Privacy policy

Who we are

Legal name

SOFTWEEN YAZILIM LİMİTED ŞİRKETİ

MERSIS number

0772146927900001

Tax ID

7721469279

Address

Ankara Cad. Yenişehir, 360 Office No:405 Kat:2 Ofis:17, 34912 Pendik / İstanbul, Türkiye

Email

support@getfund.space

1. What we collect

• Account: your email address.
• Sign-in: one-time codes, stored only as a hash, and a session token in a secure cookie, also stored only as a hash.
• Startup profile: your idea description, website, stage, company status and country, the country you are based in, sectors, team size, goals, funding goal, languages and any founder tracks you choose to see (for example student or female founder programs). These track answers are optional.
• Documents: the files you keep in My documents (PDF, PNG or JPEG, up to 10 MB each and 20 per startup), such as your deck, one-pager, financial statements, company registry papers, Findeks credit report or CV, stored in our file storage. For a deck, one-pager, financial statements and registry papers, our AI providers read the text, with ID numbers masked first, to suggest facts for you to confirm. A Findeks report, a CV and other files are only stored: no AI model reads them. getfund passes a file on only for an application you are working on: when you press "Attach files" in the browser extension, in a hosted apply run you start, or as a download link that works for 5 minutes, given to the AI agent you connected to getfund when it asks for the file.
• Browser extension: an access token you create to connect it, stored only as a hash. When you open the extension on a page, it sends that page's address to getfund to find your application for it. When you press "Fill this form", it reads the questions of the form on that page (labels, field types, options and length limits, never what is typed into the fields) and sends them to getfund to match your confirmed answers. When you press "Attach files", it downloads the matching files from My documents and puts them into the form's file fields; it never submits the form. After you submit, it keeps the site's own confirmation text (up to 1,000 characters) and that page's address, without its query string, as the record of your application. It reads nothing on pages where you did not use it and sends nothing to anyone but getfund.
• Hosted apply: if you apply through getfund's browser, the screenshots, the confirmation page and the step list of each run, and Cloudflare's recording of its browser session (section 15).
• Your activity: matches shown to you, items you save, tracker statuses and notes, and reminders.
• Billing: your plan, subscription status and the customer and subscription identifiers Paddle gives us. We never see or store your card details.
• Technical data: IP address, browser details and request times, used for security, rate limits and bot protection.
• Product analytics: pseudonymous events such as which pages and steps you used, collected without cookies or browser storage until you accept in the cookie banner and with page addresses stripped of search text, unless your browser sends Do Not Track or Global Privacy Control. When you are signed in, these events are tied to your account. With your consent, PostHog's cookies and a sampled recording of app sessions with every form field masked are added.
• Signup source: where you first came from when you created your account: a link's campaign tags (utm_source, utm_medium, utm_campaign), its ref, the referring site's domain, the first page you opened and, when you came from a Google ad, the ad click identifier Google adds to the link (gclid, gbraid or wbraid). Stored with your account and used only to know which channels bring founders; the ad click identifier is also sent back to Google Ads, only to measure which ads lead to sign-ups and paid plans, and is not used to identify you anywhere else.
• Competitor research: for the competitors you track, getfund collects publicly available information about those companies (public app store and review site reviews without reviewer names, public ad library entries, public pricing pages, press coverage of funding rounds, and public traffic estimates). It is about companies, not about you, and is shared across founders who track the same company.

2. Why we use it and on what legal basis

• To create your account, build your profile, match and rank opportunities, write explanations and send sign-in codes and reminders: performance of our contract with you (KVKK Article 5(2)(c), GDPR Article 6(1)(b)).
• To bill your plan and keep financial records: contract and legal obligation (KVKK Article 5(2)(c) and (ç), GDPR Article 6(1)(b) and (c)).
• To keep the service secure and prevent abuse: our legitimate interest (KVKK Article 5(2)(f), GDPR Article 6(1)(f)).
• To understand which parts of the product help founders: our legitimate interest, and consent where the law requires it.
• Optional founder tracks can reveal sensitive information about you. We use them only to find programs meant for those founders, and only because you chose to give them; you can remove them at any time.

3. What we never do

• We never sell your personal data.
• We never share your idea or profile with programs, investors or other founders.
• We never use what you write to train AI models, and our AI providers process it under terms that do not allow them to train on it.
• We never list personal contact details of investors or other people.

