Privacy Policy

• To provide the platform: Create and manage your account, enable core features such as project creation, discovery, messaging, and co-founder matching.
• AI-powered matching: Generate anonymous vector embeddings of your profile text to power our matching algorithm. These embeddings are mathematical representations — not stored alongside your identity in a queryable form.
• Communications: Send transactional emails such as email verification, password reset, and reply/mention notifications. We do not send marketing emails without your explicit opt-in.
• Safety & integrity: Detect fraud, abuse, spam, and security threats. Enforce our Terms of Service and protect the community.
• Platform improvement: Understand aggregate usage patterns to improve performance, fix bugs, and develop new features. We use anonymised and aggregated data wherever possible.
• Legal compliance: Meet our obligations under applicable laws including the Nigerian Data Protection Act (NDPA) and, where applicable, the GDPR.

We implement a defence-in-depth approach to data security:

• All data in transit is protected by TLS 1.2 or higher
• Passwords are hashed using bcrypt with a work factor chosen to resist brute-force attacks
• Authentication uses short-lived JWT access tokens (15 minutes) and rotating refresh tokens (21 days), both stored as HTTP-only, SameSite cookies inaccessible to JavaScript
• Rate limiting is applied to all sensitive endpoints (login, registration, API calls) to prevent credential stuffing and abuse
• Access to production infrastructure and databases is restricted to authorised personnel only
• We conduct regular dependency audits and apply security patches on a timely basis

We use a minimal set of cookies strictly necessary to operate the platform:

• Authentication cookies: HTTP-only cookies that hold your access and refresh tokens. Required for you to stay logged in.
• Session / preference cookies: Remember your in-app settings such as theme preference.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that profile you across the web. You can clear cookies via your browser settings, but doing so will log you out of the platform.

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile photo from Google. Google's use of this data is governed by their privacy policy.
• Cloud infrastructure: Our servers and file storage are hosted on reputable cloud providers. Your data resides on servers that may be located outside your country of residence (see Section 8).
• Email delivery: Transactional emails are delivered via a third-party email service provider under a DPA.

Third-party services have their own privacy policies which we encourage you to review. FoundrGeeks is not responsible for the data practices of external services.

FoundrGeeks is operated from Nigeria and serves users globally. Your data may be processed in countries other than your country of residence. Where such transfers take place, we rely on:

• Standard contractual clauses (SCCs) approved by applicable regulators
• Data processing agreements with all subprocessors
• Encryption in transit and at rest

We retain personal data only as long as necessary to fulfil the purposes set out in this policy or as required by applicable law. In practice:

• Active accounts: data is retained for the lifetime of your account
• Deleted accounts: personal data is purged within 30 days of a deletion request
• Aggregated / anonymised analytics data may be retained indefinitely
• Certain records (e.g., abuse logs) may be retained for up to 24 months for safety and integrity purposes

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Display a prominent in-app notice for at least 14 days
• Send an email notification to registered users where required by law

Your continued use of FoundrGeeks after a change becomes effective constitutes your acceptance of the updated policy.

As a Nigerian company, FoundrGeeks complies with the Nigerian Data Protection Act 2023 (NDPA) and the regulations issued by the Nigeria Data Protection Commission (NDPC). Under NDPA, you have the right to:

• Be informed about how your data is processed
• Access, correct, or delete your personal data
• Object to processing or withdraw consent at any time
• Lodge a complaint with the NDPC

To exercise these rights, contact us at contact@foundrgeeks.com.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the GDPR / UK GDPR, including the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and to lodge a complaint with your national supervisory authority. Our legal bases for processing are: contract performance, legitimate interests, and — where required — explicit consent.

If you have any questions, concerns, or requests regarding this policy or your personal data, please reach out:

We aim to respond to all privacy requests within 14 business days and no later than 30 days.