Privacy Policy

What we collect

• Account: your email, name, username, sign-in method (email or Google) and role.
• Profile: what you choose to add, such as your photo, startup or fund, thesis, portfolio, experience and links. Most of it is optional.
• Verification: the domain you verified and how (work email, website code or team review), and any LinkedIn link you send for review.
• Raise and revenue: your raise details. If you connect a payment gateway, only the 30-day totals (revenue, payment count, customer count); the key you paste is used once and never stored. If you send a revenue report for review, our team reads it and the file is deleted once it's been checked; only the totals are kept.
• Connections and messages: requests, notes, yes/no answers and messages with people you've connected with, and the contact details you choose to share.
• Reports: if you report a member, we keep who reported whom, the reason and what you wrote. Only our admin team reads reports, and the person reported isn't told who reported them. Admin actions (such as blocking an account) are logged.
• Blocks: who you've blocked and when. Only you can see your blocks; the person you block isn't told. Your chat with them stays stored but hidden from both of you, and comes back if you unblock.
• Payments: handled by Lemon Squeezy. We receive your plan, status and renewal dates, never your card details. Before checkout opens, if you tap "I'd pay" on the pricing page, we keep which plan and billing period you picked, until you take it back or delete your account.
• Consent: when you agreed to these terms and confirmed you're 18 or over, and which version you agreed to.
• Technical: basic logs (time, page, IP address, errors) to keep the service working and stop abuse. Logs are kept for a short time. We don't use advertising or analytics trackers.

We don't ask for government IDs, card numbers, or anything about your health, religion, caste, politics or sexuality.

Why we use it, and on what basis

• To provide the service you signed up for (contract): run your account, verify members, match founders with investors, deliver requests, messages and notifications, and process paid plans.
• Because you chose to (consent): show your profile, raise and revenue to the people your settings allow. You can withdraw this any time by changing those settings or deleting your account.
• To keep Cluster safe (legitimate interest): prevent spam, fraud and abuse, and fix problems.
• Because the law requires it: for example, tax records for payments, kept by Lemon Squeezy.

The fit score that ranks founders and investors is worked out automatically from what you both entered. It only orders lists; it doesn't decide anything about you. We never sell or rent personal data, and we don't use it for advertising.

Who can see what

• Your public profile can be seen by anyone with the link.
• Your raise, deck and (by default) verified revenue are visible only to verified investors, and only while Raising mode is on.
• Contact details and messages are visible only to the person you connected with, after you both said yes.
• Our team can access data when needed to verify members, handle reports or support you.

Service providers

We use a few providers to run Cluster. Each may only use your data to provide their service to us:

• Supabase: database, sign-in, file storage, live updates
• Vercel: hosting
• Lemon Squeezy: payments, as merchant of record
• Our email provider: sign-in, confirmation and password-reset emails
• Google: only if you choose Continue with Google
• Your payment gateway (such as Stripe, Razorpay, Lemon Squeezy, Paddle, PayPal, Polar, Square or Gumroad): only when you ask us to read your revenue
• OpenStreetMap, Google and DuckDuckGo: map images and company logos on the directory. Your browser loads these directly, so they see your IP address.

Your data may be stored and processed outside the country you live in (mainly in the US, EU and India). Where data leaves the EU, UK or another country with transfer rules, it's covered by the safeguards those laws recognise, such as the European Commission's Standard Contractual Clauses (and the UK addendum) that these providers sign, plus encryption.

Security and how long we keep it

Data is encrypted in transit and at rest, and database rules limit every read and write to the people allowed. We keep your data while your account is open. When you delete your account it is erased straight away, and drops out of our backups within 30 days. Revenue report files are deleted once reviewed. We keep only what the law requires (such as payment records, held by Lemon Squeezy) and a minimal record of accounts we blocked for abuse, so a ban can't be dodged by signing up again.

If we ever have a breach that affects your data, we'll tell you and the authorities as the law requires.

Your rights

Everyone has these rights, wherever they live:

• See and download your data: Settings → Download my data.
• Correct it: edit your profile at any time.
• Delete it: Settings → Delete my account erases everything at once.
• Take it with you: the download is a machine-readable file (JSON) you can move elsewhere.
• Withdraw consent: hide revenue, turn off Raising mode, or delete your account. Withdrawing doesn't affect what was done before.
• Object or ask us to pause any use of your data that relies on our legitimate interest, or while you dispute it: email us.
• Nominate someone to exercise these rights if you die or can't: email us their name and contact.
• Not be treated differently for using any of these rights.
• Complain: to us first, please (contact below). You can also go to the data protection authority where you live.

We reply to requests within 30 days, and sooner where the law asks. We may ask you to confirm it's you, usually by writing from your account email.

Where you live

• India: we act as the Data Fiduciary. Our Grievance Officer (below) handles complaints; if you're not satisfied, you can go to the Data Protection Board of India.
• EU, EEA and UK: Cluster is the controller. The legal bases are listed above. You can complain to your national data protection authority (in the UK, the ICO).
• United States (including California): we don't sell or "share" personal information, and don't use it for targeted advertising or profiling. The categories we collect and why are listed above. You, or someone you authorise, can use the rights above by emailing us.
• Anywhere else: the same rights and the same contact apply. Where your local law gives you more, you get more.

Cookies

We use one cookie to keep you signed in and remember a few settings, such as the theme. No advertising or tracking cookies. Details in the Cookie Policy.

Children

Cluster is only for people 18 and over, and everyone confirms this when they sign up. We don't knowingly collect children's data; if we learn an account belongs to someone under 18, we delete it.

Contact and Grievance Officer

Email support@founderscluster.com for any privacy question, request or complaint. Our Grievance Officer reads it.

Cluster, Bengaluru, Karnataka, India.

We'll post changes here and tell you before important ones apply.