Privacy Policy

1 Who We Are (Data Controller)

Onfound Inc. is the data controller responsible for your personal data.

Entity: Onfound Inc.
Registered address: 1111B S Governors Ave STE 29782, Dover, DE 19904, United States
Email: support@onfound.com
Website: https://onfound.com

Under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), we are the “data controller.” Under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA), we are the “responsible party.” Under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA), we are the “data controller.”

2 What This Policy Covers

This Privacy Policy applies to personal data collected through:

• Our website at onfound.com
• The Onfound mobile application (iOS and Android)
• The member dashboard
• Any Onfound-organised meetups, events, or activities
• Email, WhatsApp, and other communications with us

It does not apply to third-party websites, apps, or services linked from Onfound (such as Stripe, WhatsApp, or partner venues). Those services have their own privacy policies, which we encourage you to review.

3 Personal Data We Collect

3.1 Data You Provide Directly

When you register, complete onboarding, use the platform, or contact us, we may collect:

3.2 Data We Collect Automatically

When you use the website or app, we automatically collect:

3.3 Data from Third Parties

We may receive limited data from third parties, including:

• Stripe: payment confirmation status, subscription status, and billing events (not full card details).
• Meta (Facebook/Instagram): conversion data and ad interaction data used to measure campaign performance and serve relevant ads.
• App stores (Apple App Store, Google Play): download and installation data, crash reports.

We do not purchase personal data from data brokers or third-party marketing databases.

4 How We Use Your Personal Data

We use your personal data for the following purposes:

5 Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website and app to improve your experience and analyse how the Services are used.

5.1 Types of Cookies We Use

5.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling strictly necessary cookies may affect the functionality of the Services.

For advertising cookies, you can manage your preferences through Meta Ad Preferences. You can also opt out of interest-based advertising from participating companies at aboutads.info.

5.3 Mobile App Tracking (iOS App Tracking Transparency and Android)

Our mobile app uses tracking technologies, including the Meta Pixel and Meta Conversions API, to measure conversions and serve relevant ads on third-party platforms.

iOS (App Tracking Transparency): When you first open the Onfound app on an iPhone or iPad, Apple will show you an App Tracking Transparency (ATT) prompt asking whether you allow Onfound to track your activity across other companies’ apps and websites.

• If you allow tracking, we and our advertising partner (Meta) may access your device’s Identifier for Advertisers (IDFA) and use it to measure the performance of ads you have seen and to serve you more relevant ads.
• If you ask the app not to track, we will not access the IDFA and will not share device-level identifiers with our advertising partner. We will still measure conversions using aggregated, privacy-preserving methods (such as Apple’s SKAdNetwork and aggregated event measurement), which do not identify you individually.
• You can change your choice at any time in iOS Settings › Privacy & Security › Tracking, or in Settings › Onfound.

Android: On Android devices, conversion and ad measurement is performed using the Google Advertising ID (GAID) by our advertising partner (Meta). You can reset your GAID or opt out of personalised ads at any time in Settings › Google › Ads.

Declining tracking does not affect your ability to use the Onfound app or any of its core features.

6 Who We Share Your Data With

We do not sell your personal data to anyone. We share your data only in the following circumstances:

6.1 Service Providers

We use trusted third-party service providers to operate and improve the Services. These providers process data on our behalf and are contractually required to protect your data:

6.2 Other Members

Onfound is a member directory. When your profile is approved, the profile content you have chosen to publish (your first name, last name, profile photo, city, what you’re working on, your biggest challenge, your biggest win, business name and website, and any social links you have added) is visible to other approved Onfound members.

If you send a direct message or post in a group chat, the contents of those messages are visible to the other people in the conversation. If you RSVP to a city event, your first name, last name, and profile photo are visible on the event’s attendee list to other approved members.

Your email address, phone number, date of birth, and gender are not displayed in the directory or to other members. Other members can message you within the Onfound app, but cannot see your email or phone number unless you choose to share them in a message.

You can request that your profile be hidden from the directory by contacting us, though this may limit your ability to participate in the community.

6.3 Legal and Safety Disclosures

We may disclose your personal data if we are required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, or regulatory request.
• Protect the rights, safety, or property of Onfound, our members, or the public.
• Investigate or prevent fraud, security incidents, or violations of our Terms.
• Respond to an emergency involving potential harm to any person.

