How we protect your information

What this page is

This page states, in specific terms, how Foody Finance protects the information you give us. Every claim here names the mechanism behind it. Where we cannot point to a mechanism, we do not make the claim.

What we collect and what we do not

We collect what a funding conversation requires: business details, contact information, the amount and use of funds you describe, and, if you opt in, text message consent. We do not collect information we have no use for, and we do not buy lists of personal information from a data broker.

How we protect it

Protection is built into how data is stored and moved, not added on afterward.

• Personal information is encrypted at rest, and the encryption keys rotate on a schedule rather than staying fixed indefinitely.
• Phone numbers are never stored in plaintext. We keep a one-way cryptographic hash of the full number plus the last 4 digits, which is enough to confirm a match without ever holding the number itself.
• Uploaded files sit in private storage behind links that expire, not in a public folder.
• Optional scripts, including analytics and advertising tags, load only after you grant consent for that category.
• A strict content security policy limits which scripts, styles, and origins the browser will run or connect to.

Who can access it

Access is limited by role and confirmed by more than a password.

• Only named roles, owner and operator, can reach personal information in our systems. There is no generic staff account.
• Sign-in requires Google authentication plus a second factor from an authenticator app.
• Sessions expire on their own; nobody stays signed in indefinitely.
• Every access and change is written to an action log that cannot be altered or deleted after the fact.

How long we keep it

We keep information only as long as the reason we collected it, or the law, requires. The schedule below is the same configuration our purge jobs read, so what is published here is what actually runs.

How consent is documented

When you agree to be contacted, we keep a record built to hold up later, not just a checkbox in a database.

• The page as you saw it, so the consent language you agreed to is not reconstructed after the fact.
• An image of the consent text and the checked box at the moment you submitted it.
• The timing of your interactions on that page.
• The version of the site and the consent language in effect at that moment.
• A tamper-evident chain linking each consent record to the one before it, so a record cannot be quietly edited or removed.
• A monthly write-once preservation copy that cannot be overwritten once it is made.

How to stop us

Visit the /stop page, reply STOP to any text message from us, or email our contact address. We honor a stop request within 10 business days, and we tell every funding partner that already received your information about the request.

How to get your records

Use /do-not-sell to opt out of a sale or sharing of your information, and /request-status to check where a request stands. We honor an opt out of sale or sharing within 15 business days, and we complete an access, correction, or deletion request within 45 days, with one 45 day extension when a request is complex and we tell you why.

Who else touches it

We work with named subprocessors under contract: Supabase, Lovable, Cloudflare, Resend, HighLevel, also called LeadConnector, Google, Meta, Microsoft, Semrush, Grants.gov, AI model providers. Every vendor listed here processes data on our instructions under a written contract. None of them may use visitor data to train general purpose models. We update this list as the stack changes. We keep an allowlist of the AI providers permitted to receive personal information. A provider is on it only when we hold business terms that prohibit training on the data we send. Today no personal information is sent to any AI provider: the models we use write educational content, and the code that could send personal data refuses to run against a provider that is not on the list. Funding partners you are introduced to are independent businesses, and each one is responsible for how it handles the information you give it directly.

If something goes wrong

If we discover a security incident, we investigate it, contain it, and notify affected people and regulators as the law requires. We welcome responsible disclosure from security researchers at our contact address, and we will not pursue a good-faith researcher who reports a vulnerability to us first and gives us a reasonable chance to fix it.

What we never do

Some lines do not move.

• We do not buy or sell lists from data brokers.
• We do not store phone numbers in plaintext.
• We do not let an AI provider train on your personal data.
• We do not share your information beyond the request you actually made.
• We do not present false credentials or fake affiliations.
• We do not manufacture urgency to rush a decision.

How we check ourselves

We run our own security tests quarterly, review who has access and rotate keys on the same quarterly cycle, and review this policy in full once a year. Every change we make to it is published at /policy-history.