Privacy Notice
Updated: 13 August 2026 · Version 2026-08-13
1. Controller
The controller within the meaning of the GDPR is System Error MM GmbH, Lehrter Straße 49, 10557 Berlin, represented by its Managing Director Moses Mawila. Contact: contact@fundingos.app.
2. Scope and roles
This notice describes data processing on the public website, during registration and sign-in, in the FundingOS portal, for contact and advisory enquiries, and in connection with payment and subscriptions.
FundingOS is generally the controller for account, contract, contact and billing data. Where a business customer uses FundingOS to process personal data for its own projects or for organisations it supports, the Customer remains the controller and FundingOS processes that information under the separate Data Processing Agreement.
3. Hosting, delivery and logs
The production database and authentication run with Supabase in AWS eu-central-1 (Frankfurt). Vercel Functions are configured to run in fra1 (Frankfurt). Static content, connections and security functions are nevertheless delivered through Vercel’s global network. Vercel describes its primary processing facilities as being in the United States and may process data worldwide. FundingOS is therefore not an exclusively EU-hosted service.
When the website is accessed, hosting providers process technically necessary connection and log data, such as IP address, time, resource, referrer and browser information. The purposes are delivery, troubleshooting and protection against misuse. The legal basis is Art. 6(1)(f) GDPR. Retention depends on log type, plan, project settings and the applicable provider terms; we do not promise a fixed number of days that is not technically evidenced.
4. Registration, sign-in and user account
When you register, we process your email address, password, organisation name, B2B confirmation, the time and version of the contractual documents accepted, and any optional selection to receive updates. Supabase Auth does not store the password in plain text and sends the confirmation and recovery flows. The legal basis is Art. 6(1)(b) GDPR; security measures are based on Art. 6(1)(f) GDPR.
5. Protection against automated requests
Registration, sign-in, and the contact and advisory forms are protected by Cloudflare Turnstile. A widget runs in the browser, and our server sends the generated token together with the IP address to Cloudflare for verification. Cloudflare may process browser, device and connection characteristics. Depending on the Turnstile configuration, technically necessary storage mechanisms, including a cf_clearance cookie, may be used. We do not use Turnstile for advertising or to build our own marketing profile. The legal basis is Art. 6(1)(f) GDPR.
6. Contact and advice
When you submit a contact or advisory form, we process your name, email address, any optional organisation, the form category and source, and your message. The enquiry is stored in the FundingOS database. In addition, a notification containing the form content is sent to our contact inbox through our SMTP mail server on Hetzner infrastructure in Germany. The legal basis is Art. 6(1)(b) GDPR for pre-contractual enquiries and otherwise Art. 6(1)(f) GDPR.
7. Functional and system emails
FundingOS may send necessary account, security, contractual and billing messages. If deadline reminders or a weekly summary are enabled in the account settings, we process the email address and the programme, deadline, task and status data needed for those notifications. These notifications can be disabled in the settings. Application emails are sent through our own SMTP mail server; authentication messages are sent through the delivery service configured for Supabase Auth.
8. Payment and subscriptions
We use Stripe for plans that can be purchased directly. When Checkout or the customer portal is started, we send the email address, an internal user identifier, the plan and the billing interval. You enter billing, tax and payment details directly with Stripe. FundingOS stores Stripe customer and subscription identifiers and plan, status and term information, but not full card details. The legal basis is Art. 6(1)(b) GDPR; legally required records are processed under Art. 6(1)(c) GDPR.
For accounts outside North and South America, the Stripe DPA names Stripe Payments Europe, Limited as the contracting entity. Depending on the service, Stripe acts as a processor or as an independent controller and may transfer data to the United States and other countries. Further information is available in the Stripe DPA and the Stripe Privacy Notice.
9. Portal, matching and funding programmes
In the portal we process, in particular, profile, organisation, project, initiative, match, saved-list, deadline, task and draft data. The matching pipeline calculates fit scores from existing profile and programme data. Not every programme is evaluated through a separate language-model call. A stored match rationale is shown only when one exists for that match.
You may also store your own supporting documents in the document vault, such as a commercial register extract, articles of association, lease, bank details or—if a programme requires it—a copy of an identity document. We store these files in the FundingOS database in Frankfurt (see section 3) and use them solely to tick off the corresponding requirements for your applications and to make the evidence available to you again. The legal basis is Art. 6(1)(b) GDPR. The files are not sent to the language-model gateway, to funding bodies or to the recipients listed in section 12. You can replace or delete them in the portal at any time. Please store only documents actually required for your applications.
