Privacy Policy

This policy explains how Founded Labs Pty Ltd ("Founded", "we", "us") handles personal information. It covers our website, the Founded platform, the identity checks we run, and the messages we send for the businesses that use us.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you have a question, or want to see or correct what we hold about you, email privacy@foundedai.com.au.

1. Who this policy is about

We handle personal information about these groups of people:

• Customers and their users. People who sign up for Founded, or who are invited to use Founded by a business.
• People our customers contact. People a business reaches through Founded, for example by email, landing page, social media or phone.
• Business contacts we research. People whose work details we find in public sources and business directories, so that businesses can reach other businesses.
• People who verify their identity. People asked to confirm who they are, or to confirm the details of an organisation they act for, through a Founded identity check.
• Visitors. People who visit our website or contact us.

2. Our role, and the role of the businesses we work for

Our customers are businesses. They use Founded to run their own marketing, and they decide which contacts they upload, what they send and what they collect through their own landing pages and campaigns. We handle that information for them, under our agreement with them. Their own privacy policy also applies, and you can contact them directly.

We make our own decisions about personal information, and this policy applies in full, when we:

• run our website, customer accounts, billing and support;
• research business contacts and keep our own contact records (section 3);
• combine the contacts a customer activates with our own records, so we keep one accurate, de-duplicated record per person;
• run identity checks and keep verified identity records (section 6); and
• use automated tools, including AI, as described in section 7.

3. What we collect

Customers and their users

• Your name, email address, phone number and job title.
• Sign-in and security details. Your password is held by our authentication provider, not by us.
• Your business's name, ABN or ACN, address, plan and billing details. If you pay by card, our payment provider handles your card details; we do not store full card numbers.
• What you create or upload, such as brand assets, content, campaigns, contact lists and settings.
• How you use the platform, such as features used, device and browser details, IP address and logs.
• Accounts you connect, such as Facebook, Instagram, LinkedIn or Google Business Profile, including the page details and access permissions those services give us.
• Messages you send us.

People our customers contact

• Your name, email address, phone number, job title, employer and address, as provided by the business or collected through its campaigns.
• How you respond to messages and pages, such as whether an email was delivered or opened, which links you clicked, forms you submitted, your replies and any unsubscribe.
• What you tell a business through its landing pages, forms or messages.
• If a business uses our voice features, recordings and transcripts of calls. You will be told at the start of a call if it is recorded.

Business contacts we research

• Your name, job title, employer and role.
• Your work email address, work phone number and business address.
• Professional details published by you or your employer, such as on your employer's website.
• Information about your employer, such as its industry, size and location.

We collect this from public sources, such as company websites, search results, business directories and public registers (for example ASIC and the Australian Business Register), and from data providers that license business contact data. We use it to find people who may be interested, in their working role, in our customers' products and services. We do not use our research to send marketing to people in their personal capacity.

People who verify their identity

• Your name, date of birth, address, nationality and contact details.
• Images of your identity document and the details on it, such as its number and expiry date.
• Images and video of your face, and the biometric information taken from them, used to compare your face with your document and to check that you are a real person taking part at the time (a "liveness" check).
• Results of checks against official and other sources, such as the Australian Government's Document Verification Service, company registers, and sanctions, politically exposed persons and adverse media lists.
• For organisation checks, details of the organisation and of its directors, shareholders and beneficial owners.
• Device and network details used to detect fraud, and a record of what you agreed to.

Biometric information, and some screening results, are sensitive information under the Privacy Act. We collect them only with your consent, which we ask for on the identity check page before the check starts.

Visitors

• What you send us, and technical details such as your IP address, browser and the pages you visit.

4. How we collect it

• From you, when you sign up, fill in a form, take an identity check, reply to a message or contact us.
• From a business, when a business you deal with uploads your details, invites you to Founded, or asks you to verify your identity.
• From public sources and data providers, as described in section 3.
• From identity verification providers and official sources, during an identity check.
• From services you connect, such as social media platforms.
• Automatically, through cookies, logs and similar technologies, including pixels in emails that tell the sender whether an email was opened.

If we receive personal information we did not ask for and could not have collected ourselves, we destroy or de-identify it.

