Privacy policy
Version 3 · valid from 10 November 2026
1. Who is responsible
1.1 The controller for the processing of personal data on Cofoundista within the meaning of Art. 4(7) GDPR is:
Gregor Zehetner, sole proprietor
2540 Bad Vöslau, Austria
Email: contact@cofoundista.com
In this policy, "Cofoundista", "we" and "us" mean this controller. "You" means the person whose data we process.
1.2 We are not required to appoint a data protection officer (Art. 37 GDPR). For every question about your data, write to contact@cofoundista.com.
2. What this policy covers
2.1 This policy covers cofoundista.com (the "Platform"): the public pages, the member area, the partner portal and the emails we send. Terms we use without explaining them here have the meaning given in our terms of use.
2.2 The Platform is in a beta phase. When features change, the data we process can change too; we then update this policy (section 19).
3. In short
- We process what you enter so that you can find a co-founder: your profile, your criteria and, if you found, your co-founder searches.
- Other members see your details step by step. Your full name, photo and links come with an intro, your email address and phone number only after both sides said yes.
- Search teasers are public. Profiles of people are never public.
- Suggestions are ranked by fixed, explainable rules. There is no AI ranking.
- Our database and our servers are in the EU (Frankfurt). We do not sell personal data to anyone, and we use no advertising trackers. We count visits to the public pages and the sign-in page with Plausible, without cookies (section 10.2). Contact details go only to the other member of an intro you accepted.
- In your settings you can download your data and delete your account.
4. The data we process
We process the following data, each only as far as needed for the purposes in section 5. The forms on the Platform show which details are required and which are optional.
4.1 When you visit the public pages. Our hosting provider processes the technical data of each request to deliver the page and to protect the Platform: IP address, time, page requested, referring page, browser and status code (server logs). We set only the cookies listed in section 10. We serve fonts from our own servers, so loading a page sends nothing to font providers. The cap table calculator runs in your browser; we do not receive what you enter. On the public pages and the sign-in page we also count visits with Plausible (section 10.2).
4.2 Account. Email address, how you sign in (code, Google or LinkedIn), the name and profile picture Google sends us if you sign in with Google, the name and profile picture LinkedIn sends us if you sign in with LinkedIn and when you first did, your language, the status of your account and any roles (partner admin, platform admin). Also when you confirmed being 18 or older, whether and when you agreed to product news, your notification settings and your answer to "How did you hear about us?", including the programme you chose or whose link you used, and the code of that link. To stop misuse, our database provider counts sign-in attempts per IP address.
4.3 Consent records. Which version of the terms of use, the code of conduct and this policy you accepted, in which language and when, together with the IP address and the browser (user agent) at that moment.
4.4 Profile. First and last name, photo, phone number (optional), city (optional), country, whether you are open to remote work, role category, skills, whether you are technical, how much time you spend or can commit, industries, languages, your answers to the working-style questions, bio, answers to the optional profile questions (such as "What I have built"), links (such as LinkedIn, GitHub, website), what brings you here (founding, joining or both), your availability, your choice of who may see your photo and, if you removed your photo, when (so that no sign-in brings a picture back). We keep your photo in a private file store. A member who may see it (section 7) receives a link that is valid for one hour. If you use the profile picture of your Google account, it stays on Google's servers (section 11).
4.5 Joining terms and preferences (if you want to join a start-up). Earliest start, equity expectation, salary need, the countries where you can work on site, and your criteria with the ones that must match, such as least stage, industries, minimum founder commitment and least incorporation status.
4.6 Founder experience. Companies you founded or co-founded: name, website, your role, founded and end year, status of the company, your own status, and for exits the year, your role at the exit and a link as evidence.
4.7 Co-founder searches (if you found). Title, teaser, venture details (problem, solution, traction), industry, stage, incorporation status, legal form, country, company name and website, the role sought, required skills, hours expected, location and remote work, equity and salary offered, must-have criteria, status and, when filled, whether you found the person through Cofoundista. If you list your current team: first name, last name (optional), role title, role category, commitment and LinkedIn link (optional) of each team member.
4.8 Fit scores. For each pair of person and search: the score in each direction, the fit per criterion and when it was computed (section 8). Also which suggestions you have already seen or received by email, so that we can mark new ones.
4.9 Intros. Who sent an intro to whom and for which search, the personal note, when it was sent, answered, withdrawn or expired, its state, the optional reason for a decline, and your answers to the outcome check ("Did you talk?", "Did you start a trial project?").
