1. Who is responsible for your data
The operator trading as Founder Battle is the controller of personal data processed through founderbattle.com and its related API (the Service). “We”, “us” and “our” refer to that operator.
Contact us about privacy at hello@founderbattle.com.
2. Personal data we collect
Information you give us
- your email address and, if supplied, your X handle;
- product listing details, website URLs, edits and account activity;
- community messages, replies, reactions, attached photos, read status and moderation records;
- the public page URL submitted for badge verification and earned review requests and status;
- sponsorship details, contact email, selected dates and campaign content;
- order, payment-status and refund records (but not your full card number); and
- messages and information you send when you contact us.
Information collected when you use the Service
- essential session and anonymous voter identifiers stored in cookies;
- if you allow analytics, Google Analytics page paths, device and approximate location information, and events for the submission, voting, challenge and booking journeys; we do not send email addresses or access tokens as event properties;
- which Founder Battle email links you use, when you reach the linked page, and votes you cast within 24 hours of that return; the owner can see this alongside the recipient account email and X handle;
- a short-lived, random browser-tab identifier kept in session storage and hashed to count people currently using the Service and distinct browser-tab visits each UTC day; the daily visit hash is deleted after up to two days while aggregate daily totals remain; this first-party count works regardless of your Google Analytics choice; while you are signed in, the short-lived presence record is associated with your account so we can choose between an in-app reply alert and a content-free email; after an unsigned product submission, a separate cookie can associate later visits from that browser with the submitted founder on the private owner map, without signing the browser in;
- IP address and limited user-agent information used to rate-limit requests and create one-way anti-abuse or visitor hashes; on visits and product submissions, we also use a local IP database to estimate country and city for a private owner-only map, storing a coarse location and a one-way network or account hash for up to 90 days, without keeping the raw IP in that map;
- Arena or Support vote source, battle-entry attribution, optional feedback, battle activity, battle-result views and next-action clicks, outbound visits, sponsor or boost impressions and clicks;
- request identifiers, route, time, response status and latency in technical logs; and
- device and connection information that our hosting and security providers receive when serving the Service.
Information from public sources and service providers
When a product or sponsor website is submitted, we fetch public pages and metadata from that website. If ordinary fetching fails and automated extraction is enabled, we may use search results and public pages associated with the exact submitted domain. If you supply an X handle, we retrieve the public profile bio and profile photo from X. We store a cached copy in our database for each and display them with your founder identity. Normal page views use our cached photo rather than requesting the photo from X again. Stripe sends us payment identifiers, status, amount, currency and limited transaction details needed to fulfil or refund an order.
3. Why we use personal data and our lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Create and secure an account; send sign-in and service emails | Email, tokens, session and security data | Contract and legitimate interests in secure access |
| Deliver optional push notifications in place of activity emails | Account and session identifiers, browser push endpoint and encryption keys, alert title, short summary and destination link; community message content is not included | Your permission to receive push on each device. You can disable push in Account Preferences or browser settings. Your browser provider (such as Apple, Google, Mozilla or Microsoft) carries encrypted push messages. Signing out removes that session’s push subscription. |
| Send ranked founders a daily ladder-opportunity email | Email, product ownership, current rank, available opponents and recent battle result | Legitimate interests in helping founders use the competition; you can turn these daily emails off in My Account or from any one of them |
| Publish and manage a product listing and public battle history | Listing, website, handle, account and battle data | Contract; legitimate interests in operating a useful, trustworthy directory |
| Provide community channels, replies, unread counts and moderation | Account identity, messages, replies, reactions, photos, read status and moderation records | Contract and legitimate interests in operating a useful, safe founder community |
| Verify optional website badges and administer earned founder reviews | Product ownership, badge page URL, verification and credit records, acknowledged feedback, review request and publication status | Contract and legitimate interests in preventing reward abuse |
| Notify you when another founder replies | Account email, sender identity, channel and short-lived signed-in presence status; reply content is not included in the email | Contract and legitimate interests in delivering expected service notifications without exposing conversation content by email |
