Cookie Policy · GetFoundi

What cookies are

A cookie is a small text file placed on your device when you visit a website. Cookies allow a website to recognise your device, remember your preferences, and understand how you use the site. Similar technologies include web beacons (tiny invisible images), local storage, and session storage. This policy covers all of these technologies collectively ("cookies").

Cookies are set either by us (first-party cookies) or by third-party services we use (third-party cookies).

Legal basis for using cookies

Under EU Directive 2002/58/EC (the ePrivacy Directive) as implemented in Belgian law, and under GDPR (EU Regulation 2016/679):

Strictly necessary cookies do not require your consent because they are essential to provide the service you have requested. We have a legitimate interest in keeping the service functional and secure — Art. 6(1)(f) GDPR.
All other cookies require your freely given, specific, informed, and unambiguous consent before they are placed — Art. 6(1)(a) GDPR. You may withdraw consent at any time without detriment.

We do not use dark patterns to nudge you towards accepting optional cookies. The "Accept all" and "Manage preferences" options are equally accessible in our cookie banner.

Cookies we use

3.1 Strictly necessary cookies

These cookies are required for the service to function. They cannot be disabled without breaking core functionality. No consent is required.

Cookie name	Set by	Purpose	Duration
`sb-access-token`	GetFoundi (Supabase)	Authenticates your session after sign-in	Up to 1 hour (refreshed automatically)
`sb-refresh-token`	GetFoundi (Supabase)	Allows silent renewal of your access token without re-signing in	Up to 1 year (reset on activity)
`gf_consent`	GetFoundi	Stores your cookie consent preferences so we do not re-prompt on every visit	1 year
`__Host-next-auth.*`	GetFoundi (Next.js)	CSRF protection tokens used to secure form submissions	Session

Note on authentication cookies: Our sign-in uses a magic-link (passwordless) flow. The authentication cookies above are set only after you click your sign-in link. They are HTTP-only, Secure-flagged, and SameSite-strict where technically possible.

3.2 Analytics cookies

These cookies are only placed with your consent. They help us understand how users navigate the platform so we can improve it. We do not use third-party advertising analytics (e.g. Google Analytics is not used on getfoundi.com).

Cookie name	Set by	Purpose	Duration
`gf_analytics_session`	GetFoundi	Tracks anonymous session events (pages visited, feature interactions) within a single visit	Session (browser close)
`gf_uid`	GetFoundi	Pseudonymous identifier linking sessions over time so we can measure funnel completion (e.g. signup to first listing)	1 year

Analytics events are stored in our own database, not sent to third-party advertising networks. No cross-site tracking occurs. Event data is aggregated and pseudonymised for reporting.

3.3 Functional cookies

These cookies enhance your experience by remembering choices you have made. They are only placed with your consent.

Cookie name	Set by	Purpose	Duration
`gf_ui_prefs`	GetFoundi	Remembers optional UI preferences (e.g. dismissed banners)	6 months
`gf_chat_guest`	GetFoundi	Maintains a guest chat session on `/chat` so that conversation context is preserved across page loads before you sign in. May be merged into your account on sign-up.	Session (browser close)

3.4 Marketing cookies

GetFoundi does not currently use third-party marketing or advertising cookies, retargeting pixels, or ad-network trackers. This category is reserved; if we introduce marketing cookies in the future we will update this policy and seek fresh consent before placing them.

3.5 Third-party cookies set on specific pages

Some pages embed content or integrations from third parties. When present, these third parties may set their own cookies:

Third party	Pages affected	Purpose	Their privacy policy
Stripe	Checkout / billing pages	Fraud detection and payment security	stripe.com/privacy

We have no access to, and no control over, Stripe's cookies. They are subject to Stripe's own privacy and cookie policies. Stripe cookies are only loaded when you visit the billing or checkout pages.

Local storage and session storage

In addition to cookies, we use browser local storage and session storage to improve performance:

Key	Storage type	Purpose	Cleared
`gf_draft_listing`	Session storage	Temporarily saves unsaved listing draft form data to prevent data loss on accidental navigation	On tab/window close
`gf_banner_dismissed`	Local storage	Remembers that you have dismissed a notification banner	After banner expires (varies)

Local and session storage are not transmitted to our servers and are not used for tracking.

How we obtain consent

On your first visit to getfoundi.com, we display a cookie consent banner. The banner:

Clearly identifies the categories of optional cookies we use.
Provides an "Accept all" button and a "Manage preferences" link with equal visual prominence.
Does not pre-tick optional cookie categories.
Does not set optional cookies before you have made a choice.

Your choices are stored in the `gf_consent` cookie (listed above) and, when you are signed in, also in your account record so that your preference persists across devices.

5.1 Changing or withdrawing consent

You may change or withdraw your cookie consent at any time:

In the platform: Account → Privacy & legal → Cookie preferences.
In your browser: You can delete or block cookies through your browser settings. Note that blocking strictly necessary cookies will prevent sign-in and core service functions.
Browser opt-out tools: You may also use browser-level privacy settings or browser extensions to manage cookies across all websites.

Withdrawing consent does not affect the lawfulness of any processing that took place before withdrawal.

5.2 Do Not Track

GetFoundi does not currently respond to browser Do Not Track (DNT) signals in a standardised way because there is no legally recognised mechanism in Belgian or EU law at this time. Our cookie controls (above) provide the equivalent functionality.

Cookies and personal data

Some of the cookies and storage items described above may constitute personal data under GDPR (in particular, any identifier that can be linked back to you). Where that is the case:

The legal bases for processing are as stated in Section 2.
Your rights under GDPR (access, rectification, erasure, portability, objection) apply — see our Privacy Policy, Section 10.
Data linked to analytics cookies is retained in pseudonymous form for up to 1 year before aggregation or deletion.

For full details of how we process personal data, see our Privacy Policy.

Cookie retention periods

The retention periods in Section 3 reflect the maximum duration. Cookies are cleared earlier if you:

Sign out (authentication cookies are invalidated and cleared).
Clear cookies in your browser.
Delete your account (all server-side data linked to your session is deleted in accordance with our Privacy Policy).
Withdraw analytics consent (analytics cookies are removed within the current page session).

Changes to this policy

We will notify you of material changes to this Cookie Policy by updating the version date above and, for signed-in users, through a notification in the platform. We will seek fresh consent if we introduce new categories of optional cookies.

Contact and complaints

For questions about our use of cookies:

Email: privacy@getfoundi.com

Postal: Lyne Systems & Consultancy (LSC), Groeneweg 17, 9320 Aalst, Belgium

If you believe we have placed cookies in violation of applicable law, you have the right to lodge a complaint with the Belgian supervisory authority:

Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA)

Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium

+32 2 274 48 00

www.autoriteprotectiondonnees.be

What changed in this version