4.10 Blocks and reports. Whom you blocked; reports you made or that concern you, with reason, description and our decision.
4.11 Plans, codes and sponsorships. Your plan with its tier, source, period and why it ended; codes you redeemed, and failed attempts to redeem a code (to limit guessing); sponsorship requests to a partner programme and sponsorships, with the partner, dates and decisions.
4.12 Checks. The review status of your profile and your searches, our decisions with their reasons, and the internal note of our team.
4.13 Emails. For every email the Platform sends you: address, type, subject, language, status, the message ID of our email provider, any error, and the text as sent (email log). The text can contain details of other members, for example the name and contact details of the other side in the email after an accepted intro. Sign-in codes are sent by our database provider and are not part of the email log. We also keep bounce notices from our email provider and your unsubscribe choices.
4.14 Change history. Changes to the data of the Platform: what changed, the old and new value, who changed it and when (audit log).
4.15 Usage events. Steps such as sign-up, profile live, search published, intro sent, accepted or declined, and outcome answers, and the days you use the member area, each with the time and the programme you are attributed to (event log).
4.16 Partner admins. If you administer a partner programme: your account data, your programme and your actions in the partner portal, such as codes created and sponsorship requests decided.
4.17 Messages to us. What you write to us, for example to contact@cofoundista.com.
We do not ask for special categories of personal data (Art. 9 GDPR), such as health, religion or political views. Please do not put such data into free texts.
5. Purposes and legal bases
| Purpose | Data (section 4) | Legal basis |
|---|---|---|
| Account, sign-in and providing the Platform | 4.1, 4.2 | Art. 6(1)(b) GDPR: contract (terms of use) |
| Profiles and searches, showing them to members, public search teasers | 4.4 to 4.7 | Art. 6(1)(b) GDPR |
| Fit scores, suggestions and emails with new suggestions | 4.4 to 4.8 | Art. 6(1)(b) GDPR |
| Intros, sharing contact details after acceptance, reminders, expiry | 4.9 | Art. 6(1)(b) GDPR |
| Outcome check after an accepted intro | 4.9 | Art. 6(1)(f) GDPR: our interest in learning whether matches turn into teams; answering is voluntary |
| Plans, codes and sponsorships, including your name and email address to the partner when you send a sponsorship request | 4.11 | Art. 6(1)(b) GDPR |
| Checks, reports, blocks and measures against breaches | 4.10, 4.12, 4.14 | Art. 6(1)(b) GDPR (terms of use); Art. 6(1)(f) GDPR: a trustworthy platform for all members; Art. 6(1)(c) GDPR where the Digital Services Act requires it |
| Emails the Platform needs (sign-in codes, intros, decisions) | 4.2, 4.13 | Art. 6(1)(b) GDPR |
| Product news | 4.2 | Art. 6(1)(a) GDPR: your consent; § 174 TKG 2021 |
| Proof of your acceptance of the legal documents, including IP address and browser | 4.3 | Art. 6(1)(c) GDPR with Art. 7(1) GDPR; Art. 6(1)(f) GDPR: proof against claims |
| Email log as proof that notices were sent, and for support | 4.13 | Art. 6(1)(f) GDPR |
| Change history for security, traceability and accountability | 4.14 | Art. 6(1)(f) GDPR; Art. 5(2) GDPR |
| Measuring whether the Platform works, and figures without personal data for partner programmes | 4.2, 4.15 | Art. 6(1)(f) GDPR: our interest in improving the Platform and in reporting to the programmes we work with |
| Visitor statistics for the public pages and the sign-in page (Plausible) | 4.1, 10.2 | Art. 6(1)(f) GDPR: our interest in learning which pages are read and how people find us, for example through search engines and AI assistants |
| Security, limits against misuse, server logs | 4.1, 4.2 | Art. 6(1)(f) GDPR: security of the Platform and its members |
| Partner portal for programme staff | 4.16 | Art. 6(1)(b) GDPR (agreement with the programme); Art. 6(1)(f) GDPR |
| Answering your messages | 4.17 | Art. 6(1)(b) or (f) GDPR |
| Legal obligations, establishing or defending legal claims | as needed | Art. 6(1)(c) or (f) GDPR |
Where we rely on our legitimate interests (Art. 6(1)(f) GDPR), we have weighed them against your interests. You can object to this processing (section 15).
Emails with new suggestions, intros and reminders are part of the service you signed up for. They need no marketing consent and carry no advertising. You can switch off the emails with new suggestions in your settings.
