Privacy Policy

Foundry is a private community platform for Imperial College London students and alumni interested in the startup ecosystem, operated under the name “Imperial Entrepreneurs”.

The data controller responsible for your personal data is IC Founders Ltd, a company limited by guarantee registered in England and Wales (company number 17171277), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. In this policy “we”, “us” and “our” mean IC Founders Ltd.

Questions about this policy or your data, including any request to exercise your rights, can be sent to contact@imperialentrepreneurs.com.

We collect only what we need to run a members’ directory and the features you use:

• Account data — your name and email address. If you sign in with Google, Google provides your name and email to us (see section 4).
• Profile data (onboarding) — the course you study or studied, your graduation year, an optional short bio and “what you’re working on”, optional LinkedIn / GitHub / portfolio links, and the sectors and skills you select.
• Membership status — whether you are a current student or alum, and your approval status, which our admins set during review.
• Content you post — the opportunities, events, and VC / grant listings you submit, including any contact email you choose to attach to a listing.
• Engagement data — anonymised-to-others counts of views and click-throughs on listings you posted, so you can see how your content performs.
• Technical and security data — your IP address and request metadata, used by our edge provider and rate limiter to prevent abuse, and limited error diagnostics (e.g. URL, browser, your user ID) if something goes wrong.

We do not collect special category data (such as health, ethnicity, or political opinions), and we do not ask for payment details — Foundry is free to use.

Under the UK GDPR we must have a lawful basis for each use of your data:

• Creating and running your account and verifying your eligibility — to provide the membership service you asked for (performance of a contract under our Terms), supported by your consent at sign-up.
• Showing your profile in the member directory — your consent. You can withdraw this at any time by editing your profile or deleting your account.
• Sending you service / transactional emails (sign-in and password reset, decisions on your application and listings, account and content notices, and replies when you contact us) — necessary to perform our contract with you and our legitimate interest in operating the platform.
• Keeping the platform secure (anti-bot challenges, rate limiting, abuse prevention) — our legitimate interest in protecting members and the service.
• Understanding how the product is used (cookieless, pseudonymous analytics) — our legitimate interest in improving Foundry. See our Cookie Policy.

We do not use your data for advertising, we do not sell it, and we do not carry out automated decision-making that produces legal or similarly significant effects about you.

If you choose to sign in with Google, Google shares your name, email address, and basic profile identifier with us so we can create or access your account. We only request this basic profile information and do not receive your Google password. Google’s handling of your data is governed by Google’s own privacy policy.

Your data is hosted in UK / EU regions. We use the following sub-processors, each under a data processing agreement and each receiving only the data needed for its role:

• Supabase (EU / London) — database, authentication, and storage. Holds your profile and the content you post.
• Vercel (EU / Frankfurt) — application hosting and serving.
• Resend (EU) — sending our service emails; processes the recipient address and message content in transit.
• Cloudflare (EU) — DNS, inbound contact-email routing, edge security, and the Turnstile anti-bot challenge on our forms. Processes request metadata such as your IP address to block abuse.
• Upstash (EU) — rate limiting. Stores only short-lived request counters keyed to your user ID or IP; no profile data.
• Sentry (EU) — error monitoring. May capture technical diagnostics when an error occurs; we do not send it form contents.
• PostHog (EU) — privacy-friendly, cookieless product analytics (which pages and features are used), tied to a pseudonymous user ID only.

We aim to keep your data within the UK and EU. Some of our providers are headquartered outside the UK / EU; where any transfer of personal data outside the UK takes place, it is protected by an appropriate safeguard recognised under UK law (such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses).

Your profile (name, course, graduation year, bio, what you’re working on, sectors, skills, and links) is visible to other approved Foundry members in the directory. Your email address is notdisplayed unless you explicitly choose to make a listing’s contact email visible. Our admins can see all profile data, including email addresses, for review and operational purposes. We do not make your data public on the open internet.

We keep your data while your account is active. When you delete your account (Settings → Delete account) we remove your profile and the content you posted from our live systems. Our admins also run a graduate-cleanup that removes current-student accounts whose graduation year has passed, with a notice giving you the option to reapply as an alum. Residual copies may persist briefly in encrypted backups before being overwritten on our providers’ normal backup cycle.

Access to your data is restricted by database row-level security, server-side authorisation checks, and least-privilege access controls. Data is encrypted in transit. We keep the platform patched and monitor for errors and abuse. No system is perfectly secure, but we take reasonable and proportionate measures appropriate to a community of this size.

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected — you can edit most of it yourself in your profile;
• have your data erased — use Settings → Delete account, or contact us;
• restrict or object to certain processing;
• data portability (receive your data in a portable format); and
• withdraw consent at any time, without affecting processing done before withdrawal.

To exercise any of these, email contact@imperialentrepreneurs.com or use the in-app contact form. We will respond within one month.

We use only strictly necessary cookies (for your sign-in session and security) and run our analytics cookielessly, so we do not show a cookie banner. Full details are in our Cookie Policy.

Foundry is intended for Imperial College London students and alumni and is not directed at children under 18. We do not knowingly collect data from anyone under 18.

We may update this policy from time to time. If we make a material change we will notify members by email at their registered address. The date at the top shows when it was last updated.

Contact us about your data at contact@imperialentrepreneurs.com. If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to resolve it with you first.