Privacy Policy

The short version

• We collect what we need to run a fundraising marketplace — your account, your listings or investor profile, your deal activity, and the verification documents you choose to submit.
• Money moves through Stripe. Full card numbers never reach our servers.
• We don't sell your data. Ever.
• Records of binding deals (signed contracts, escrow ledger, audit log) are kept even after you leave, because the other side of your deal — and the law — may need them.

What we collect

• Account: your name, email, role (founder or investor), and password — stored as a hash by our sign-in provider, never readable by us. Phone number, if you verify it.
• Verification documents you choose to submit: government ID, a live selfie (when that check is enabled), or a trade licence.
• Listings: product profile, deal terms, milestones, team bios, pitch deck, demo video, and the metrics you report.
• Deal activity: interest, offers, deal-room messages, shared documents, signatures (with time, IP address, and device — that's the signing record), and escrow and payout history.
• Technical basics: server logs, your language preference, and notification settings.

What we use it for

• Running the platform — listings, deal rooms, contracts, escrow.
• Showing verification badges that reflect completed checks.
• Notifying you about activity on your deals (in-app always; email only if you keep it on).
• Keeping tamper-evident records of signatures and money movements.
• Safety: reviewing reports, preventing fraud, enforcing suspensions.
• Meeting legal obligations.

Who can see what

• Your counterparty sees what you share in a deal — messages, documents, signatures.
• Published listing content (including deck and demo) is visible to signed-in investors. Drafts are visible only to you.
• Verification badges are visible wherever your listing or profile appears.
• Verification documents themselves (ID, selfie, licence) are private — reviewers check them; other users never see them.
• Platform admins see reports and the audit log when reviewing safety issues.
• We do not sell or rent your data to anyone.

Services we rely on

We build on a small set of providers, each processing only what its job needs: Supabase (database, file storage, and sign-in), Vercel (hosting), and Stripe (payments and escrow money movement; also revenue metrics if you choose to connect your Stripe account). Some features use additional providers as they roll out: Veriff (live selfie checks), Brevo (email notifications), and Daily.co (video calls).

How your data is protected

Everything is encrypted in transit. Database access is governed by row-level security rules, so each user can only read what they're entitled to. Private files — IDs, milestone proofs, signed contracts — are only reachable through short-lived signed links. Service credentials stay on the server and never reach the browser.

How long we keep things

Account data is kept while your account is active. If you close your account or ask us to delete your data, we remove what we can — but records that document a binding deal (signed contracts, escrow ledger entries, cap-table records, audit entries) are retained, because your counterparty and the law may require them.

Your choices

• Edit your profile details on the account page.
• Turn email notifications on or off any time (in-app notifications stay on).
• Ask for a copy of your data, or ask us to delete it, through the support form inside the app.
• Use Funder in English or Arabic — the toggle is in the top bar.

Children

Funder is for adults. We don't knowingly collect data from anyone under 18.

Changes to this policy

When we change this policy we'll update the date at the top, and flag material changes in the app.

Contact

Questions about your data? Reach us through the support form inside the app.