Privacy Policy

Controller: PAYET FABRICE

Address: 20 Allée des Flamboyants, 97429 Petite-Île, La Réunion, France

Email: contact@cofounderfit.com

SIREN: 798 679 296

We collect and process your data to:

• Create and manage your account (legal basis: contract performance)
• Conduct the psychometric test and calculate your profile (legal basis: explicit consent for sensitive data)
• Analyze compatibility with other users (legal basis: contract performance)
• Generate exportable reports (legal basis: contract performance)
• Send email invitations (legal basis: consent)
• Improve our services and algorithm (legal basis: legitimate interest)
• Anonymized usage statistics (legal basis: legitimate interest)
• Comply with our legal obligations (legal basis: legal obligation)

In accordance with the GDPR, personal data processing is based on the following legal bases:

• Consent: for sensitive psychometric data and sending invitations
• Contract performance: for the provision of the CofounderFit service
• Legitimate interest: for improving our services
• Legal obligation: for compliance with our accounting and tax obligations

Your personal data is processed by PAYET FABRICE and may be shared with the following technical service providers:

• Convex, Inc.: database and backend hosting (servers located in Europe for GDPR compliance)
• Vercel Inc.: web application hosting
• Google (Alphabet Inc.): OAuth authentication (if you use Google to log in)
• Resend: sending magic links and email invitations

We never sell your personal data to third parties.

Our technical service providers are primarily located in the United States. Data transfers outside the European Union are governed by:

• Standard contractual clauses approved by the European Commission
• Compliance with Privacy Shield principles for certain providers
• Hosting of sensitive data (psychometric profiles) in data centers located in Europe via Convex

• Account data: retained as long as your account is active
• Psychometric data: retained until you exercise your right to deletion
• Compatibility results: retained for 3 years after last activity
• Invitations: automatic expiration after 30 days
• Technical logs: retained for maximum 12 months

After deletion of your account, your data is permanently erased within 30 days, except for data we must retain to comply with our legal obligations (accounting, taxation).

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of your personal data
• Right of rectification: correct inaccurate or incomplete data
• Right to erasure (right to be forgotten): request deletion of your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to the processing of your data for legitimate reasons
• Right to restriction of processing: request restriction of processing in certain cases
• Right to withdraw consent: at any time for processing based on consent
• Right to define post-mortem directives: define the fate of your data after your death

To exercise your rights, contact us at: contact@cofounderfit.com

We commit to responding to your request within a maximum of 1 month. If your request is complex, this period may be extended by 2 months with justification.

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) if you believe that your rights are not being respected.

We implement appropriate technical and organizational measures to protect your personal data against:

• Accidental or unlawful destruction
• Accidental loss
• Unauthorized alteration, disclosure, or access

Security measures:

• Data encryption in transit (HTTPS/TLS)
• Secure authentication (OAuth 2.0, magic links)
• IP address hashing for anonymous views
• Strict data access controls
• Regular backups
• Hosting in SOC 2, ISO 27001 certified data centers