policies

We encourage you to review the privacy policies of our AI providers for the most up-to-date information.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Secure authentication mechanisms
• Regular security assessments
• Access controls and authentication for our systems

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. Data Retention

We retain your personal information for as long as necessary to:

• Provide the Services to you
• Comply with our legal obligations
• Resolve disputes
• Enforce our agreements

Account Data: Retained while your account is active and for a reasonable period thereafter to allow for reactivation.

User Content: Retained while your account is active. Upon account deletion, User Content is deleted within 60 days.

Product Analytics: PostHog events that remain linked to your Supabase user ID are retained for 12 months. We then delete them or convert them into aggregated data that no longer identifies you.

Payment Records: Retained as required by tax and accounting regulations (typically 7 years).

Shared Report Links: A validation report can have one standing “anyone with the link” share link. So that you can copy that link again at any time, we store it in a reusable form — not as a one-way hash. Anyone who obtains the link, including through a breach of our database, can read that report without signing in, so treat a share link like a password. The link does not expire; revoking it takes effect immediately and it can no longer be opened, and creating a new one issues a different link that replaces it. Links are deleted when the report is deleted or upon account deletion.

For each share link we also keep a server-side log of views and source-link clicks. These records are personal data about the people you share a report with. We use them only to measure whether shared reports are opened and read, and we retain them for as long as the report exists — they are deleted when the report is deleted or upon account deletion. We do not use them to identify individual recipients or build profiles.

Share links created before August 2026 worked differently: they were addressed to a named recipient, expired automatically, and were stored only as a one-way hash. Where any of those older links still exist, we still hold that recipient label and its hash, and we still cannot recover the link itself.

7. International Data Transfers

Your information may be processed in the United States and in other countries where our service providers operate.

Where a provider's data processing terms include safeguards for transfers of personal data from the UK or EEA, we rely on them. Exa's and Upstash's data processing agreements (which form part of their Terms of Service) include the EU Standard Contractual Clauses; Upstash's also covers the EU-U.S. Data Privacy Framework. E2B processes data under its own terms and privacy policy.

Stack Exchange does not currently have a data processing agreement with us, so data sent to it is processed under its own terms.

Anthropic's and OpenAI's data processing addendums, which form part of their commercial terms, include the EU Standard Contractual Clauses and the UK transfer addendum. Google processes data under its own terms.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to certain exceptions.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to our processing of your personal information in certain circumstances.
• Restriction: Request that we restrict processing of your personal information.
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, please contact us at alex@fullstackfounder.ai. We will respond to your request within 30 days.

If you object by email to our legitimate-interests product analytics, we will suppress future non-essential server-side analytics for your account. This does not delete or stop us keeping records needed to provide the Services or meet contractual, accounting, security, or legal obligations.

If you are in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children's Privacy

The Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us at alex@fullstackfounder.ai, and we will take steps to delete such information.

10. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Services after any changes indicates your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Email: alex@fullstackfounder.ai

Alex Omeyer trading as Full Stack Founder
United Kingdom

We will endeavour to respond to your enquiry within 30 days.

13. Legal Basis for Processing (UK/EEA Users)

If you are located in the UK or European Economic Area, we process your personal data on the following legal bases:

You may object to processing based on legitimate interests by contacting us. An objection to non-essential product analytics does not prevent you from using the Services; we will suppress future server-side analytics for your account while keeping contractual, accounting, security, and legal records where required.