Privacy policy · Fundur

1. Who is responsible

The responsible party (controller) for information about our users is To be added: registered company name, trading as Fundur, of To be added: physical address. Our Information Officer is To be added: Information Officer’s name, reachable at To be added: Information Officer’s email. Contact them about anything in this policy.

2. Information we collect

What	Examples	Where it comes from
Account details	Name, email address, profile picture, sign-in identifier, workspace name	You, through our sign-in provider Auth0 (and a social sign-in service such as Google, if offered and you choose to use it)
Your content	Projects, briefs, client names and details, tasks, notes, floor plans, uploaded files and photos, messages to the assistant	You
AI usage	Which AI feature you used, the model, its token count and cost	Created when you use AI features
Issue reports	Your note, the screen and part of the app it is about	You, when you report an issue
Usage data	Pages you open, time and scrolling on each, where you click (the label of what you clicked and its position), features you use, errors, device type and screen size, linked to your account. A click label can include a project or client name shown on screen. What you type is never recorded.	Recorded by Fundur's own usage tracker while you are signed in
Client link activity	The name a client gives when commenting on or approving a shared page, their comments and decisions, and how often and when the link was last opened	People you share a link with
Client progress page invitations	The client's email address you invite, and how often and when they last opened the page. Only someone signed in with that verified address can open it.	You, when you invite a client
Team space	Comments, whiteboard notes and chat messages written on a project, with the name of who wrote them	You and your teammates
Teammate invitations	The email address and role you invite someone with	You, when you invite a teammate
Technical data	IP address, browser and device type, request logs, sign-in session cookies	Your browser, recorded by us and our hosting and sign-in providers

We do not use advertising trackers or any third-party analytics tool, and we never sell information. Usage data stays in our own database and only the platform Admin can see it. We do not ask for special personal information (such as health, religion or biometrics) and ask you not to put it into Fundur unless your work truly needs it.

3. Why we use it, and on what basis

To provide Fundur: to create your account, keep your work, run the features you use and keep you signed in. This is needed to perform our agreement with you (POPIA section 11(1)(b); GDPR article 6(1)(b)).
To run AI features you ask for: to send the relevant part of a project to the AI provider handling the task, and to log the cost. Also part of performing our agreement.
To keep Fundur safe and working: backups, security, preventing misuse and fixing issues you report. This is in our legitimate interest and yours (POPIA section 11(1)(f); GDPR article 6(1)(f)).
To improve Fundur: we record in-app activity (the usage data above) to see which parts of the app work well and which confuse people, and to decide what to build or fix next. When the Admin asks Fundur's improvement advisor for advice, an AI provider reads summary usage numbers, the text of issue reports and the Admin's own notes; it does not receive your projects. This is in our legitimate interest. There is no switch to turn usage recording off yet; you can object to it, or ask for your usage data or its deletion, by emailing us.
To tell you about the service: important notices such as changes to these policies or to pricing. We will only send marketing with your consent or, for our own similar services, where POPIA section 69 allows it, and every message will let you opt out.
To meet legal obligations, such as keeping records the law requires or responding to lawful requests.

4. Information about your clients and other people

When you put information about your clients, their staff or anyone else into Fundur, you decide why and how it is used, so you are the responsible party for it and we are your operator (under GDPR, you are the controller and we are your processor). We process it only to provide Fundur to you, keep it confidential, protect it with the safeguards in section 8, and will tell you without undue delay if we believe it has been accessed without authorisation. You are responsible for having a lawful basis to share it with us and for telling those people how their information is used.

5. Who we share it with

We share personal information only with service providers who help us run Fundur, and only what they need:

Provider	What they do
Vercel	Hosts the app and stores uploaded files and backups (Vercel Blob)
Neon	Hosts the database that holds your projects
Auth0 (Okta)	Handles sign-in and account security
AI providers: Anthropic, OpenAI, Google (Gemini), xAI (Grok) and OpenRouter	Process the part of a project an AI feature needs, only when that feature is used, including images for concept visuals. OpenRouter passes requests to the model provider chosen for the task. The improvement advisor sends only summary usage numbers, issue report text and Admin notes.
Whop	Will process payments for paid plans once they launch. No payment details are collected during the free beta, and we will not store full card details.

When you share a client link, the people who open it see what you chose to share. When you invite a teammate, they see the projects you give them access to.

We may also disclose information if the law requires it, to protect rights or safety, or to a business that takes over Fundur, which would have to honour this policy.

6. Information sent outside South Africa

Our service providers run their systems in other countries, so your information will be processed outside South Africa. Under POPIA section 72 we only do this where the recipient is bound by law, binding rules or an agreement that gives protection substantially similar to POPIA, or where the transfer is needed to perform our agreement with you. For people in the EU or UK, transfers rely on adequacy decisions or standard contractual clauses offered by these providers.

7. How long we keep it

Account details and your content: for as long as your account is open.
After you ask us to close your account: we delete your information from the live service, and it leaves our nightly backups when they expire, which is after 30 days.
AI usage and cost records: for as long as your account is open, as part of your project history.
Usage data: 13 months, then deleted automatically.
Client link comments and decisions: with the project, until you delete it or close your account.
Team comments, whiteboard notes and chat messages: with the project, until they or the project are deleted or you close your account.
Anything the law requires us to keep longer: only for as long as that law requires.

8. How we protect it

Fundur is only reachable over encrypted connections (HTTPS), and everything in your workspace needs a signed-in session.
Each workspace's projects are kept separate and are only returned to people signed in to it.
Uploaded files are stored privately, not on public links.
AI provider keys are encrypted before they are stored.
The service is backed up every night, and each backup is checked.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the Information Regulator as POPIA section 22 requires.

9. Your rights

You may, free of charge unless the law allows a fee:

ask whether we hold information about you and for a copy of it (POPIA section 23; GDPR article 15);
ask us to correct, update or delete it (section 24; articles 16 and 17);
object to processing based on legitimate interests, and to direct marketing at any time (section 11(3));
withdraw any consent you gave, without affecting what was done before;
under GDPR, also ask to restrict processing or receive your information in a portable format;
complain to the Information Regulator of South Africa (inforegulator.org.za), or to the data protection authority where you live.

To use these rights, email To be added: Information Officer’s email. We may need to confirm who you are first, and we will reply within a reasonable time and at most within the period the law sets. Formal requests for records can also be made under our PAIA manual.

10. Automated decisions

We do not make decisions about you that have legal or similarly significant effects based only on automated processing. AI in Fundur drafts and suggests; you decide.

11. Cookies

We use cookies and browser storage to keep you signed in, keep drafts safe and group usage data by visit, and no advertising or third-party tracking cookies. See our cookie policy.

12. Children

Fundur is for adults using it for work. We do not knowingly collect information from anyone under 18.

13. Changes

We will post any changes here with a new date and tell you about important ones before they take effect.