Controller and processor roles
For your own account and billing data, FounderReply is the data controller. For the personal data you process through the service — for example the comments, mentions and direct messages from your audience — you are the controller and FounderReply acts as your processor under a Data Processing Agreement.
Lawful basis
We process account data to perform our contract with you and on the basis of our legitimate interest in operating and securing the service. Personal data you process via the service is handled under your instructions and your own lawful basis, as set out in the DPA.
EU data residency
Application data — workspaces, personas, content plans, scheduled posts and OAuth tokens — is hosted in the EU. We do not transfer this data outside the EU/EEA except where a connected platform you authorise (Reddit, Instagram, Facebook, LinkedIn, X) is itself located abroad, which is inherent to using that platform, and for the AI processing described in the next clause, part of which runs in the United States under Standard Contractual Clauses or an equivalent safeguard.
AI drafting
Content generation, the processing of inbound audience messages and image generation run through our phi-cloud AI gateway, which sends each call to a model host in the region we request: text generation in the United States, images on its global pool, and embeddings and AI voice calls in the EU. Google’s Gemini API (United States) is used for web research with Google Search grounding, and for drafting only when phi-cloud is not configured. In every case your brand data and your audience’s personal data are not used to train third-party models, and processing remains under our DPA.
Sub-processors
We use a short list of sub-processors, all bound by data-processing terms:
| Sub-processor | Purpose |
|---|---|
| Supabase (EU region) | Application database, authentication and file storage for generated images. |
| Cloudflare | Application hosting (Workers), edge delivery, DDoS protection, rate limiting and media storage. |
| phi-cloud (AI gateway) | AI text generation (drafts, articles, personas, reviews), image generation, embeddings, and the speech and language models for AI voice calls. It routes each call to a model host in the region we request: text in the US, images on its global pool, embeddings and voice in the EU. |
| Google (Gemini API, PageSpeed Insights, Search Console; US) | Web research with Google Search grounding (topic and press research), AI drafting when phi-cloud is not configured, page-speed checks of public URLs, and search-performance data for a website you have verified in Search Console. |
| Monopea (agent runtime) | The multi-step agent behind the marketing-manager chat, campaign reviews and outreach drafting. |
| Monopea (website analytics; same operator) | First-party, cookieless website analytics (see Cookies in the privacy policy). Runs on Cloudflare’s global edge; the analytics data is kept in Cloudflare Analytics Engine for 90 days. |
| Browser-session provider | Runs the real browser sessions for networks you connect by signing in rather than by OAuth, and acts in them only as you instruct. |
| Prompt-injection classifier (self-hosted, Switzerland) | Scores drafts built from inbound messages or scraped pages for attempts to steer the agent, before they reach your approval queue or go out. |
| Resend (EU region) | Transactional and outreach email delivery, and inbound reply handling. |
| Stripe | Payments and VAT handling for paid plans. |
| Telnyx / Twilio (US) | Phone numbers and telephony for outbound voice outreach (only when you enable calling). |
| LiveKit | Real-time media transport for voice calls. |
| Fly.io | Hosting for the voice-call service and the agent runtime. |
| MarketPrior | Shared journalist directory used by Digital PR to find and verify press contacts. |
| MCPDial (AI phone agent) | The voice channel when you enable calling: phone numbers and their carrier verification, AI-agent calls, call recordings and transcripts, follow-up scheduling and calendar bookings. |
| CogniLead (cold email) | Lead sync with your own CogniLead account, only when you connect it: warm leads are imported, and opt-outs and erasure requests are passed back. |
| GitHub (US) | Our private issue tracker: bug reports and feature requests sent through the support and contact forms are copied there so they can be fixed. |
| IndexNow (api.indexnow.org) | Notifies search engines when a published page changes, so it is re-crawled sooner. |
| The platforms you connect (e.g. Reddit, X, LinkedIn, Meta, Bluesky, and blogs you syndicate to) | Publishing and engagement on your own accounts, at your direction. |
We notify customers of material changes to this list. Request the current sub-processor register, including the legal entity behind the browser-session provider, at admin@founderreply.com.
Data-subject rights
We support access, rectification, erasure, restriction, portability and objection. You can delete your data at any time via Data & Deletion, or contact us to exercise any right. Where we act as your processor, we assist you in responding to your own data subjects’ requests.
| Right | GDPR | How to exercise it |
|---|---|---|
| Access | Art. 15 | Request a copy of your data by email. |
| Rectification | Art. 16 | Correct account details in the dashboard, or ask us. |
| Erasure | Art. 17 | Self-serve — delete your account from Data & Deletion at any time. |
| Restriction | Art. 18 | Contact us to restrict processing. |
| Portability | Art. 20 | Request a machine-readable export by email. |
| Objection | Art. 21 | Contact us to object to processing. |
Write to admin@founderreply.com to exercise any of these rights.
Security
OAuth tokens are encrypted at rest, access is scoped per workspace with row-level security, and the service runs over TLS. See our Security page for detail.
Request a DPA
A Data Processing Agreement is available to all customers. Email admin@founderreply.com to request one, or read the DPA summary.