Privacy
What we store, why, and what we will never do with it — in the same plain English as our terms, with a line under each section saying what it means for you.
Version 1 — 31 July 2026. Changes are announced 30 days before they take effect, alongside the terms.
1. What we store about you
Your account: an email address, a password if you set one (stored only as a hash), or the fact that you sign in with Google — we receive your email from Google, not your Google password. Then the working material: the briefs and answers you give your employee, the reports and receipts it writes, the documents, pages and code it produces for your company, and any corrections you make along the way.
What this means: we store what is needed to sign you in and to do the job you hired the employee for. There is no shadow profile beyond the work itself.
2. Your connected accounts
If you connect Stripe, we store the identifier of your Stripe account and read its numbers to show them to you and, on the managed plan, to compute our fee. Stripe verifies your identity directly: your documents, bank details and risk review go to Stripe, and we never collect, see or store any of it.
What this means: the most sensitive material in this relationship — your identity papers and your bank account — never touches our servers at all.
3. Leads your company collects
When a visitor submits a contact or waitlist form on your company's site, we store what they typed — an email address and a message — plus hashed, non-reversible fingerprints of their browser and network used only for rate limiting and duplicate detection. That data belongs to your company and is yours to export or delete. You are responsible to your visitors for how it is used: it is your site and your customer relationship, and we process it only on your behalf.
What this means: your leads are yours, we keep no more of a visitor's identity than the form itself, and how you treat the people who wrote to you is on you, not us.
4. Founder research — only when you ask
If you press "Build one for me", the employee reads up on you before proposing a business — public web searches only. We store the derivation, not just the conclusion: the queries it ran, the pages it relied on, and its confidence — and it shows you its sources so you can check them. Anything touching a sensitive category is dropped rather than stored. One click deletes the profile and permanently opts your account out of ever being researched again; we keep only the marker recording that you opted out. This never happens unless you press that button.
What this means: it only looks you up when you ask it to, it shows its work, and "stop" is one click and forever.
5. No training, no selling
We do not train AI models on your business, your briefs, your results or your customers, and we do not permit the model providers who run the shifts to do so. We do not sell or rent anyone's data — yours or your visitors' — to anyone, and we do not share it with advertisers or data brokers.
What this means: your business is the customer, not the product. Nobody else is paying us for it.
6. Analytics we run ourselves
Two things measure this site. Our own analytics are self-hosted, in our own database: which pages are visited and which steps of signup and checkout are reached, tied to a session identifier, the page path and an IP address, with known crawlers filtered out. Alongside it we use Clicky, an analytics company, for visitor counts and page views — its script is served from our own domain rather than theirs, so the request never leaves our origin, but the page view, the referrer and your IP address do reach Clicky. There are no advertising pixels and no ad-network trackers on this site, and nothing here follows you to other sites.
What this means: measuring whether our own pages work does not require telling an ad network you were here, so we do not.
7. Cookies
We set the cookies the product needs to function — keeping you signed in, remembering your session, protecting forms from forgery. No advertising or cross-site tracking cookies, because nothing on the site does advertising or cross-site tracking.
What this means: the cookies are plumbing, not surveillance.
8. Email from us
Today we send the email the product requires: verification, password resets, receipts for payments, and your company's own reports and notices. If we ever send anything beyond that, it will carry a working unsubscribe that we honour, and saying no to it will never affect the emails the product needs to send you.
What this means: your inbox gets what you signed up for. Anything optional stays optional.
9. Who else touches the data
The providers needed to run the service: the servers that host it, Stripe for payments, and the AI model providers that perform the shifts — each under terms that restrict them to running our service and forbid using your content to train their models. We disclose data beyond that only when the law validly requires it, and where we are allowed to, we tell you it happened.
What this means: a short, boring list of subprocessors doing their jobs — not an ecosystem of "partners".
10. Deleting your account
Deleting your account removes the account, your companies, their sites, their reports, their receipts and their leads. It is immediate and cannot be undone, so export anything you want to keep first — export is always available while the account exists. What survives deletion: records the law requires us to keep, such as invoices, and the marker that says you opted out of founder research, if you did.
What this means: delete means delete, with the two narrow exceptions named out loud instead of hidden in a definitions section.
11. Your rights
You can see what we hold about you, export it, correct it, delete it, and object to a use of it — and we honour those rights for everyone, not only where a statute forces us to. We do not claim certifications we have not earned; we claim the practices on this page, and you can hold us to them. To exercise any of this, write to us.
What this means: the rights European law made famous, applied to every account, without an audit badge pretending to be the point. Contact us →