4. Who processes data for us

These providers process personal data on our instructions, only for the purposes below:

5. International transfers

Some providers above store or process data outside Türkiye and the European Economic Area. For these transfers we rely on the safeguards the law provides, such as standard contracts under Article 9 of the KVKK and, for data covered by the GDPR, the European Commission's standard contractual clauses or adequacy decisions.

6. How long we keep it

• Account, profiles, saved items and notes: while your account exists. After you ask us to delete your account we delete or anonymise them within 30 days.
• One-time sign-in codes and the log entry of the email that sent each one: deleted within two days after they are created.
• Sessions: expire after 30 days without use.
• Billing and subscription records: Paddle, our merchant of record, keeps invoices and tax records under its own legal obligations. Our own copy (plan, status and Paddle ids) is kept while your account exists and deleted with it; the details of each payment notification Paddle sends us are emptied after 90 days.
• Security logs and analytics events: only as long as needed for their purpose. When you delete your account, your analytics events are deleted with it. Session recordings made with your consent are deleted after 30 days, PostHog's cookie expires after 1 year, and your cookie choice is kept until you change it; after 12 months we ask again.
• Documents you upload and the facts, drafts and answers built from them: while the document, the startup or your account exists, whichever ends first.
• Extension tokens: kept as a hash until you revoke them or delete your account.
• Form questions the extension reads and the confirmation text kept as proof: while the application, the startup or your account exists, whichever ends first.
• Hosted apply: step screenshots and the confirmation page screenshot are deleted 90 days after they are taken, or with your account if you delete it first. Cloudflare deletes the recording of the browser session after 30 days. The step list is kept while the application, the startup or your account exists, whichever ends first.

7. Security

We use encrypted connections, store sign-in codes, session tokens and browser extension tokens only as hashes, limit who can access production data and restrict each account's data to that account.

8. Your rights

You can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw a consent you gave. Under KVKK Article 11 you also have the rights listed in our KVKK notice. Write to support@getfund.space from the email address on your account; we answer within 30 days and free of charge. You can also complain to the Turkish Personal Data Protection Authority or, in the EU, to your local data protection authority.

9. Children

getfund is for adults. We do not knowingly collect data from anyone under 18.

10. Changes and contact

If we change this policy in a way that matters, we tell you on the site or by email before the change applies. Questions: support@getfund.space.

11. Gmail data

This section applies only if you connect a Gmail account to getfund. Connecting is optional and happens only when you choose it.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. The policy is at https://developers.google.com/workspace/gmail/api/policy

• What we read: only mails in the connected Gmail account that match a search for application result words in English and Turkish, such as accepted, rejected, interview and application received. On first connect we look back 180 days, and after that once a day we look at new mails. For each matching mail we read the sender, the subject, the date and Gmail's short preview of the message (the snippet). We never fetch mail bodies or attachments.
• Why we read it: to detect whether a program you applied to has accepted you, rejected you, invited you to an interview or confirmed that it received your application, and to update your getfund application tracker and stats, or to suggest the update for you to confirm.
• How it is processed: the sender, subject and snippet of a matching mail are sent to Google Vertex AI (Gemini) under getfund's own Google Cloud account, only to classify the mail. We do not use this data to train models or for advertising, and we never sell or share it.
• What we store: the Gmail message id, the date, the sender's domain, a guess of the program name, the result class and its confidence, the application it was matched to, and your Gmail refresh token, which is stored encrypted. We do not store the subject, the snippet, the body or attachments.
• How long we keep it and how you control it: until you disconnect Gmail or delete your account. Disconnecting in getfund revokes our access at Google and deletes all stored mail data immediately. You can also revoke access yourself at https://myaccount.google.com/permissions

12. Sign in with Google

This section applies only if you choose Sign in with Google, an alternative to the email code. You can use either one.

Google processes your sign-in under its own privacy policy, which is separate from this one. The policy is at https://policies.google.com/privacy

• What we receive: your name, your email address and your Google account identifier. We ask only for the basic profile and email scopes. Signing in gives getfund no access to your Gmail, Drive, contacts or any other Google data.
• Why we use it: only to create and authenticate your getfund account. If a getfund account with the same verified email address already exists, signing in with Google opens that same account.
• Gmail stays separate: the Gmail application results feature (gmail.readonly) is a different, optional connection that you choose on its own, and it is described in section 11. Signing in with Google does not connect Gmail.