6. Where the data comes from
6.1 Most data comes from you.
6.2 If you sign in with Google, Google sends us your name, email address and profile picture. If you sign in with LinkedIn, LinkedIn sends us your name, email address, profile picture and language. We keep the name, the email address and the language. If your profile is new and has no photo yet, we copy the picture once into our private file store as your profile photo (section 4.4); you can replace or remove it at any time. We receive nothing else from LinkedIn, in particular not your skills, positions, contacts or messages. You can sign in with a code by email instead.
6.3 Other members may provide data about you: a founder who lists you in the current team of a search (section 16), or a member who reports your profile.
6.4 When you use the link or code of a partner programme, we learn which programme it is. Partner programmes do not send us data about you.
6.5 To check a profile, our team may open the links you give, such as your LinkedIn profile or the evidence for an exit. We do not buy data and do not enrich your profile with data from data brokers.
7. Who sees your data
7.1 Who sees what on the Platform depends on the relationship. The rules are enforced in our database, not only in the interface.
| Data | Public | Members | Recipient of your intro | After an accepted intro |
|---|---|---|---|---|
| Your first name | No | Yes | Yes | Yes |
| Your last name | No | No | Yes | Yes |
| Your photo | No | Only if you choose "all members"; by default not | Yes | Yes |
| Role, skills, technical, city, country, availability and earliest start | Counts only | Yes | Yes | Yes |
| Bio, answers to profile questions, working style, industries, languages, badges | No | Yes | Yes | Yes |
| Founder experience without company name and website | No | Yes | Yes | Yes |
| Company name and website in your founder experience | No | No | Yes | Yes |
| Your links (LinkedIn and others) | No | No | Yes | Yes |
| Your equity and salary expectations | No | Only as fit or no fit | Yes | Yes |
| Your email address and phone number | No | No | No | Yes |
| Evidence link for an exit | No | No | No | No (our team only) |
For co-founder searches:
| Data | Public | Members | Recipient of the founder's intro | After an accepted intro |
|---|---|---|---|---|
| Title, teaser text, industry, stage, role sought, location | Yes | Yes | Yes | Yes |
| Incorporation status, legal form, hours, founder commitment, equity and salary offered, required skills, must-have criteria, venture details | No | Yes | Yes | Yes |
| Company name and website | No | No | Yes | Yes |
| Current team: first names, role titles, role categories, commitment | Team size only | Yes | Yes | Yes |
| Current team: last names and LinkedIn links | No | No | Yes | Yes |
7.2 Intros are one-sided until accepted. When you send an intro, you show the recipient your details as in the third column. You keep seeing the recipient as a member until they accept. Before you send, the Platform tells you what the recipient will see.
7.3 Blocks. If you block a person, or a person blocks you, you no longer see each other.
7.4 Partner programmes. We give partner programmes figures for their programme without personal data, such as the number of sign-ups and intros. When you send a programme a sponsorship request, its admins see your name, your email address, the code and the dates of the request and of any sponsorship, and they receive an email about it. If programmes are later to see more of their members, we will do that only under a written agreement with the programme and will update this policy first.
7.5 Our team. Platform admins see the data they need for checks, moderation and support, including the email log.
7.6 Search engines and AI services. Published search teasers are public pages that search engines and AI search services can find and show. When a search is paused, we ask search engines not to index it; when it is filled or closed, its page is gone. Copies in search indexes, caches and AI services may remain for some time; we have no influence on them. Profiles of people are never on public pages. We also let crawlers that collect training data for AI models read the public pages.
7.7 Data you shared. Once other members have received your details, for example your contact details after an accepted intro, they process them on their own responsibility. We cannot recall them. Our code of conduct allows their use only for the conversation about building a company together.
8. Fit score: how we rank suggestions
8.1 To suggest searches to people and people to founders, we compare the criteria both sides gave, such as role, skills, time, location, stage, equity and salary. This is profiling within the meaning of Art. 4(4) GDPR. It follows fixed rules set by our team, without AI. The role always has to match, and a pair that misses a must-have criterion of the other side is not suggested. For every suggestion the Platform shows which criteria fit; the page How it works explains the score.
8.2 The legal basis is Art. 6(1)(b) GDPR: matching is the service you signed up for. The score only orders and filters suggestions. Whether to contact someone and whether to accept an intro is always decided by people, so there is no automated decision within the meaning of Art. 22 GDPR.