10. AI-generated initial drafts
AI-generated initial drafts are not created automatically for every programme. You start generation yourself for a selected match; the available allowance depends on your plan. The current production path uses Requesty Ltd. with a model from Mistral AI SAS. Requesty processes the prompt and response as a gateway and forwards the request to the selected model.
For a match you have selected, you may request English-language guidance on the programme and the match. You start this request yourself; it does not run automatically. We send the selected source-programme data, the saved match rationale, suggested approach and assessment score, and the profile slug through the same Requesty gateway. Files stored in the document vault are not sent for this guidance.
The result is cached against the existing match and removed when that match is deleted through the foreign-key cascade. Up to two generation attempts are allowed per match, source snapshot and generator version. In addition, a limit of 20 English-guidance generation attempts per user per UTC day applies; this daily limit applies only to this guidance feature, not to AI-generated initial drafts. Newly saved drafts store output-language metadata (output_locale); existing drafts are not backfilled.
The information sent includes the programme data selected for the draft, such as title, URL, type of funding, area, topics, target group, amount, deadline and eligibility information, as well as profile data such as name, legal form, organisation type, non-profit status, founding date, location, languages, areas of focus, segments and self-description. Where available, the match rationale and suggested approach are also sent. Do not enter special categories of personal data or unnecessary information about third parties in free-text fields.
Requesty states that its gateway infrastructure is in Frankfurt, that it does not store request or response text, and that Mistral inference is provided in the EU without provider-side retention. According to the current Requesty subprocessor list, content is not used for model training unless this is expressly enabled in project settings. The current API request does not transmit training permission; the account-level project setting was not independently verified in this audit. These statements describe the providers’ published terms. They are not a general guarantee of exclusively European processing or of the entire provider and support chain.
A FundingOS-specific executed Requesty DPA and evidence of the EU endpoint or EU router policy used in production have not yet been fully documented internally. Until that evidence is complete, unnecessary information about natural persons should not be used in AI free-text fields.
The legal basis is Art. 6(1)(b) GDPR. Where you, as Customer, enter data about third parties, the processing takes place under your documented instructions and the Data Processing Agreement. An initial draft is an editable working document and is not an automated decision producing legal effects.
11. Cookies and analytics
FundingOS uses technically necessary cookies and similar storage technologies for sign-in, sessions and security functions. The legal basis for access to the terminal equipment is § 25(2) no. 2 TDDDG. No proprietary analytics or marketing SDK is currently integrated into the application. Technical usage and log data processed by infrastructure providers are unaffected.
12. Recipients and transfers to third countries
- Supabase, Inc.: database and authentication in Frankfurt
- Vercel Inc.: hosting, Functions in Frankfurt and global delivery
- Cloudflare, Inc.: Turnstile and protection against misuse
- Hetzner Online GmbH: own server and mail infrastructure in Germany
- Stripe: payment, subscriptions and billing
- Requesty Ltd. and Mistral AI SAS: AI-generated initial drafts and English-language match guidance initiated by the user
EU regions do not automatically prevent every access from a third country. Where required, providers rely in particular on adequacy decisions, the EU-US Data Privacy Framework or EU Standard Contractual Clauses for transfers. Details of processing on behalf of customers and active subprocessors are available on the data processing agreement page (German original).
13. Retention and deletion
We generally retain account and content data for the duration of the user relationship. Valid deletion requests are currently handled case by case by an operator; self-service deletion in the portal is not available. The existing support tool does not yet cover every possible project, saved-list, contact, email, Stripe, log and backup relationship for an account. Data belonging to shared organisations may remain after a membership is removed if other authorised users still need it. Statutory retention and record-keeping obligations remain unaffected.
We retain contact and advisory enquiries for as long as necessary to handle them and any follow-up communication. Billing and tax records are retained for the statutory periods. AI outputs are stored in FundingOS as drafts until removed under the contract or deletion process. Specific deletion periods for provider logs and backups depend on the plan and configuration of the service concerned and are not yet fully documented in the operational register.
Files stored in the document vault are deleted with the account. The deletion tool removes them separately and before the organisation and profile data; you can also remove individual files yourself at any time.
14. Your rights
Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent with effect for the future. Where processing is carried out on a Customer’s behalf, that Customer may be your first point of contact; we will support the Customer in handling your request.
You may lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for FundingOS is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI). Send enquiries to contact@fundingos.app.
15. Changes
We update this notice when functions, providers or the law change. The controlling version is the dated version published here.