6.4 Business Transfers

If Onfound is involved in a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and ensure the receiving party is bound by obligations consistent with this Privacy Policy.

7 International Data Transfers

Onfound is based in the United States. If you are located in the United Kingdom, European Economic Area, South Africa, or any other jurisdiction with data protection laws that restrict international data transfers, your personal data will be transferred to and processed in the United States and potentially other countries where our service providers operate.

We ensure that international transfers of personal data are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission and recognised by the UK Information Commissioner’s Office (ICO), incorporated into our agreements with service providers.
• Adequacy decisions, where the European Commission or UK government has determined that a country provides an adequate level of data protection.
• Other lawful transfer mechanisms as recognised under applicable law.

8 Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.

After the applicable retention period, we will securely delete or anonymise your personal data so that it can no longer be associated with you.

9 Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit using TLS/SSL and encryption at rest for stored data.
• Secure authentication mechanisms, including hashed and salted passwords.
• Access controls limiting who within Onfound can access personal data, on a need-to-know basis.
• Regular security reviews and monitoring of our infrastructure.
• PCI-DSS compliant payment processing through Stripe (Onfound never stores full card details).
• Incident response procedures to detect, investigate, and respond to data breaches.

While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the highest practicable standard.

10 Your Rights

Depending on where you are located, you have certain rights regarding your personal data. We are committed to helping you exercise these rights.

How to Exercise Your Rights

To exercise any of these rights, please contact us at support@onfound.com with the subject line “Data Rights Request.” We may ask you to verify your identity before processing your request.

We will respond to your request within:

• 30 days for requests under UK GDPR / EU GDPR (extendable by a further 60 days for complex requests, with notice).
• A reasonable period for requests under POPIA (generally within 30 days).

We will not charge a fee for most requests. However, we may charge a reasonable administrative fee if your request is manifestly unfounded, excessive, or repetitive, or we may refuse to act on the request in such cases.

11 Children’s Privacy

Onfound is not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@onfound.com and we will take steps to delete that information promptly.

12 Marketing and Communications

12.1 Marketing Consent

We will only send you marketing communications (such as newsletters, promotional offers, and community content) where you have given us your explicit consent or where we are permitted to do so under applicable law.

12.2 Opting Out

You can opt out of marketing communications at any time by:

• Clicking the “Unsubscribe” link in any marketing email.
• Updating your communication preferences in your account dashboard.
• Contacting us at support@onfound.com.

Opting out of marketing does not affect transactional communications necessary for the operation of your account (such as billing receipts, message and event notifications, and service updates).

13 Automated Decision-Making and Profiling

Onfound uses an automated suggestion engine (“Why Connects”) to surface members from the directory who may be relevant to you, based on factors such as city, what you’re working on, interests, and goals.

Onfound also offers an optional AI-powered member search (“Frontier Intelligence”). When you use it, your search request and the community profile information of potentially relevant members are processed by the AI providers listed in Section 6.1 to identify and briefly explain relevant suggestions. Suggestions are informational only, you can always browse the full directory without using this feature, and the data involved is never used to train the providers’ models. Search requests are also stored on Onfound’s own systems, linked to your account, so we can improve the feature and understand what members are looking for; they are visible only to Onfound administrators.

This suggestion process constitutes profiling under GDPR but does not produce legal effects or similarly significant effects on you. It is used to help you discover potentially relevant members in the directory, not to make decisions about you, and you can browse the directory freely without relying on these suggestions.

You have the right to request information about the logic involved in the suggestion process and to object to automated decision-making. To do so, please contact us at support@onfound.com.

We do not use automated decision-making for any purpose that produces legal effects or significantly affects you (such as credit decisions, employment, or access to essential services).

14 Do Not Track Signals

Some browsers transmit “Do Not Track” (DNT) signals. There is currently no industry standard for how to respond to DNT signals. Our website does not currently respond to DNT signals, but you can manage tracking preferences through your browser settings and cookie choices as described in Section 5.

15 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law.

If we make material changes, we will notify you by:

• Sending an email to the address associated with your account.
• Displaying a prominent notice within the platform or app.
• Updating the “Last Updated” date at the top of this policy.

We will provide at least 14 days’ notice before material changes take effect, except where changes are required by law. Your continued use of the Services after the updated policy takes effect constitutes your acceptance of the changes. If you do not agree, you should stop using the Services and delete your account from within the app or member dashboard.