8.3 You control the score through your criteria and must-haves. If you switch off your availability, founders no longer see you in their suggestions.
9. Checks and automated steps
9.1 We check searches before they go live and profiles after they go live, against our published check criteria. We reserve the right to use automated tools, including AI technologies, for these checks, for example to flag profiles with missing or inconsistent details.
9.2 Before an AI service receives your data for this, we name the provider, the data and the transfer basis in this policy. Decisions that take a profile offline or suspend an account are always made by a person.
9.3 Some steps follow automatically from the rules in the terms of use, for example: intros expire when nobody answers in time, a plan ends at its end date and searches beyond the remaining coverage pause, and limits stop too many intros or reports in a day. These steps apply the same rules to everyone and do not assess you as a person.
10. Cookies
10.1 We use only cookies that the Platform needs to work. None of them tracks you or serves advertising. They need no consent (§ 165(3) TKG 2021). The legal basis for the related processing is Art. 6(1)(b) and (f) GDPR.
| Cookie | Purpose | Stored for |
|---|---|---|
| sb-…-auth-token | Keeps you signed in; deleted when you sign out | up to 400 days, extended while you use the Platform |
| sb-…-auth-token-code-verifier | Secures the sign-in while it is in progress | up to 400 days |
| cf_signed_in | Shows the link to your dashboard in the page header while you are signed in | up to 400 days, extended while you use the Platform |
| NEXT_LOCALE | Remembers the language you chose | 365 days |
| cofoundista_code | Keeps a voucher or programme code from a sign-up link until you use it | 30 days, deleted when you redeem the code |
| cofoundista_partner | Remembers the programme whose link you came by until you sign up | 30 days, deleted when you answer "How did you hear about us?" |
We do not use the local storage of your browser.
10.2 Web analytics. On the public pages and the sign-in page we count visits with Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). Plausible sets no cookies and stores nothing in your browser. For each page view it receives the address of the page (without any query parameters except campaign parameters such as utm_source), the referring page, browser, operating system and device type taken from your browser's identification, how far you scrolled and how long the page was open, and your country, region and city derived from your IP address. To count visitors per day, Plausible forms a value from your IP address, your browser's identification, our domain and a random value that it deletes after 24 hours; it stores neither your IP address nor your browser's identification. We see only aggregated figures, never single visitors. We do not use Plausible in the member area, the partner portal or the admin area. Legal basis: Art. 6(1)(f) GDPR (section 5). You can object (section 15); a content blocker in your browser also stops it.
11. Recipients and processors
11.1 We pass on personal data only to the recipients below. Processors process data only on our instructions under a data processing agreement (Art. 28 GDPR).
| Recipient | Role | Data | Location | Safeguards |
|---|---|---|---|---|
| Supabase | Processor: database, sign-in, file storage, sending sign-in codes | All data in section 4 except server logs | EU (Frankfurt, Germany) | Data processing agreement; standard contractual clauses where data is accessed from outside the EU |
| Vercel | Processor: hosting, scheduled jobs, content delivery, server logs | Requests (section 4.1) and the data of the pages and jobs it runs | EU (Frankfurt, Germany); static files through a worldwide network | Data processing agreement; EU-US Data Privacy Framework; standard contractual clauses |
| Resend | Processor: sending emails, including sign-in codes; bounce notices | Email address, name, subject and text of the email | Sending from the EU (Ireland); account data, logs and metadata in the USA | Data processing agreement; EU-US Data Privacy Framework; standard contractual clauses |
| Plausible | Processor: visitor statistics for the public pages and the sign-in page | As in section 10.2 | EU (Germany) | Data processing agreement |
| Independent controller: sign-in with Google, and profile pictures from Google accounts | Sign-in data. When you view a member who uses their Google profile picture, your browser loads it from Google, which receives your IP address and browser data | Worldwide | Sign-in with Google is your choice; you can sign in with a code instead and upload your own photo | |
| Independent controller: sign-in with LinkedIn | Sign-in data: LinkedIn learns that you sign in to Cofoundista | Worldwide | Sign-in with LinkedIn is your choice; you can sign in with a code instead | |
| Partner programmes | Independent controllers | As in section 7.4 | EU | Your sponsorship request; agreement with the programme |
| Other members | Independent controllers | As in section 7 | Worldwide | Terms of use and code of conduct |
| Advisers (legal, tax, IT) | Bound to secrecy | Only what an engagement needs | EU/EEA | Professional secrecy; data processing agreement where needed |
| Authorities and courts | Recipients by law | Only what the law requires | Austria/EU | Legal obligation |
11.2 We do not sell personal data to anyone and do not pass it on to advertising networks. Founders pay for a plan to publish searches, not for data: contact details go to another member only when the recipient accepts an intro.
