Privacy and cookies
Last updated: 20 October 2026.
This page sets out what this site collects.
Who is responsible
Thibaut Vanderhofstadt, FounderOS, thibaut@founderos.eu. For any question about your data, write to that address directly.
Audience measurement
Audience measurement has one purpose: knowing which pages help founders. It runs through Google Analytics 4, loaded via Google Tag Manager.
By default, and for as long as you have accepted nothing, measurement happens without cookies (Consent Mode v2, every signal set to denied): pageviews and sessions are counted, but you are not recognised from one visit to the next and attribution stays coarse.
If you accept, only analytics_storage becomes granted. The
advertising signals (ad_storage, ad_user_data,
ad_personalization) stay denied even after you
accept: this site runs no advertising.
Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
fos_consent | Remembers your choice so you are not asked again. Strictly necessary: set whichever way you answer, including a refusal. | 6 months |
_ga, _ga_* | Google Analytics: distinguishing visitors. Set only if you accept. | up to 2 years |
The consent cookie is scoped to .founderos.eu so one choice
covers both the site and the application.
Changing your mind
Live session registration
If you register for a live session on the registration
page, your first name, email address, chosen session, ticked boxes and the page
you came from (utm_* parameters) are stored in a FounderOS Google
spreadsheet. They are used to send you the Google Calendar invitation, the
session link, the reminders and the recording. Upcoming events, only if you
ticked the box for it. Your two optional answers after registering are used to
prepare the session. If saving fails, your request is emailed (Resend) to
Thibaut so he can register you by hand. Nothing is sold or shared with a third
party, and none of it is sent to Google Analytics. Every email carries an
unsubscribe link; you can also write to
thibaut@founderos.eu. Registration
data is deleted at the latest 12 months after the session.
Testimonial video
The French homepage and Results page show a testimonial video hosted on YouTube. Same rule as for replays: its player (youtube-nocookie.com) loads only if you accepted cookies in the banner. Otherwise nothing comes from YouTube until you click « Regarder sur YouTube ».
Replay access
To unlock a replay, you give your first name, your work email and your phone
number. They are stored in the same Google spreadsheet as the live session
registrations and serve two purposes, written next to the box: sending you the
replay link, and a call from Thibaut. The video is hosted on YouTube. Its player
(youtube-nocookie.com) loads on the page only if you accepted cookies in the
banner, the same choice as for audience measurement; YouTube then sets its own
cookies. Otherwise the page offers to watch the video on YouTube, or to reopen
the banner and change your choice. So that you don't have to enter your details again, a
technical cookie fos_rp_<replay> (signed, with no personal data,
readable only by our server) remembers the access for 6 months; your browser also
keeps a local marker (fos_replay_<replay>, with no personal data) so it
knows to ask for it. The data is
deleted at the latest 12 months after registering.
Hosting
The site is hosted by Vercel. Like any web server, it logs requests (IP address, page requested, browser) for technical and security reasons.
The FounderOS Audit
The audit lives on app.founderos.eu, a separate application with its own account and its own data. What you enter there is not shared with this marketing site.
Bank data (connection via Enable Banking)
This part covers the FounderOS application (app.founderos.eu), and only
if you connect a bank account from its Cash module. This marketing site reads no
bank data.
Who does what
Data controller: MetSAAS, Avenue Guillaume Lefever 10, 1160 Auderghem, Belgium, enterprise number (BCE/KBO) 0727.721.615. Contact: thibaut@founderos.eu.
Connection provider: Enable Banking Oy (Espoo, Finland), an account information service provider under the EU Payment Services Directive (PSD2), supervised by the Finnish Financial Supervisory Authority (FIN-FSA). Enable Banking sends you to your bank, where you give your consent. FounderOS never sees your bank credentials. Enable Banking publishes its own terms and privacy policy on its website.
What is read
For each account you pick at your bank, read-only:
- the account identifier (IBAN), its name as your bank sends it, and its currency;
- the balance;
- booked transactions: date, amount, direction, counterparty name and account, payment reference.
No payment can be initiated. Access is limited to reading.
What is kept
- For each transaction: the date, the amount, the currency, a counterparty key
(a computed fingerprint, not a name), a suggested category and, when there is
one, the Belgian structured reference (
+++…+++). - The free-text payment reference is never kept: it is read only during the import, to suggest a category.
- Salaries are kept with no name and no counterparty key. The name of a private individual is never kept.
- The name of a counterparty that is an organisation (supplier, client, public body) is kept, so that you can file its payments.
- The balance, per day.
- For each account: the last four characters of the IBAN and the bank's name. The Enable Banking access session, which holds the account identifiers, is stored encrypted (AES-256-GCM).
Why
To track your cash (balance, coverage, low point, 13-week forecast) and file your receipts and spending in your FounderOS P&L. The balance also feeds the "Cash" indicator of your dashboard.
Legal basis: the performance of your contract with FounderOS (the service you ask for when you connect your account), and the explicit consent you give your bank.
How long, and how often
- Your consent lasts until the date set by your bank, at most 180 days. The application warns you 14 days before it ends.
- Your accounts are read at most four times a day.
- Transactions and balances are kept for a rolling 24 months: anything older is deleted at each new import.
- After your FounderOS account is closed: bank data is deleted within 30 days.
Who has access
- Enable Banking: the connection to your bank.
- Supabase: database hosting in the European Union (Ireland).
- Vercel: application hosting (Dublin region).
- Artificial intelligence: transactions are never sent to an AI model; they are filed by rules. Once it becomes the "Cash" indicator, the balance can be part of the context the Copilot sends to its model provider (Mammouth AI) when you ask it a question.
Your bank data is not sold and not used for advertising.
Stopping, deleting
You can withdraw your consent at your bank at any time: reading stops. To cut the connection from FounderOS, write to thibaut@founderos.eu. To have the bank data already kept deleted, write to thibaut@founderos.eu.
Your rights
You can request access to, correction or deletion of your data, or object to its processing, by writing to thibaut@founderos.eu. You may also lodge a complaint with the Belgian Data Protection Authority.