Privacy Policy

Fundgeek.eu (“Fundgeek”, “we”, “us”) is operated by FAMIGLIA EIGHT LTD, a company incorporated in the Republic of Cyprus. For any privacy matter you can contact us at privacy@fundgeek.eu.

This policy is issued under Regulation (EU) 2016/679 (“GDPR”) and the Cypriot Law 125(I)/2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data. The lead supervisory authority is the Office of the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy).

• Account data: email address, hashed password or OAuth identifier, display name.
• Billing data: subscription plan, transaction IDs, billing country and VAT status. Card numbers are processed by our payment provider (Paddle) — we never see or store them.
• Product data: saved funding calls, search queries, filter preferences, CSV exports you generate.
• Technical data: IP address, browser and device info, approximate location derived from IP, logs of API requests and errors.
• Communications: emails you send us and email delivery metadata (open, bounce, unsubscribe) for transactional messages.

• Providing the service (Art. 6(1)(b) GDPR — contract): authentication, saving calls, delivering paid features.
• Billing, tax and accounting (Art. 6(1)(c) — legal obligation): invoicing, VAT reporting, retention of accounting records under Cypriot Companies Law Cap. 113 and VAT Law 95(I)/2000.
• Service emails (Art. 6(1)(b)): welcome, receipts, subscription changes, security alerts.
• Security & fraud prevention (Art. 6(1)(f) — legitimate interests): log retention, rate limiting, webhook signature verification.
• Product improvement & aggregated analytics (Art. 6(1)(f)): understanding which calls are viewed. We do not build advertising profiles.

We use strictly necessary cookies for authentication and session state. We do not use advertising cookies. If we introduce optional analytics cookies we will request your consent first, as required by ePrivacy and Cypriot Law 112(I)/2004.

We only share personal data with vetted processors under a DPA:

• Supabase — database, authentication, storage (EU region).
• Cloudflare — hosting, CDN, DDoS protection.
• Paddle — Merchant of Record for payments, VAT collection and invoicing.
• Resend — transactional email delivery.

We do not sell personal data. Any transfer outside the EEA relies on the European Commission's Standard Contractual Clauses (SCCs) plus supplementary measures where required.

• Account data: while the account is active, plus 30 days after deletion.
• Billing and tax records: 7 years, as required by Cypriot tax and accounting law.
• Security logs: up to 12 months.
• Suppression list (unsubscribes): retained indefinitely to honour your choice.

You have the right to:

• Access, rectify or erase your personal data (Art. 15–17).
• Restrict or object to processing (Art. 18, 21).
• Data portability (Art. 20).
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with the Cypriot Commissioner for Personal Data Protection or your local EU supervisory authority.

To exercise any right, email privacy@fundgeek.eu. We respond within 30 days.

Data is encrypted in transit (TLS) and at rest. Access to production systems is limited and logged. We follow reasonable technical and organisational measures appropriate to the risk under Art. 32 GDPR.

Fundgeek is not directed at children under 16. We do not knowingly collect data from them.

We may update this policy. Material changes will be notified by email or an in-app banner at least 14 days before they take effect.