Skip to content
Findingbase
Sign in or start

Privacy policy

Version of October 20, 2026.

This describes what the running service actually stores, written from its database schema rather than from a template.

1. Who is responsible

The controller of this data is Styvan Hauterville, trading as SHAU, a French entreprise individuelle registered under SIREN 107 173 320, RCS Fort-de-France, France, at 1 rue de la Tannerie, 97200 Fort-de-France, France. Contact: contact@findingbase.com.

The controller is established in France, so the EU General Data Protection Regulation (GDPR) applies to everything on this page, wherever you are. Because the controller is established in the European Union, no EU representative is required. No data protection officer has been appointed: the processing is neither large-scale nor systematic monitoring, and involves no special categories of data, so the GDPR does not require one. The contact above answers every privacy request.

2. What we collect from customers

Your account
Your email address, an optional name, and the time you last signed in. There is no password, because we never ask for one.
Sign-in and session security
The IP address that asked for a sign-in link, so that we can rate-limit abuse, and the browser user-agent string attached to a session. Sign-in links are stored as a hash, never in the clear, and are single use.
What you asked to watch
Your NAICS codes, states, minimum contract amount, the address alerts go to, how often you want them, and the look-ahead window. This is the whole product, so it is the whole of what we need.
Billing
A Stripe customer id, the subscription status, the plan and how many extra NAICS codes it carries, and when the current period ends. Card numbers never reach our servers: Stripe takes the payment and we hold only the reference.
Alerts you were sent
Which expiring contracts each digest contained and when it went out, so that the next digest does not repeat itself, plus a random token that makes the unsubscribe link in that email work without a login.

3. What we collect about businesses we contact

Findingbase writes to federal vendors who are not customers yet. Those details come from the public SAM.gov entity registration: business name, unique entity id, NAICS codes, state, and the point of contact the business itself published there. We also keep what happened next — sent, replied, bounced, unsubscribed — and, if you reply, the text of your reply and how it was classified. The AI disclosure explains that classification, including when a reply is sent to a third-party model provider.

Every such message carries a physical mailing address, a one-click unsubscribe link and a statement that it was prepared with software assistance, as US commercial email law requires. Unsubscribing adds the address to a suppression list, which we keep precisely so that we can never write to it again.

4. What we do not collect

  • No card or bank details. Stripe holds them; we hold a customer id.
  • No third-party analytics, advertising or social media scripts. This site loads none.
  • No tracking pixel in alert emails. The database has columns for open and click tracking and this build does not write to them.
  • No sale of personal data to anybody, for any purpose.
  • No special categories of data, and nothing about your bids or pricing.

5. Cookies

One cookie is needed to use the service: fbus_session. It holds a session reference, is marked HttpOnly and SameSite, is only sent to the pages of this product (under /us), and exists so that you stay signed in.

Your theme choice (light or dark) is kept in your browser’s local storage and never sent to us. There are no analytics or advertising cookies, so there is no consent banner to click through.

6. Why we are allowed to hold it

For customers: to perform the contract you signed up for (GDPR article 6(1)(b)), and to comply with French tax and accounting law, which requires invoices and the records behind them to be kept (article 6(1)(c)). For outreach to businesses: our legitimate interest in offering a relevant service to a registered federal vendor, using the professional contact that vendor chose to publish for that purpose (article 6(1)(f)), balanced by an unsubscribe that works in one click and a suppression list that is honoured for good.

US state privacy laws (California, Colorado, Connecticut, Virginia and the others) apply to businesses above revenue or volume thresholds that this service is far below. We do not rely on that: every right described in section 10 is open to anyone whose data we hold, wherever they live.

7. Who else sees it

The processors that handle personal data on our behalf, and where they do it:

  • Hosting: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. The application, its database and its mail server run on a virtual server in an OVH data center in France. No data leaves the European Union on this path.
  • Backup copy: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. One encrypted copy of the nightly database backup is stored on a second server there. It is encrypted before it leaves our server and the key never travels with it.
  • Payments: Stripe. Our contract is with Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe processes card data in the United States as well as in Europe, under its own privacy policy and the European Commission’s standard contractual clauses included in its data processing agreement.
  • Email: transactional mail, alerts and outreach are sent by our own mail server, on the same French host as the application. No third-party email service holds your address.
  • Reply classification: Anthropic, PBC, San Francisco, United States, and only for the text of a reply to our outreach email, as described in the AI disclosure. That transfer to the United States relies on the standard contractual clauses in Anthropic’s commercial data processing terms. Nothing about customers ever goes there.

We do not share your data with anyone else, and we do not sell it.

8. Where it is kept, and for how long

  • Everything is stored in France, in the OVH data center named above.
  • Sign-in links expire within minutes and can be used once.
  • Sessions expire 30 days after they are created, and sooner if you sign out.
  • Account, watch profile and alert history are kept while the account exists.
  • Deleting the account deletes the organization row, and the database cascades that to the watch profile, the subscription record, the alert history and the sessions immediately.
  • Backups: a database dump is taken every night and kept for 14 days on the server, and the encrypted off-site copy in Germany is kept for 30 days. A record you delete can therefore survive in a backup for at most 30 days, after which no copy of it exists anywhere. Backups are only ever restored whole, after a loss; we do not read individual records out of them.
  • Stripe keeps its own record of payments for as long as its own legal obligations require; that copy is outside our control. Our invoices and the accounting records behind them are kept for 10 years, as French commercial law requires.
  • Suppression entries are kept indefinitely, on purpose: forgetting that you unsubscribed would mean writing to you again.

9. How to delete your account

Sign in, open Watch profile, and use the delete panel at the bottom of that page: you type DELETE to confirm, and the organization and everything attached to it are removed. There is no undo and no soft delete, and we do not keep a shadow copy.

If you would rather we did it, write to contact@findingbase.com from the address on the account.

10. Your other rights and choices

  • Change what you watch, or the address alerts go to, at any time from your profile.
  • Unsubscribe from any email in one click, with no login.
  • Ask for a copy of what we hold about you, a correction, its deletion, a restriction of its use, or its transfer to you in a machine-readable form, and object to processing based on our legitimate interest, at the address above. We answer within one month, as the GDPR requires, and we do not charge for it.
  • If you think we have handled your data unlawfully you can complain to the French supervisory authority, the CNIL (3 place de Fontenoy, 75007 Paris, cnil.fr), or to the authority of the EU country where you live.

11. Children

This is a service for businesses that hold or bid on federal contracts. It is not directed at children and we do not knowingly collect anything from them.

12. Changes

If this policy changes materially we will email the address on the account before the change takes effect. The date at the top of this page is the date the current version took effect.