| Record Arena and Support Votes and enforce fair-play rules | Choice, source attribution, optional feedback, cookie identifier, IP/user-agent-derived hashes and timestamps | Legitimate interests in operating fair rankings, measuring community support and preventing duplicate votes, fraud and abuse |
| Provide paid boosts and sponsorships | Contact, order, campaign, payment status and reporting data | Contract |
| Keep financial and compliance records | Order, payment and refund records | Legal obligation and legitimate interests in handling disputes |
| Count visits, impressions and clicks; show approximate visitor locations to the owner; improve reliability and the battle journey | Pseudonymous visitor hashes, coarse country and city estimates, result actions, event and technical log data | Legitimate interests in measuring delivery, diagnosing faults and improving the Service |
| Understand site journeys with optional Google Analytics | Page paths, device and approximate location, interaction and outcome events, and a payment reference and value after a confirmed booking | Your consent; analytics is off until you allow it |
| Show the owner how recipients respond to Founder Battle emails | Recipient account, email type, linked page path, click and return times, and votes within 24 hours | Legitimate interests in understanding the response to our communications |
| Show how many people are currently online, mark signed-in founders online on the private owner map, and route reply alerts | A random browser-tab identifier, kept in session storage and stored on our server as a one-way hash with its latest activity time; for signed-in members, a temporary account association | Legitimate interests in showing live community activity and avoiding unnecessary reply emails |
| Moderate content, investigate abuse and protect legal rights | Account, listing, vote, payment, communications and technical data | Legitimate interests and, where relevant, legal obligation |
Where we rely on legitimate interests, we consider whether the use is necessary and balance it against your rights and reasonable expectations. You can object as explained below. We use product ownership, rank and battle state to send one daily ladder-opportunity email while your product is ranked. It can show opponents available to challenge and a recent result to share. You can turn off daily emails separately, or stop all notification emails in Account preferences or from the unsubscribe link in a notification. Sign-in links and essential booking receipts can still arrive. We do not use account data to send third-party advertising and we do not sell personal data.
4. Public information
Product name, website, description, tags, category, images, submitted X handle, cached X profile bio and profile photo, rank, battle results and activity may be public and indexed by search engines. Sponsor names, taglines, websites and images are also public during placement. Do not submit personal data that you do not want published. Email addresses, payment records and account-security data are not displayed publicly.
5. Automated tools and ranking
We may use automated tools, including an OpenAI service when configured, to turn public website material into a suggested listing. You can review and edit the suggestion before publishing. Leaderboard positions and battle results are calculated automatically from valid votes under the published ranking rules. These processes do not make decisions that produce legal or similarly significant effects about individuals.
6. Cookies and similar technology
Account and fair-voting cookies are necessary for the Service. Google Analytics is optional and loads only after you choose “Allow analytics”; it may then set analytics cookies to recognise a browser across visits. We do not use advertising cookies. The online count does not create a cookie. It keeps a random identifier in session storage only while that browser tab remains open. We also use this identifier to count daily browser-tab visits on our own server; this count is independent of your Google Analytics choice. After an unsigned product submission, a separate HTTP-only cookie links visits from that browser to the submitted founder for the private map for up to 90 days. It does not grant account access and is cleared when you sign in or sign out.
| Cookie | Purpose | Duration |
|---|---|---|
founder_battle_session | Keeps an authenticated account signed in; HTTP-only | Up to 1 year; renewed during authenticated use |
founder_battle_map_submitter | Associates a browser that submitted a product with its founder on the private location map; HTTP-only and not a sign-in cookie | Up to 90 days; cleared on sign-in or sign-out |
founder_battle_voter | Assigns an anonymous identifier used to prevent repeat voting and count visits fairly; HTTP-only | Up to 1 year |
founder_battle_email_return | Connects an email link to your page return and votes within 24 hours; HTTP-only | 24 hours |
_ga and _ga_* | Optional Google Analytics browser and session measurement, only after you allow analytics | Up to 2 years unless you withdraw consent or clear cookies |
You can block or delete cookies in your browser, but account sign-in, voting and visit counting may not work correctly. Stripe may set its own cookies when you choose to visit its hosted checkout; Stripe explains those cookies in its own privacy information.