5. Why we use it

• To provide, secure and improve the platform, and to support our customers.
• To run our customers' campaigns: sending messages, publishing content and landing pages, and recording how people respond.
• To find business contacts who may be interested in a customer's products and services, and to contact them, in their working role, on the customer's behalf.
• To run identity and organisation checks, keep verified identity records, and let you reuse your verified identity with other businesses if you choose.
• To check that email addresses and phone numbers are valid, and to keep suppression lists so that people who opt out are not contacted again.
• To bill customers and keep business records.
• To detect and prevent fraud, abuse and security incidents.
• To meet our legal obligations and respond to lawful requests.
• To tell our customers about Founded's own products. Customers can opt out of these messages at any time.

We use personal information for the purpose we collected it for, or for a related purpose you would reasonably expect (for sensitive information, a directly related purpose). Otherwise we use it only with your consent or where the law allows.

6. Identity checks and your verified identity

When a business asks you to verify your identity, Founded runs the check for that business. The check page names Founded as the identity provider, and names the verification provider that captures your images and checks your document.

• What the business receives. The business receives the result of the check and the details listed on the check page, such as your name and date of birth. It never receives the images of your face or your document.
• Reusing your verified identity. We keep a record that you have been verified. If another business later asks you to verify, you may not need to take the full check again. We share your verified details with a business only when you agree on that business's check page, and we may ask you to take a fresh face check first.
• Keeping a face reference. We keep an image or template of your face for later re-checks only if you agree to that separately. You can withdraw that agreement at any time.
• Images. Our verification provider deletes the images of your face and your document within 30 days of the decision. If the law requires a business to keep them for longer, the check page tells you.
• Seeing who holds your details. You can ask us which businesses have received your verified details.
• Age. Identity checks are only for people aged 18 or over.

7. Automated decisions and AI

Founded uses computer programs, including artificial intelligence (AI), to make decisions or to help people make them. The Privacy Act requires us to tell you when a computer program makes, or substantially and directly helps to make, a decision that could significantly affect your rights or interests. This section sets out the kinds of decisions our programs make or help make, and the kinds of personal information they use.

Identity checks

• The decision: whether your identity, or an organisation's details, are verified, declined, or referred to a person for review. A business may rely on this result when deciding whether to deal with you, for example whether to rent you a property or open an account for you.
• Information used: your document images and details, face images and biometric comparisons, liveness results, results from official sources and screening lists, and device and network details.
• Review by a person: if a check is declined automatically, you can ask for a person to review it. The result page tells you how, or you can email privacy@foundedai.com.au.

Finding and contacting business contacts

• The decision: which business contacts suit a customer's campaign, whether and when to contact them, and when someone has shown enough interest for their contact details to be shared with that customer.
• Information used: work contact details, job title, employer, information about the employer, and how the person has responded to earlier messages.

Checking contact details

• The decision: whether an email address or phone number is valid and safe to contact. An address or number that fails is not contacted.
• Information used: the address or number, delivery results, and suppression lists.

Writing and personalising content

• What happens: customers use AI to draft emails, social media posts, landing pages and other content. A message may be personalised with your name, job title, employer and similar details.
• Human approval: we do not send or publish content for a customer unless a person at that business has approved it, or has approved the plan it belongs to.

Preventing fraud and abuse

• The decision: whether activity looks fraudulent or abusive. This can mean an account, a message or an identity check is blocked or held for review.
• Information used: account activity, device and network details, and logs.

AI providers

Some of these programs use AI models run by other companies, such as large language model providers. We send them only the information a task needs, and we choose providers whose terms do not allow them to train their models on the information we send. We do not use identity documents, face images or other biometric information to train AI models.

Asking for a review

You can ask how any of the decisions in this section was made, or ask for a person to review a decision about you, by emailing privacy@foundedai.com.au.