13. Sign in with LinkedIn

This section applies only if you choose Sign in with LinkedIn, an alternative to the email code. You can use either one.

LinkedIn processes your sign-in under its own privacy policy, which is separate from this one. The policy is at https://www.linkedin.com/legal/privacy-policy

• What we receive: your name, your email address (and whether LinkedIn has verified it) and your LinkedIn member identifier. We ask only for the openid, profile and email scopes. Signing in gives getfund no access to your LinkedIn connections, messages, posts or anything else on LinkedIn, and getfund never posts on your behalf.
• Why we use it: only to create and authenticate your getfund account. If a getfund account with the same verified email address already exists, signing in with LinkedIn opens that same account.

14. Password (optional)

This section applies only if you choose to set a password. Setting one is optional; signing in with an email code or with Google keeps working without one.

• What we store: if you set a password, getfund never stores the password itself. We store only a one-way hash, made with a random salt and a server-side secret. The hash cannot be turned back into your password.
• Breach check: when you set a new password, we check whether it has appeared in a known data breach. We send only the first 5 characters of the SHA-1 hash of the password to the Have I Been Pwned service (k-anonymity). The password and the full hash never leave getfund.
• Why we use it: only to authenticate your account and keep it secure.
• Retention: the hash is deleted when you remove your password or delete your account.

15. Applying through getfund's browser (hosted apply)

This section applies only if you use hosted apply, a feature of the Autopilot plan, and only to the runs you start. When you start a run, getfund opens a remote browser on your behalf, goes to the program's application form and fills it with the answers and documents you confirmed. You remain the applicant: getfund submits a form only after you approve it in getfund.

• Where the browser runs: the remote browser is Cloudflare Browser Run, operated by Cloudflare, Inc. on its global network. Cloudflare does not let us choose a region for it, so a run can take place outside Türkiye and the European Economic Area. Each run uses a new browser session that ends with the run; we do not keep the browser's cookies or sign-ins for another run.
• What the browser receives: the program's application address, the answers and documents (for example your deck) you confirmed for that application, and what you type yourself in the live view.
• What you type yourself: when a site asks you to sign in or enter an emailed code, getfund pauses and hands control to you in the live view. getfund never stores or types your passwords for other sites; what you type goes to the site through the remote browser.
• CAPTCHAs: when a CAPTCHA stands in front of a form, getfund may have it solved by 2Captcha, a CAPTCHA-solving service run by ALTWEB LLC FZ in the United Arab Emirates. 2Captcha receives only the address of the page the CAPTCHA is on (without its query parameters) and the CAPTCHA's own settings from that page, such as its public site key; it receives none of your answers or documents and nothing else about you. If getfund does not solve a CAPTCHA this way, it pauses and hands it to you in the live view.
• What we keep: a screenshot of each step of the run, a screenshot and the text of the site's confirmation page as the record of your application, and the list of steps (what happened and when). A payment page ends the run and is never captured, and getfund never enters card details.
• Session recording: Cloudflare records the browser session of each run. Values in form fields are masked in the recording; the rest of what the pages show is recorded. Cloudflare keeps the recording for 30 days. We use it only for support and to investigate errors, only getfund administrators can open it, and it is not shown in your account.
• Live view: you watch the run inside getfund. Each live view link is made for you (or, for support, for a getfund administrator) and expires shortly after it is made.
• AI help: when the form cannot be filled directly (for example a form spread over several pages or a start screen), an AI model (Claude, by Anthropic) reads the structure and text of the page to choose the next step. This can include answers already filled in on that page.
• Why we use it and on what legal basis: to fill and, after your approval, submit the application you asked getfund to make for you: performance of our contract with you (KVKK Article 5(2)(c), GDPR Article 6(1)(b)).
• Who receives your application: the program you apply to receives what you submit, as with any application you send yourself, and its own privacy policy applies to it.
• How long we keep it: the step screenshots and the confirmation page screenshot are deleted 90 days after they are taken, or with your account if you delete it first; after that the step list shows the screenshot as expired. The step list and the confirmation text are kept while the application, the startup or your account exists, whichever ends first. Cloudflare deletes the session recording after 30 days.