Privacy policy.

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2.1 Account data

When you register for FoundersDeck, we collect:

• Email address (for login and notifications)
• Password (stored as an irreversible hash using Argon2)
• Optionally, a free-text answer to "How did you find us?" if you choose to provide one. This field is voluntary, can be left empty, and is used solely to help us understand which channels bring new users to FoundersDeck. Legal basis: Art. 6(1)(a) GDPR — consent. You can request deletion of this field at any time via info@foundersdeck.dev.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract (for email and password).

2.2 Monitoring data

When you create monitors, we process:

• URLs you configure for monitoring
• HTTP response status codes and response times
• Error messages and incident details
• Timestamps of all checks

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.3 Payment data

Payment processing is handled entirely by Polar.sh (USA) as our Merchant of Record. FoundersDeck never receives, processes, or stores credit card numbers, bank account details, or other payment credentials. Polar.sh sells our paid plans as authorised reseller and is the seller in the purchase transaction; for the checkout and payment data it processes the data under its own privacy policy. To start the checkout we pass your email address and an internal customer ID to Polar.sh; Polar.sh provides us only with your subscription status and customer ID. We use Polar.sh as an interim solution because no comparable EU-based Merchant of Record meets our technical requirements today. We will switch to an EU alternative as soon as one becomes available.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.4 Server logs

Our web server automatically collects standard access logs including IP addresses, request timestamps, HTTP methods, and user agent strings. These logs are retained for a maximum of 7 days for security and debugging purposes, then automatically deleted.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in security and service stability.

2.5 Cookies

We set only technically necessary cookies: a session cookie (auth_session) that keeps you logged in, and a language cookie (lang, one year) that remembers your language choice. We do not use analytics, advertising or tracking cookies; no consent banner is required for these cookies.

Legal basis: Section 25(2) no. 2 TDDDG; Art. 6(1)(b) and (f) GDPR.

2.6 Status page subscribers

Visitors can subscribe on a customer’s public status page to receive incident and maintenance updates by email. For this we process the email address, the language, the selected monitors, the time of the opt-in and the confirmation and management tokens. Subscriptions only become active after a confirmation link in a double opt-in email (consent, Art. 6(1)(a) GDPR). Unconfirmed subscriptions are deleted automatically once the confirmation link has expired. You can unsubscribe at any time via the link in every email; the address is then removed. Addresses that cause a hard bounce are marked and no longer used.

The operator of the status page you subscribe to is the controller for this processing; FoundersDeck processes the data on their behalf as processor under the Data Processing Agreement. Emails are sent via Scaleway SAS (France). Automatically detected incidents are never sent to subscribers.

• We do not use cookies for analytics or tracking
• We do not use any third-party analytics tools (no Google Analytics, no Mixpanel, no Plausible)
• We do not track user behavior across pages
• We do not collect or process data of your end users visiting your public status pages — apart from the short-lived server logs described in section 2.4 (deleted after 7 days)
• We do not sell, share, or otherwise monetize your data

All application data is stored and processed exclusively on servers operated by Netcup GmbH in Nuremberg, Germany. Monitoring data, status pages and account data never leave the European Union. The only exception is payment processing: Polar Software, Inc. (USA), our Merchant of Record, receives only your billing email, subscription status, plan and customer ID. This transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) agreed with Polar. We do not use any US-based cloud providers (no AWS, no Google Cloud, no Azure).

For a complete list of our sub-processors, see our Trust & Transparency page. Business customers can review the formal Data Processing Agreement, which is automatically entered into when you accept our Terms of Service.

Monitoring data (checks, incidents) is retained according to your plan:

• Free: 30 days
• Starter: 90 days
• Pro: 180 days
• Scale: 365 days

After the retention period, check data is automatically and permanently deleted. Account data is retained for the duration of your account and deleted within 30 days of account deletion.

We send transactional emails via Scaleway Transactional Email (Scaleway SAS, Paris, France) for the following purposes:

• Alert notifications (when your monitors detect incidents)
• Email address verification and password reset emails (when you request one)
• Incident and maintenance updates to status page subscribers (see section 2.6)
• Critical account notifications (security-related)

We do not send marketing emails, newsletters, or promotional content unless you explicitly opt in.

DiGA benchmark: report requests and consent

Through the form on /de/diga-benchmark we process company, DiGA name, business email address and your optional message to answer your request (Art. 6(1)(b) GDPR). We also store whether the email domain matches a URL of that DiGA listed in the BfArM directory; this only serves to send individual reports to manufacturers exclusively.

Optionally you can give two separate consents: information about future editions of the DiGA benchmark (about 1–2 emails per year) and information about FoundersDeck offers for healthcare providers (at most 4 emails per year). The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) UWG). It only takes effect once you click the link in our confirmation email (double opt-in, valid for 7 days). We store the time and wording of each consent as proof.

Retention: requests without a confirmed consent are deleted 12 months after receipt. Confirmed consents are kept until you withdraw them; we keep proof of the withdrawal for 12 months and then delete the request. You can withdraw each consent separately at any time, via the link in every email or informally at info@foundersdeck.dev.

If you configure Slack, Discord, or webhook alert channels, FoundersDeck sends incident notifications to the endpoints you specify. These notifications contain only your monitor name, status (up/down), timestamp, and error type. You are responsible for the data processing that occurs at your chosen endpoints.

Public status pages display aggregated, non-personal monitoring data (uptime percentages, incident history). Status pages are served with:

• Zero cookies
• Zero tracking scripts
• Zero third-party requests

Visitors of your status page are not tracked, fingerprinted, or profiled in any way.

You have the following rights regarding your personal data:

• Access (Art. 15) — Request a copy of all personal data we hold about you
• Rectification (Art. 16) — Correct inaccurate data via your account settings
• Erasure (Art. 17) — Have your account and all associated data deleted
• Restriction (Art. 18) — Restrict processing of your data
• Portability (Art. 20) — Receive your data in a structured, machine-readable format (JSON/CSV)
• Objection (Art. 21) — Object to processing based on legitimate interests (Art. 6(1)(f))
• Withdrawal of consent (Art. 7(3)) — Withdraw any consent you have given at any time, with effect for the future

To exercise any of these rights — including deleting your account or receiving a copy of your data — please email info@foundersdeck.dev from the email address registered with your account. We handle requests within 30 days, usually much faster, and free of charge. On the Pro and Scale plans, you can also export the check and incident data of individual monitors as CSV yourself at any time. Billing records held by Polar as Merchant of Record are subject to statutory tax retention periods and are kept by Polar.

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for FoundersDeck is:

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify registered users by email.

For privacy-related questions or to exercise your rights:

Email: info@foundersdeck.dev