Who is responsible for your data
Philippe Nicolas, entrepreneur individuel (French sole trader), 1 rue de Madrid, 67310 Wasselonne, France, SIREN 938 048 071, trading as FoundByName. Write to nick@foundbyname.com about anything on this page. The business is run from France, so European data protection law applies to it, whichever country you are in. Our US address is a mail address only, and the full company details are on the legal notice.
What we collect
- Account data. Your email address and a password we store only as a salted hash. The sessions you open (a random token, the time, the IP address and browser that opened them) so we can end them and spot abuse.
- Billing data. Payments go through Stripe. We keep your Stripe customer and subscription identifiers, your plan and invoice status. We never see or store your card number.
- What you tell us about your business. The answers to the questionnaire, the services, hours and areas you give us, and the access you choose to grant to your Google Business Profile.
- Public business data. Business names, addresses, phone numbers, websites, ratings and review counts from public directories, and the answers AI assistants give to questions such as “best [your trade] in [your city]”. This is information about businesses, not about consumers.
- Requests and emails. When you ask for a report or write to us, we keep the request, your email address and our replies. Email opt-outs are kept so we respect them.
- Referrals. If you came to us through a client’s referral link, we note which client sent you, so we can give them their reward. The referral code is in the link itself, not in a cookie.
- Partners. If you join our partner program, we keep your name, email and website, the email where we send your commission, what you told us about how you'll share your link, and a one-way fingerprint of the connection you signed up from, so no one can sign up more than five times a day. If you came to us through a partner’s link, we note which partner sent you and count your payments to pay their commission. The partner sees your business name and the amounts you paid us, nothing else. The code is in the link, then kept in your browser tab for the visit (not in a cookie).
- Search ad measurement, for visitors outside the EEA, the UK and Switzerland. If you reach us from one of our search ads, Google’s tag notes that you arrived from the ad and whether you then started a free report or signed up as an agency. Microsoft’s tag runs on our public pages, whether or not you came from an ad. It notes the pages you open and whether you started a free report or signed up as an agency. If you pay, it also gets the amount. Both tags also receive your IP address and browser details. See Cookies.
- Search ad clicks. With your report request or agency sign-up (and your payment, if you buy), we keep the ad’s click ID and the keyword that showed you our ad. That tells us which keywords bring us customers.
- Technical logs. Server logs with IP addresses and user agents, kept for security and debugging. The free checks store a one-way hash of your IP address, never the address itself.
Why we use it, and on what legal basis
- To deliver what you bought and to run your account: performance of our contract with you.
- To bill you and keep invoices: a legal obligation under French tax and accounting law.
- To email businesses about what AI assistants answer in their city: our legitimate interest in offering a service that concerns their trade. We use business addresses, we say where we found them, and you can object at any time, by clicking the unsubscribe link in any email or by replying and telling us to stop. We keep a written note of why we consider this balanced, and you can ask us for it.
- To run the referral program and reward the client who sent you: performance of our contract with that client, and our legitimate interest in thanking them.
- To measure our ads on Google and Bing, for visitors outside the EEA, the UK and Switzerland: our legitimate interest in knowing which searches bring us customers. You can object at any time (see Cookies).
- To keep the service secure and to stop abuse of the free checks: our legitimate interest in protecting it.
- To record what AI assistants answer about a city and a line of work, and to publish those measurements: our legitimate interest in measuring a public market. The answers are about businesses.
We do not sell personal information for money. We run ads on Google and Bing and measure them with the tags described under Cookies. Some US state laws count that kind of tag as “sharing” or a “sale” of data. On our site, these tags are the only case. We do not profile anyone automatically in a way that has legal effects.
Who sees it
Service providers that process data on our instructions, each under a written contract. The full list, with a link to each one’s own terms, is on the subprocessors page:
- Stripe (payments), Vercel (hosting), Supabase (database), Google Workspace (our own email).
- OpenAI, Anthropic, Google and Perplexity: we send them the questions we ask about a city and a line of work, and, for your page, the business facts you asked us to publish. We never send them your account or billing data.
- Apify for reading public directories. Instantly for outbound email to businesses.
- Google and Microsoft, to measure our search ads, only for visitors outside the EEA, the UK and Switzerland (Google only after a click on one of our ads). Each may also use this data for its own purposes under its own privacy policy.
We may also disclose data when the law requires it. Pages we publish for you are public by design: that is the point of them. When we handle data on a client’s behalf rather than our own, the rules we follow are in our data processing agreement.
Where the data goes
Most of these providers are in the United States, so your data goes there. We rely on the European Commission’s adequacy decision for providers certified under the EU-US Data Privacy Framework, and on its standard contractual clauses for the others. Ask us and we will tell you which applies to which provider.
Google Business Profile data
If you connect your Google Business Profile, we read your listing (name, address, phone, hours, description, services, categories, rating and reviews) and write the updates you asked for. We use that data only to run the features you see in your account. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: we do not sell it, we do not use it for advertising, and no human reads it except with your permission, for support you asked for, or where the law requires it. You can disconnect the access at any time from your account or from your Google account settings, and we delete the tokens.
Cookies
One session cookie when you log in, so the app knows it is you. We count page views with Vercel Web Analytics. It sets no cookie and keeps no identifier that follows you from site to site. We see how many people opened a page, from which country and on what kind of device, but never who they are. When you open a report, we also note that it was opened that day, again without a cookie. A cookie that only keeps you logged in does not need a consent banner. The ad tags covered below do set cookies.
Google and Bing. We also advertise on Google and Bing. Google’s ads tag loads only on our free check page and our agency page, and only if you came to our site from one of our search ads. Microsoft’s UET tag loads on our public pages, but not on reports or on the pages we publish for clients. In your account, it loads only on the page you see right after a payment, to count that payment. Neither tag loads for visitors we locate in the European Economic Area (EEA), the UK or Switzerland.
Google’s tag sets cookies whose names start with _gcl, kept for up to 90 days. It tells Google that you came from one of our ads and whether you started a free report or signed up as an agency. Microsoft’s tag sets _uetsid for one day, _uetvid for up to 13 months, and _uetmsclkid for up to 90 days. It tells Microsoft which of our pages you open and whether you started a free report or signed up as an agency. If you pay, it also gets the amount. Both also receive your IP address and browser details, and may link the visit to your Google or Microsoft account if you’re signed in. We never send them your email address or phone number, not even in hashed form.
You can object at any time. These tags run in your browser, so blocking them there (with tracking protection or an ad blocker) is the way to stop them.
How long we keep it
- Account and billing data: while your account exists, then 30 days. Invoices for as long as tax law requires.
- Business contacts we emailed: three years after the last contact, or straight away if you ask.
- Technical logs: 90 days.
- Public business data and AI answers: as long as we publish measurements about that city.
Your rights
You can ask for a copy of your data, a correction, deletion, a limit on what we do with it, or a copy in a portable format. You can object to us emailing you, and to any use we base on our legitimate interest. Write to nick@foundbyname.com from the address on your account, or use the unsubscribe link in any email. We answer within 30 days, and usually much sooner.
If you think we handle your data badly, you can complain to the French data protection authority, the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris, or to the authority where you live.
Children
Our service is for businesses. We do not knowingly collect data from anyone under 18.
Changes
When this policy changes, the date at the top changes with it. For a change that matters to you, we email the address on your account.