Privacy notice
Version: draft of 5 October 2026
Draft. This page is awaiting legal review and may change before MakeFounders is generally available. If you are evaluating MakeFounders now, ask us for the current version.
Who this notice is for
This notice explains how MakeFounders handles personal data. It applies under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and under Singapore’s Personal Data Protection Act 2012 (PDPA).
Which part applies to you depends on how you use MakeFounders:
- You take part in a programme (as a founder, mentor, reviewer, applicant, investor or member of staff). The accelerator, incubator or university that runs the programme decides why and how your data is used. It is the controller (in PDPA terms, the organisation responsible). MakeFounders processes your data on its behalf, as its processor (data intermediary). Its own privacy notice applies as well as this one.
- You are our customer’s contact, or you contact us (for example, you ask for a demo). MakeFounders is the controller of that data.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Identity and contact details | Name, email address, time zone, your role in a programme or startup | You, or the programme that invited you |
| Sign-in data | A protected (hashed) password, two-step verification settings, the devices you are signed in on | You |
| What you write and upload | Check-ins, evidence, notes, messages, applications, interview records, files | You |
| Programme records about you or your startup | Milestone progress, feedback, session notes, review scores, health scores | You, programme staff, mentors and reviewers |
| Optional demographic answers | Gender, age band, whether you are a first-time founder | You, only with your explicit consent, which you can withdraw |
| Technical records | IP address, browser type, and a log of security-relevant actions | Created automatically when you use MakeFounders |
| Enquiries | Your name, work email, organisation and message | You, through the demo request form or by email |
We do not ask for special-category data (such as health or ethnicity) and ask customers not to upload it. Founders sometimes record the people they interview; they are asked to do so only with those people’s knowledge.
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing MakeFounders to a programme and the people in it | Decided by the programme as controller, typically performance of a contract or its legitimate interests. We act on its instructions. |
| Keeping accounts secure, preventing misuse, keeping an audit log | Legitimate interests in running a secure service; legal obligation where one applies |
| Managing our relationship with customers: contracts, billing, support | Performance of a contract; legitimate interests |
| Replying to enquiries and demo requests | Legitimate interests in responding to you; steps taken at your request before a contract |
| Optional demographic reporting, in aggregate | Your explicit consent |
Under the PDPA, we collect, use and disclose personal data with your consent or as otherwise permitted by the Act, and only for purposes a reasonable person would consider appropriate.
We do not sell personal data, and we do not use it for advertising.
How AI features use data
Some features use an AI model to draft, summarise or suggest. When one runs, the text it needs (for example, a startup’s check-ins and evidence) is sent to our AI supplier, OpenAI, and the result is shown to the person who asked. The supplier’s terms for this service exclude using the data to train its models. AI never changes records by itself; a person confirms. No decision with legal or similarly significant effect is made about you by automated means alone. An organisation can switch AI features off entirely.
Who we share it with
Within a programme, your data is visible to the people that programme’s roles allow: for example, a founder’s check-ins are seen by the programme team and that startup’s mentors. Outside it, we share data only with suppliers who process it for us, under contract:
| Supplier | What for | Where |
|---|---|---|
| Neon | Database | UK |
| Railway | Application hosting | EU |
| Vercel | Website hosting | Global network; no customer data stored |
| Cloudflare | File storage | EU |
| OpenAI | AI features | USA |
| Resend | Sending email | USA / EU |
| Stripe | Subscription billing (customer contacts only) | USA / EU |
| Sentry | Error monitoring (no personal data is sent) | EU |
We may also disclose data where the law requires it.
Transfers outside the UK and Singapore
Customer data is stored in the UK and the European Union. Where a supplier processes data elsewhere, including the USA, the transfer is covered by the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. For individuals in Singapore, we take steps to ensure that data transferred out of Singapore receives a standard of protection comparable to the PDPA.
How long we keep it
- Programme data: for as long as the organisation’s subscription runs, then deleted or returned as its contract provides.
- Unsuccessful and withdrawn applications: 12 months by default; each organisation can change this.
- Audit log: 24 months by default; each organisation can change this.
- Deleted files: removed 30 days after deletion.
- Enquiries and demo requests: up to 24 months after our last contact.
Your rights
Under UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its use, to receive it in a portable form, and to withdraw consent where we rely on it. Under the PDPA you have the right to access and correct your data and to withdraw consent.
If you take part in a programme, you can do much of this yourself: download your data and ask for your account to be erased from your account page. For anything else, contact the organisation that runs your programme, which is the controller; we will help it respond. For data we control, contact us at the address below.
You can complain to the UK Information Commissioner’s Office (ico.org.uk) or, in Singapore, to the Personal Data Protection Commission (pdpc.gov.sg). We would appreciate the chance to put things right first.
Cookies and similar storage
This website sets no cookies. When you sign in to the application, it sets:
- one cookie that keeps you signed in; and
- a second, for ten minutes, only if you sign in through your organisation’s single sign-on.
Both are strictly necessary, so no consent banner is needed. Your browser also stores a few of your choices (such as which workspace you last used, and your currency on the pricing page). We use no analytics, advertising or third-party cookies, and load no third-party scripts or fonts.
Security
How we protect data is described on the security page. If a breach is likely to put people at risk, we notify the organisations affected without undue delay, and within 72 hours of becoming aware of it.
Changes to this notice
We will post changes here and, where they are significant, tell customers by email before they take effect.
Contact
Email privacy@makefounders.com. The company that operates MakeFounders, its registered address and its data protection contact will be shown here when this notice is finalised.