Who is responsible for your data
Philippe Nicolas, entrepreneur individuel (French sole trader), 1 rue de Madrid, 67310 Wasselonne, France, SIREN 938 048 071, trading as FoundByName. Write to nick@foundbyname.com about anything on this page. The business is run from France, so European data protection law applies to it, whichever country you are in. Our US address is a mail address only, and the full company details are on the legal notice.
What we collect
- Account data. Your email address and a password we store only as a salted hash. The sessions you open (a random token, the time, the IP address and browser that opened them) so we can end them and spot abuse.
- Billing data. Payments go through Stripe. We keep your Stripe customer and subscription identifiers, your plan and invoice status. We never see or store your card number.
- What you tell us about your business. The answers to the questionnaire, the services, hours and areas you give us, and the access you choose to grant to your Google Business Profile.
- Public business data. Business names, addresses, phone numbers, websites, ratings and review counts from public directories, and the answers AI assistants give to questions such as “best [your trade] in [your city]”. This is information about businesses, not about consumers.
- Requests and emails. When you ask for a report or write to us, we keep the request, your email address and our replies. Email opt-outs are kept so we respect them.
- Referrals. If you came to us through a client’s referral link, we note which client sent you, so we can give them their reward. The referral code is in the link itself, not in a cookie.
- Technical logs. Server logs with IP addresses and user agents, kept for security and debugging. The free checks store a one-way hash of your IP address, never the address itself.
Why we use it, and on what legal basis
- To deliver what you bought and to run your account: performance of our contract with you.
- To bill you and keep invoices: a legal obligation under French tax and accounting law.
- To email businesses about what AI assistants answer in their city: our legitimate interest in offering a service that concerns their trade. We use business addresses, we say where we found them, and you can object at any time, by clicking the unsubscribe link in any email or by replying and telling us to stop. We keep a written note of why we consider this balanced, and you can ask us for it.
- To run the referral program and reward the client who sent you: performance of our contract with that client, and our legitimate interest in thanking them.
- To keep the service secure and to stop abuse of the free checks: our legitimate interest in protecting it.
- To record what AI assistants answer about a city and a line of work, and to publish those measurements: our legitimate interest in measuring a public market. The answers are about businesses.
We do not sell or share personal information, we do not run advertising, and we do not profile anyone automatically in a way that has legal effects.
Who sees it
Service providers that process data on our instructions, each under a written contract. The full list, with a link to each one’s own terms, is on the subprocessors page:
- Stripe (payments), Vercel (hosting), Supabase (database), Google Workspace (our own email).
- OpenAI, Anthropic, Google and Perplexity: we send them the questions we ask about a city and a line of work, and, for your page, the business facts you asked us to publish. We never send them your account or billing data.
- Apify for reading public directories. Instantly for outbound email to businesses.
We may also disclose data when the law requires it. Pages we publish for you are public by design: that is the point of them. When we handle data on a client’s behalf rather than our own, the rules we follow are in our data processing agreement.
Where the data goes
Most of these providers are in the United States, so your data goes there. We rely on the European Commission’s adequacy decision for providers certified under the EU-US Data Privacy Framework, and on its standard contractual clauses for the others. Ask us and we will tell you which applies to which provider.
Google Business Profile data
If you connect your Google Business Profile, we read your listing (name, address, phone, hours, description, services, categories, rating and reviews) and write the updates you asked for. We use that data only to run the features you see in your account. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: we do not sell it, we do not use it for advertising, and no human reads it except with your permission, for support you asked for, or where the law requires it. You can disconnect the access at any time from your account or from your Google account settings, and we delete the tokens.
Cookies
One session cookie when you log in, so the app knows it is you. No advertising cookies and no third-party trackers. We count page views with Vercel Web Analytics, which sets no cookie and keeps no identifier that follows you across sites: we see how many people opened a page, from which country and on which kind of device, never who. When you open a report, we also note that it was opened that day, again without a cookie. A cookie that only keeps you logged in does not need a consent banner, which is why you do not see one here.
How long we keep it
- Account and billing data: while your account exists, then 30 days. Invoices for as long as tax law requires.
- Business contacts we emailed: three years after the last contact, or straight away if you ask.
- Technical logs: 90 days.
- Public business data and AI answers: as long as we publish measurements about that city.
Your rights
You can ask for a copy of your data, a correction, deletion, a limit on what we do with it, or a copy in a portable format. You can object to us emailing you, and to any use we base on our legitimate interest. Write to nick@foundbyname.com from the address on your account, or use the unsubscribe link in any email. We answer within 30 days, and usually much sooner.
If you think we handle your data badly, you can complain to the French data protection authority, the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris, or to the authority where you live.
Children
Our service is for businesses. We do not knowingly collect data from anyone under 18.
Changes
When this policy changes, the date at the top changes with it. For a change that matters to you, we email the address on your account.