Privacy Policy

1. Introduction

This Privacy Policy explains how FoundIQ Ltd ("FoundIQ", "we", "us", or "our") collects, uses, stores, and protects personal information when you visit our website, create an account, or use the FoundIQ scouting intelligence platform (the "Service").

We are committed to handling personal data responsibly and in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy should be read together with our Terms and Conditions. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

FoundIQ Ltd is the data controller responsible for your personal information in connection with the Service.

Contact details: cameron@foundiq.io · FoundIQ Ltd, United Kingdom.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us using the details above.

3. Information We Collect

We may collect the following categories of personal information:

• Identity and contact data: name, email address, organisation name, job role, and billing contact details.
• Account and authentication data: login credentials, account preferences, subscription tier, and team membership information.
• Usage data: pages viewed, features used, search queries, watchlist activity, report generation, timestamps, and interaction logs.
• Technical data: IP address, browser type, device identifiers, operating system, and diagnostic logs.
• Payment data: billing status and transaction references processed by Stripe. We do not store full payment card numbers on our servers.
• Communications data: support requests, emails, feedback, and messages you send to us.
• Integration data: credentials or configuration details you provide to connect third-party services, where applicable.

4. How We Collect Information

We collect information directly from you when you register for an account, subscribe to a plan, submit searches, configure integrations, contact support, or otherwise interact with the Service.

We collect information automatically through cookies, log files, and similar technologies when you use our website or platform.

We may receive information from third parties such as payment processors, authentication providers, analytics services, and integrated data partners where you have authorised such connections.

5. How We Use Your Information

We use personal information to:

• Provide, operate, maintain, and improve the Service.
• Create and manage your account, authenticate users, and administer team access.
• Process subscriptions, invoices, and payments.
• Generate personalised intelligence outputs, digests, and platform recommendations.
• Send service-related communications, including account notices, security alerts, and daily digest emails where enabled.
• Monitor usage, troubleshoot issues, prevent fraud, and protect the security of the Service.
• Comply with legal obligations and enforce our Terms and Conditions.
• Analyse aggregated or anonymised usage trends to improve product performance and features.

6. Legal Basis for Processing

Under UK GDPR, we rely on one or more of the following legal bases depending on the processing activity:

• Contract: processing necessary to provide the Service you have requested or to take steps at your request before entering into a contract.
• Legitimate interests: operating, securing, and improving the Service, preventing abuse, and communicating with account holders, provided those interests are not overridden by your rights.
• Consent: where required for optional marketing communications or non-essential cookies.
• Legal obligation: where processing is necessary to comply with applicable law, regulation, court order, or regulatory request.

7. AI and Automated Processing

FoundIQ uses artificial intelligence, including large language models and automated scoring systems, to analyse football data and generate scouting intelligence outputs such as player briefings, risk flags, search results, and IQ scores.

These systems process Customer Data and Third-Party Data to produce informational outputs. Automated processing does not produce legal or similarly significant effects on individuals in the employment or contracting sense, but outputs may influence professional scouting decisions made by users.

AI outputs may be inaccurate or incomplete. Users should apply independent professional judgment before relying on any automated recommendation.

We do not use your confidential account content to train public third-party foundation models unless you have expressly agreed otherwise in writing.

8. Third-Party Service Providers

We use trusted third-party providers to help deliver the Service. These providers process personal data only on our instructions and subject to appropriate contractual and security obligations:

• Supabase — authentication, database hosting, and account infrastructure.
• Stripe — payment processing and subscription billing.
• Anthropic — AI model processing for search and intelligence features.
• Resend — transactional and digest email delivery.
• Vercel or similar hosting providers — application hosting and content delivery.
• Analytics, monitoring, and security vendors — performance, error tracking, and abuse prevention.

9. Data Retention

We retain personal information for as long as necessary to provide the Service, fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

Account information is generally retained for the duration of your subscription and for a reasonable period thereafter to support reactivation, billing records, and legal compliance.

Usage logs and diagnostic data may be retained for a shorter period unless needed for security investigations or legal purposes.

When data is no longer required, we delete or anonymise it using appropriate technical and organisational measures.

10. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

To exercise these rights, contact us at cameron@foundiq.io. We may need to verify your identity before responding and will reply within the timeframe required by applicable law.

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of personal data in certain circumstances.
• Restriction — request that we limit processing in specific situations.
• Portability — request transfer of certain data to another provider where technically feasible.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

11. International Data Transfers

Some of our service providers may process personal data outside the United Kingdom. Where this occurs, we implement appropriate safeguards designed to protect your information in accordance with applicable data protection law.

Such safeguards may include Standard Contractual Clauses, adequacy regulations, or equivalent transfer mechanisms approved under UK GDPR.

You may contact us for more information about the safeguards applied to international transfers relevant to your account.

12. Security

We implement administrative, technical, and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, or destruction.

These measures include access controls, encrypted connections, secure authentication, environment isolation, and restricted internal access on a need-to-know basis.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

13. Cookies and Similar Technologies

We use cookies and similar technologies to operate the website, maintain sessions, remember preferences, and understand how users interact with the Service.

Essential cookies are required for core functionality such as authentication and security. Optional analytics or preference cookies, where used, will be managed in accordance with applicable consent requirements.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

14. Contact and Policy Updates

If you wish to exercise your privacy rights or have questions about this Privacy Policy, contact us at cameron@foundiq.io.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom if you believe our processing of personal data violates applicable law.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. We encourage you to review this Privacy Policy periodically.