Privacy Policy

1.1 Who we are

Founder's Dock is a compliance tracking and recruitment record-keeping service operated by Uplifting Together Limited, a company registered in England and Wales (company number 16684471), trading as Founder's Dock ('we', 'us'). Our registered office is 3rd Floor, 86-90 Paul Street, London, EC2A 4NE. You can contact us about privacy at info@myfoundersdock.com.

1.2 Our two roles

We act in two different roles, and your rights and our duties differ between them.

• As a controller, we decide how and why we use information about the people who sign up to Founder's Dock, such as account holders, invited team members and people who contact us. This is covered in this Privacy Policy.
• As a processor, we store and handle information that our customers put into their account, such as records about their staff, candidates, clients and contacts, and the documents they upload. The customer decides what is entered and why, so the customer is the controller for that information. We process it only on the customer's documented instructions under our Data Processing Agreement (see the Data Processing Agreement page at /dpa).

If you are a candidate or employee whose details were entered by a customer, please contact that customer first about your rights. We will help the customer respond.

1.3 What we collect and why

1.4 Sensitive information in your account

Customers may record things such as criminal record (DBS) checks, right-to-work documents, identity documents and health-related training or fitness information. This can include special category data and criminal offence data. We do not decide to collect it. The customer does, and the customer is responsible for having a lawful basis and any additional condition required by UK GDPR and the Data Protection Act 2018. We protect all uploaded documents the same way (see our Security overview in the Trust Centre) and we do not use them for any purpose of our own.

1.5 Where your data is stored

Our database runs on Lovable Cloud (built on Supabase and hosted on Amazon Web Services) in Europe (Stockholm, Sweden). Uploaded files are held in private storage areas on the same platform. The United Kingdom recognises the European Economic Area as providing adequate protection for personal data.

Some of our suppliers are based in, or may access data from, the United States (see our Sub-processors page at /sub-processors). Where that involves a transfer of personal data out of the UK or EEA, we rely on the UK International Data Transfer Addendum, standard contractual clauses or the UK-US data bridge, as applicable to each supplier.

1.6 Who we share data with

We use a small number of service providers (sub-processors) listed on our Sub-processors page (/sub-processors), each bound by a data processing contract. We do not sell personal data. We do not share it for advertising. We may disclose information if required by law or to protect our legal rights.

1.7 How long we keep it

There are no automatic time limits on customer content today. Records, documents and history stay in your account until you delete them or close your account. You control retention of your own records.

• Physical post received through the Business Address service is held for 30 days after scanning. Scans are kept until the account closes.
• Activity and audit history is kept for as long as the account exists so that changes can be traced.
• Deleted items are kept in a recovery bin for 30 days and then permanently removed.
• If you close your account, we delete your account records and login. We remove any remaining files (such as company logos, verification files and mail scans) within 30 days of your request.
• Some information is kept after closure where we must: payment records at Stripe, and emails already sent through Resend, for the periods those providers hold them; and accounting records as required by law (normally six years).

Our staff activity log may continue to hold entries that refer to a closed account for security and dispute purposes.

1.8 Security

A summary of our measures is in the Security overview in our Trust Centre. No online service can be completely secure, and we do not claim that it is.

1.9 Your rights

You have the right to access, correct, erase, restrict and port your personal data, to object to certain processing, and to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). To exercise a right in relation to information we hold as controller, email info@myfoundersdock.com. We aim to respond within one month.

Customers can view and delete records themselves in the product and can download a compliance summary as PDF and CSV. If you need a full copy of your data, contact us at info@myfoundersdock.com.

1.10 Cookies and tracking

We use only the cookies and browser storage needed to keep you signed in and remember your cookie choice. We do not run analytics or advertising trackers. See our Cookie Notice at /cookies.

1.11 Automated decisions and AI

Founder's Dock calculates green, amber and red readiness scores from rules based on the dates and documents recorded in your account. These are aids for your own judgement and do not make legal decisions about individuals. Some features, such as policy tailoring and form drafts, use an AI service provided through Lovable AI, which uses OpenAI models. When you use these features, the text of the policy section or the description you type for a form, and the business details you have entered in your profile, are sent to the service to produce a suggestion. We do not use AI to make decisions about you or your account. AI suggestions are drafts that you review and accept or reject. You can choose not to use these features.

1.12 Changes

We will post changes here and, for material changes, email account holders. Last updated: 12 October 2026.