Privacy Policy

FounderGrade, referred to here as we, our or us, operates the foundergrade.ai platform from the Dubai International Financial Centre. This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have over it.

We are pursuing a DFSA Innovation Testing Licence and we build our data handling practices to the DIFC Data Protection Law, DIFC Law No. 5 of 2020, with reference to GDPR-aligned standards where our users are based outside the DIFC.

This policy covers founders, experts, investors and accelerator staff who create an account, and visitors who browse public pages without an account. Each role sees a different amount of personal data collected: founders and experts undergo identity verification, while a visitor reading the blog does not.

Account information: name, email address, phone number, password hash, and role selected at signup.

Identity verification data: government identification documents, proof of address and liveness checks, collected through our KYC and KYB partners when you take an action that requires verification, such as funding escrow or receiving an expert payout.

Company and pitch information: anything you submit for scoring, including pitch decks, financial models, cap tables and answers to the eight scoring dimensions.

Financial and transaction information: bank or wallet details needed to fund or receive escrow, on-chain transaction references, and invoices for fees charged under our fee schedule.

Communications: messages sent through deal rooms, blind review queries, support tickets and marketing preferences.

Technical information: device type, browser, IP address and usage events, collected to keep the platform secure and to improve it.

To create and administer your account, run blind expert review, publish credibility scores and match founders with investors and accelerators.

To operate on-chain milestone escrow, including verifying that a release condition has been met and recording the resulting transaction.

To meet our legal obligations, including AML and KYC checks, tax reporting and responding to lawful requests from regulators including the DFSA.

To keep the platform secure, detect fraud and misuse, and maintain the audit trail that every administrative action writes to.

To send you service messages you cannot opt out of, such as security alerts and milestone notifications, and optional product updates you can opt out of at any time.

Where the DIFC Data Protection Law or an equivalent regime applies, we rely on one or more of: performance of a contract with you, our legitimate interest in operating a secure marketplace, your consent where we ask for it explicitly, and compliance with a legal obligation such as AML and KYC rules.

Expert review is conducted blind: the expert sees an anonymised reference to your company and none of your personal identifying details during scoring. We maintain this separation at the database and access-control level, not only in the interface, so identity and score data are never joined in a way an expert reviewer can see.

Once a deal moves into a deal room, both parties' real names and details become visible to each other because they are actively transacting.

Milestone escrow is administered through audited smart contracts on an EVM-compatible network. Wallet addresses, transaction amounts and release events are recorded on a public ledger by design and cannot be deleted once written, because that is how a public blockchain works. We do not put your name, email or documents on-chain; only the minimum transactional data needed to operate escrow is written there.

If you opt in to publishing your credibility score on-chain, the score and issuance hash become part of the public ledger. This is optional and you choose it explicitly during onboarding.

We share personal data with: identity verification and payment processing sub-processors, cloud infrastructure providers, the specific investors, experts or accelerators you choose to engage with on the platform, and regulators or law enforcement where we are legally required to.

We do not sell personal data. We do not share your data with advertisers, and we do not run third-party advertising trackers on authenticated pages.

Every sub-processor that touches identity, payment or custody data goes through vendor due diligence before onboarding and is reviewed periodically after.

Data at rest is encrypted with AES-256 and data in transit uses TLS 1.3. Access to production data is role-scoped on a least-privilege basis, and every administrative action writes to an immutable audit trail.

We do not claim SOC 2, ISO 27001 or any other certification today. When we complete an independent audit, we will publish the report reference on our Trust page rather than asserting a badge we cannot evidence.

We retain personal data for as long as your account is active, plus the period required by our AML, tax and dispute-resolution obligations after account closure. On-chain escrow and score records are immutable by design and are retained indefinitely as part of the public ledger.

You can request deletion of off-chain personal data at any time, subject to the records we are legally required to keep.

Because FounderGrade serves founders, investors, experts and accelerators across MENA and other emerging markets, personal data may be transferred outside the DIFC to sub-processors that support our infrastructure. We require contractual safeguards from any sub-processor that receives personal data across a border.

Under the DIFC Data Protection Law and comparable regimes, you have the right to access, correct, erase, restrict processing of, and port your personal data, and to object to certain kinds of processing. To exercise any of these rights, contact our Data Protection Officer at the address below.

We will respond to a verified request within the timeframe required by applicable law and will tell you if a legal retention obligation limits how a request can be fulfilled.

FounderGrade is a professional marketplace for company founders, investors, experts and accelerator staff. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18.

We will update the effective date at the top of this page whenever this policy changes and will notify account holders by email of any material change.

For privacy questions or to exercise your rights, contact our Data Protection Officer at privacy@foundergrade.ai, or write to FounderGrade, DIFC Innovation Hub, Dubai, United Arab Emirates.