Privacy Policy

1. Information We Collect

1.1 Information You Provide to Us

Account Information: When you register for an account, we collect your email address and name. If you sign up using Google authentication, we receive your name, email address, and profile picture from Google.

Payment Information: If you subscribe to a paid plan, our payment processor Stripe collects your payment card details. We do not store your full card number—only a reference to your Stripe customer record and the last four digits of your card for display purposes.

User Content: We collect the content you create and input into the Services, including:

• Project names and descriptions
• Persona configurations and details
• Interview questions and conversations
• Any other data you input into the Services

Communications: If you contact us directly, we may receive additional information about you such as your name, email address, and the contents of your message.

1.2 Information Collected Automatically

Usage Data: We automatically collect certain information when you access the Services, including:

• Pages and features you access
• Time spent on pages
• Actions you take within the Services
• Referring URLs

Device and Browser Information: We may collect information about your device, including IP address, browser type, operating system, and device identifiers.

Cookies and Similar Technologies: We use cookies and similar tracking technologies to collect information. See our Cookies Policy for more details.

2. How We Use Your Information

We use the information we collect to:

• Provide the Services: Create and manage your account, process your transactions, and deliver the features you request
• Improve the Services: Analyse usage patterns, diagnose technical issues, and develop new features
• Communicate with You: Send service-related emails, respond to your enquiries, and provide customer support
• Process Payments: Handle billing, invoicing, and subscription management
• Ensure Security: Detect, prevent, and respond to fraud, abuse, or security incidents
• Comply with Legal Obligations: Meet our legal and regulatory requirements

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

3.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

3.4 With Your Consent

We may share your information for other purposes with your explicit consent.

4. AI Data Processing

4.1 How AI Processes Your Data

When you use the Services, your User Content (including project details, persona configurations, and interview conversations) is sent to third-party AI providers (Anthropic and Google) for processing via their APIs.

4.2 No Training on Your Data

Your data is not used to train AI models. Both Anthropic and Google have committed to not using data submitted via their APIs for model training:

• Anthropic: API data is not used to train models by default. See Anthropic's Privacy Policy.
• Google: Gemini API data is not used to train models when using paid API tiers. See Google's AI Data Policies.

4.3 Data Retention by AI Providers

AI providers may temporarily retain data for abuse prevention and operational purposes:

• Anthropic: May retain API inputs for up to 30 days for trust and safety purposes
• Google: Retention periods vary; see their documentation for current policies

We encourage you to review the privacy policies of our AI providers for the most up-to-date information.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Secure authentication mechanisms
• Regular security assessments
• Access controls and authentication for our systems

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. Data Retention

We retain your personal information for as long as necessary to:

• Provide the Services to you
• Comply with our legal obligations
• Resolve disputes
• Enforce our agreements

Account Data: Retained while your account is active and for a reasonable period thereafter to allow for reactivation.

User Content: Retained while your account is active. Upon account deletion, User Content is deleted within 60 days.

Usage Data: Retained in anonymised or aggregated form for analytics purposes.

Payment Records: Retained as required by tax and accounting regulations (typically 7 years).

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our service providers are located.

When we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequate data protection laws
• Certification mechanisms such as the EU-US Data Privacy Framework

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to certain exceptions.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to our processing of your personal information in certain circumstances.
• Restriction: Request that we restrict processing of your personal information.
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, please contact us at alex@fullstackfounder.ai. We will respond to your request within 30 days.

If you are in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children's Privacy

The Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us at alex@fullstackfounder.ai, and we will take steps to delete such information.

10. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Effective" date. Your continued use of the Services after any changes indicates your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Email: alex@fullstackfounder.ai

Alex Omeyer trading as Full Stack Founder
United Kingdom

We will endeavour to respond to your enquiry within 30 days.

13. Legal Basis for Processing (UK/EEA Users)

If you are located in the UK or European Economic Area, we process your personal data on the following legal bases:

You may object to processing based on legitimate interests by contacting us. However, this may affect your ability to use certain features of the Services.