12. Transfers outside the EU and EEA
We host the Platform in the EU. Some of our processors or their subcontractors are based in the USA or may access data from there, for example for support. Such transfers rest on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards at contact@cofoundista.com.
13. How long we keep data
| Data | How long |
|---|---|
| Account, profile, searches, intros, plans and settings | As long as your account exists |
| After a deletion request | Profile and searches are hidden at once and open intros end. After a grace period of 14 days, in which you can cancel, we delete your account and all data linked to it, at the latest one month after your request |
| Consent records, email log and change history | Deleted with your account |
| Record of the deletion | Only an internal ID, who deleted and when, as proof that we deleted (Art. 5(2) GDPR) |
| Usage events | Kept without any link to you once your account is deleted |
| Visitor statistics (Plausible) | Only aggregated figures without any link to you; the daily value used to count visitors cannot be linked to you once its random value is deleted after 24 hours |
| Reports you made | Kept without your name once your account is deleted, as the record of our decision |
| Data other members received from you | Stays with them (section 7.7) |
| Emails we sent to other members that name you, for example the email with your contact details after an accepted intro | Stay in their email log as long as their account exists |
| Data under a legal hold (litigation, investigation) | As long as the hold lasts |
We do not delete inactive accounts automatically.
14. Security
We protect your data with technical and organisational measures (Art. 32 GDPR), in particular encrypted connections, encrypted storage, access rules in the database for every table, sign-in without passwords through single-use codes, and a change history for admin actions. No system is completely secure. If a breach of personal data is likely to put your rights at risk, we inform the Austrian Data Protection Authority within 72 hours and, if the risk is high, you as well (Art. 33 and 34 GDPR). Please report vulnerabilities to contact@cofoundista.com.
15. Your rights
You have these rights under the GDPR:
- Access (Art. 15): which data we process about you, and a copy. In your settings you can download your data as a JSON file at any time. On request we also tell you about data the download does not contain, such as our internal review notes.
- Rectification (Art. 16): you can correct most data yourself in your profile and settings.
- Erasure (Art. 17): you can delete your account in your settings (section 13).
- Restriction (Art. 18) of processing in the cases the law sets out.
- Data portability (Art. 20): the download in your settings gives you the data you provided in a machine-readable format.
- Objection (Art. 21): you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You can object to direct marketing at any time without giving reasons.
- Withdrawal of consent (Art. 7(3)): you can withdraw your consent to product news at any time, in your settings or with the link in every such email. This does not affect processing before the withdrawal.
- Complaint (Art. 77) to a supervisory authority. In Austria this is the Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at. You can also complain in the EU country where you live or work.
To exercise your rights, write to contact@cofoundista.com. We answer within one month; for complex requests we can extend this by two months and tell you why. We may ask you to prove your identity.
16. If a founder lists you in a team
A founder can list the current team of a search. If you are listed, we process your first name, and if given your last name, role title, role category, commitment and LinkedIn link. The founder enters these details and confirms that you agreed. Members see your first name, role title, role category and commitment; your last name and LinkedIn link are visible only in an intro and after an accepted intro (section 7.1); the public sees only the size of the team. The legal basis is the legitimate interest of the founder and of us in presenting the team (Art. 6(1)(f) GDPR). We delete the entry when the founder removes it, when the search is deleted or when you ask us to. Write to contact@cofoundista.com; the other rights in section 15 apply to you too.
17. Minors
The Platform is for people aged 18 or older. We do not knowingly process data of minors. If we learn that a minor signed up, we delete the account.
18. Partner programme staff
If you work for a partner programme and administer it on Cofoundista, we process your account data and your actions in the partner portal to provide the portal under our agreement with the programme (section 5). If we invite you by email, we keep the invitation with your email address; it is valid for 30 days. We also keep the email address of the contact person the programme gives us for our agreement. Your programme can ask us to remove your access.
19. Changes to this policy
We update this policy when our processing, our service providers or the law change. Every version carries a version number and the date from which it applies. We show you a material change at your next sign-in.
20. Contact
Cofoundista, Gregor Zehetner, 2540 Bad Vöslau, Austria
contact@cofoundista.com