We remember your analytics choice in browser storage. You can change it at any time using. Rejecting or withdrawing analytics does not affect submitting, voting or buying a placement. Email link response measurement uses the separate 24-hour cookie described above, regardless of your Google Analytics setting.
7. Who receives personal data
We disclose data only where needed to operate the Service, including to:
- hosting, database, network, logging and security providers;
- Resend or an email infrastructure provider to send sign-in, battle, booking, community reply and daily ladder-opportunity messages;
- Stripe to create, confirm, manage and refund payments;
- Google, only if you allow optional Google Analytics, to measure site use and the journeys described above;
- OpenAI when automated listing extraction is enabled;
- professional advisers, insurers, auditors or transaction advisers under duties of confidence; and
- courts, regulators, law enforcement or other parties where required by law or necessary to protect legal rights and safety.
We do not sell personal data. If ownership of the Service changes, relevant information may be disclosed to the buyer or successor subject to appropriate confidentiality and data protection safeguards.
8. International transfers
Some suppliers may process personal data outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an applicable safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism, together with supplementary safeguards where required. Contact us if you would like more information about the safeguard relevant to your data.
9. How long we keep data
We keep personal data only for as long as reasonably needed for the purposes above:
- sign-in links expire after 15 minutes; authenticated browser sessions last up to 1 year and may be renewed during authenticated use;
- account and management data is kept while the account or listing remains active and for a reasonable period afterward to handle restoration, disputes, abuse and legal claims;
- public listings and battle records may remain as part of the leaderboard’s historical record, but we will remove or de-identify owner contact data where it is no longer needed;
- payment, refund and related transaction records are kept for the period required by tax, accounting and legal obligations;
- security, vote, visit, impression, click and technical records are kept for the period reasonably needed to prevent abuse, verify reporting, diagnose incidents and establish legal claims; and
- online-presence records are removed after 10 minutes without activity; approximate location records for the private map are removed after 90 days;
- email engagement records are removed after 90 days;
- backups are overwritten on a managed cycle and may retain deleted data for a limited additional period.
We decide the exact period by considering the amount, nature and sensitivity of the data, security risk, operational need and applicable limitation and record-keeping periods. We may retain de-identified statistical information that no longer identifies an individual.
10. Security
We use proportionate technical and organisational measures designed to protect personal data. These include expiring single-use sign-in links, hashed authentication and anti-abuse identifiers, HTTP-only cookies, transport encryption in production, access controls and payment processing through Stripe. No internet service is completely secure, so please tell us promptly if you suspect unauthorised account access.
11. Your data protection rights
Depending on the circumstances and the law that applies, you may ask us to access, correct, erase or restrict your personal data, or provide certain data in a portable format. You may also complain about how we use it. These rights can be subject to legal exceptions—for example, we may need to retain transaction records or evidence of abuse.
Your right to object
You may object to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
To exercise a right, email hello@founderbattle.com. We may ask for information needed to verify your identity. There is normally no fee, and we aim to respond within one month, subject to any lawful extension.
If you are in the UK, you may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first.
12. Children
The Service is intended for people aged 18 or over. We do not knowingly collect account or payment data from children. Contact us if you believe a child has provided personal data so we can investigate and take appropriate action.
13. Changes to this policy
We may update this policy when the Service, our suppliers or the law changes. We will post the updated version here and change the date above. If a change materially affects how we use account data, we will take reasonable steps to bring it to account holders’ attention.
14. Contact
Send privacy questions or rights requests to hello@founderbattle.com.