Privacy Policy

Controller

We have not appointed a data protection officer, because neither threshold in Section 38 BDSG applies to us.

Reading the site

Reading founders.casa needs no account and sets no cookie. Our host records the usual server log data for every request: the IP address, the time, the page, the referrer, the browser and the operating system. We process it to keep the site available and secure, on the basis of Art. 6(1)(f) GDPR, and it is kept for as long as our host retains its logs.

If you claim a Profile

A Profile is a public page. What you put on it, your name, your Handle, your Place, your Founder type, your age if you choose to show it, and your Links, is visible to everyone and can be indexed by search engines. That is the service you sign up for, so publishing it rests on Art. 6(1)(b) GDPR.

Your birth date is a separate matter. We keep it to work out the age shown on your Profile and to record the age you declared when you claimed it. Below 18 no age is printed, so the date is held and not shown. Showing your age is optional and rests on your consent under Art. 6(1)(a) GDPR, which you withdraw by switching the field off; keeping the declaration rests on Art. 6(1)(f), our interest in being able to show that we asked.

Nothing else on a Profile is mandatory. A Profile without a Place simply appears on no Place page.

If you sign in

You claim a Profile through a Google Login. Google sends us your account e-mail address, your name and an account identifier, and Google remains its own controller for what happens on its side. We store a session so that you stay signed in, on the basis of Art. 6(1)(b) GDPR.

A session lasts seven days unless you sign out earlier. The short record that carries you through the sign-in round trip is discarded after ten minutes.

Cookies, and why there is no banner

founders.casa sets login cookies and nothing else. They appear only after you click to sign in, they are first-party, and they carry only what the sign-in needs. Section 25(2) No. 2 TDDDG exempts exactly that, so there is no consent to collect and therefore no cookie banner. A visitor who never signs in receives no cookie at all.

• better-auth.session_token, the session itself, seven days
• better-auth.state, set only during the sign-in round trip, five minutes

The price of that is a rule we keep: no third-party fonts, embeds, advertising or analytics scripts on the page.

If you pay

Stripe processes the payment when you become a Supporter or buy a Slot. Stripe receives what a payment needs, and we store the customer and subscription identifiers it returns, on the basis of Art. 6(1)(b) GDPR.

The invoice records that German tax law obliges us to keep are held for eight years under Art. 6(1)(c) GDPR, in accordance with Section 147 AO and Section 14b UStG. They stand apart from your Profile, so deleting the Profile does not touch them and they do not keep it alive.

Who else receives data

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, hosts the site. Our functions run in Frankfurt, but Vercel is a US company, so data reaches the United States. Its data processing addendum covers that transfer through the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback.

Neon, operated by Databricks, Inc., stores the database in Frankfurt. The same transfer mechanisms apply: Neon, LLC is named in the Databricks Data Privacy Framework certification, and the Databricks addendum carries the standard contractual clauses.

Automattic Inc. serves the photo on a Profile through Gravatar, identified by a hash of the Founder's e-mail address. Without a Gravatar a Profile shows initials, and we store no image of anyone. The transfer to the United States rests on the standard contractual clauses in Automattic's own terms.

Beyond that, the recipients are the public and any search engine, because a Profile is a public page.

How long we keep it

A Profile stays until you delete it. Deleting it removes the Profile, the Login behind it and the sessions belonging to it. Because the Profile was public, we also serve a gone response for its address and take it out of our sitemap so search engines drop it.

Decisions

Nothing here is decided automatically. There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.

Your rights

• Access to the data we hold about you (Art. 15 GDPR)
• Correction of it (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of your consent to show your age, at any time, by switching the field off (Art. 7(3) GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR)

Write to [email protected] to exercise any of them.

Supervisory authority

Point of contact under the Digital Services Act

The single point of contact for authorities (Art. 11 DSA) and for users (Art. 12 DSA) is [email protected]. It is read in English and in German.

Zentrale Kontaktstelle für Behörden (Art. 11 DSA) und für Nutzerinnen und Nutzer (Art. 12 DSA) ist [email protected]. Sie kann in deutscher und in englischer Sprache angeschrieben werden.

Last updated

17 September 2026.