8. Who we share it with

• Customers. A business receives:
  • the results of identity checks it asked for, and the details you agreed to share;
  • what you tell it through its campaigns, forms and landing pages; and
  • your contact details from our records, when you respond to its messages in a way that shows you want to hear more (for example by asking to be contacted or subscribing), or when it is given access to them under its agreement with us.
• Service providers who help us run Founded, such as providers of cloud hosting and storage, content delivery and security, sign-in, email and messaging delivery, identity verification, AI models, analytics, customer support and payments. They may use the information only to provide their services to us.
• Official and other sources used in identity checks, such as the Document Verification Service, company registers and screening list providers.
• Services you connect. When you connect a social media or business account, we send it the content you ask us to publish.
• Our professional advisers and insurers, such as lawyers and auditors.
• Regulators, courts and law enforcement, where the law requires or allows it.
• A buyer or successor, if all or part of our business is sold or restructured, under obligations of confidentiality.

9. Overseas disclosure

Some of our service providers store or access personal information outside Australia. The countries most likely to be involved are the United States and member states of the European Union. Some providers also use their own subcontractors in other countries.

Before we disclose personal information overseas, we take reasonable steps, including contract terms, to make sure the recipient handles it consistently with the APPs.

10. Messages we send for businesses

• Every marketing message sent through Founded identifies the business it is from and includes a way to unsubscribe. We act on an unsubscribe within five business days.
• Unsubscribing from one business's messages stops messages from that business. Other businesses that contact you through Founded are separate, and you can unsubscribe from each of them.
• We contact researched business contacts only at their work addresses, about matters relevant to their working role, and not where a published address says it does not want marketing messages.
• Some messages are sent from domains we provide for a business, such as "with" followed by the business's name. The message still identifies the business it comes from.
• We do not make marketing calls to numbers on the Do Not Call Register unless the law allows it.

11. Cookies and analytics

• This website does not use advertising or tracking cookies.
• The Founded platform uses cookies that are needed for signing in and keeping accounts secure, and analytics that show us how features are used.
• Landing pages and emails that our customers publish through Founded may use cookies, pixels and similar technologies to measure responses. That business's privacy policy explains how it uses them.
• You can block cookies in your browser, but some features may then stop working.

12. How we protect it

We protect personal information with measures such as encryption in transit and at rest, access limited to the people and systems that need it, and logs of access to sensitive information. Identity check information is kept separately, under stricter controls. We assess our service providers' security before we use them.

If a data breach is likely to cause serious harm to the people it affects, we will notify them and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

13. How long we keep it

• Accounts and billing: while the account is open, then for as long as the law requires (for example, up to seven years for financial records).
• Customer content and contacts: while the customer uses Founded, then deleted after the account closes, as set out in our Terms of Service, unless the law requires us to keep it.
• Researched business contacts: until the details are no longer accurate or needed, or until you ask us to delete them.
• Identity check images: deleted by our verification provider within 30 days of the decision (section 6).
• Verified identity records: while they are needed to let you reuse your verified identity and to meet our legal obligations. After that we delete or de-identify them.
• Suppression lists: the minimum needed (such as an email address) for as long as needed to make sure an opt-out keeps working.

14. Access, correction and deletion

• You can ask for access to the personal information we hold about you, and ask us to correct it.
• You can ask us to delete researched contact details and stop contacting you. If you do, we keep only what we need to make sure you are not contacted again.
• We will check your identity before we act on a request, and respond within 30 days.
• Making a request is free. If giving you access would involve significant cost, we will tell you the charge before we go ahead.
• If we refuse a request, we will explain why in writing and tell you how to complain.
• If we hold the information for a business, we may refer your request to that business and help it respond.

15. Using Founded without identifying yourself

You can visit our website without telling us who you are. You cannot use the Founded platform or complete an identity check anonymously, because we need to know who you are to provide them.

16. Complaints

If you have a concern about how we have handled your personal information, email privacy@foundedai.com.au. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

17. Children

Founded is for businesses and is not directed at children. Identity checks are only for people aged 18 or over. If we learn that we hold a child's personal information that we should not have, we delete it.

18. Changes to this policy

When we change this policy, we publish the new version here with the date it takes effect. Earlier versions stay available in the version history below. If a change significantly affects how we handle your personal information, we will tell our customers by email before it takes effect.

19. Contact us

Founded Labs Pty Ltd

Privacy: privacy@foundedai.com.au