This policy explains how personal data is handled on fundmysaas.io, as articles 13 and 14 of the General Data Protection Regulation (GDPR) require. It applies to visitors, backers and founders.
1. Who is responsible
Sway SRL, Clos des Colombes 23, 1342 Limelette, Belgium, enterprise number BE 1037.531.992, is the controller of the personal data described in this policy. For any question about your data, or to exercise your rights, write to contact@fundmysaas.io. Sway has not appointed a data protection officer, as its activity does not require one; the same address reaches the person in charge.
Founders are controllers too
When you back a campaign, the founder who sells the reward receives the data needed to deliver it (section 4). From then on, the founder is an independent controller of that data, responsible for its own use of it under its own privacy policy. Our terms allow founders to use it for delivering the reward only: never to sell it, and never to market other products to you without your separate consent. News about the campaign's progress reaches you from the founder only if you ticked that box at checkout, which is never ticked for you; we send that news on the founder's behalf, and you can withdraw that consent at any time with the "Stop the news" button of My pledges, from the founder or by writing to us.
Stripe
Payments are processed by Stripe on the founder's Stripe account. Stripe handles your card data under its own privacy policy, as a processor for the founder and as an independent controller for its own legal duties (fraud prevention, anti-money-laundering, financial reporting). Sway never sees or stores your full card number.
2. The data we handle, why, and on which legal basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: name, email address, a hash of your password (never the password), your second factor if you set one up, the sign-in methods you linked (GitHub, LinkedIn or X: the account identifier, name, email address and picture they send us) | To create your account and let you sign in | Contract, art. 6(1)(b) |
| Pledges: the campaign and reward, the price, the status of the pledge, the dates of the pledge, charge, withdrawal or refund, the reference of the card Stripe saved, your choice to hide your name on the campaign | To make and manage your pledge, charge it when due, process withdrawals and refunds, and show it in My pledges | Contract, art. 6(1)(b) |
| Backer profile: your public name on campaigns (unless you hide it) and your backer grade, worked out from the amounts you pledged | To show who backs a campaign and to give perks | Contract, art. 6(1)(b) |
| Campaign news: your choice, made at checkout, to receive news about the campaign's progress from its founder, and when you made it | To let the founder send you that news | Consent, art. 6(1)(a) |
| Saved campaigns: the campaigns you saved with "Remind me", when you saved them, and which reminders we sent | To list them in Saved campaigns and email you 48 hours and 8 hours before each one ends, unless you back it | Contract, art. 6(1)(b) |
| Launch alerts: the email address you leave on a campaign shown as a preview, and whether you confirmed it | To email you once when the campaign opens for pledges | Consent, art. 6(1)(a) |
| Founders: the organization, the product, campaign content, the Stripe account identifier and its status, and the verification data Stripe collects (legal name, address, identity, tax and company numbers) | To run campaigns, verify sellers and show the verified seller | Contract, art. 6(1)(b); legal obligation, art. 6(1)(c) (trader traceability under the Digital Services Act, DAC7 tax reporting) |
| Fees and invoices: the fees Sway charged founders, its invoices and accounting records | To bill our fee and keep the accounts | Legal obligation, art. 6(1)(c) |
| Messages: what you write through the contact form or by email, including reports of content | To answer you and handle reports and complaints | Legitimate interest, art. 6(1)(f); legal obligation, art. 6(1)(c), for reports and complaints under the Digital Services Act and the P2B Regulation |
| Moderation decisions: what was decided about content or an account, why, and the statement sent | To keep the marketplace lawful and to account for our decisions | Legal obligation, art. 6(1)(c); legitimate interest, art. 6(1)(f) |
| Security: sessions, the browser used, the network address (stored shortened in the audit log), the audit log of actions in an organization, rate-limit counters, the bot check | To protect accounts and the service against fraud and abuse | Legitimate interest, art. 6(1)(f) |
| Abuse checks: when turned on, the details of a sign-up or of campaign text (address, email, browser, the text) are checked by our fraud and moderation provider; we keep its decision and reasons, not the content | To prevent fraud, spam and illegal campaigns | Legitimate interest, art. 6(1)(f) |
| Error reports: when something breaks, a technical report of the error, without passwords or card data | To fix the service | Legitimate interest, art. 6(1)(f) |
| Analytics: pages viewed and clicks, the steps of a pledge (the campaign and the amount) and a masked recording of the public pages, with a random identifier, linked to your account's internal id once you are signed in, never to your name or e-mail address, only if you accept analytics cookies | To understand how the site is used | Consent, art. 6(1)(a) |
Advertising measurement: only if you accept marketing cookies, and only if we run ads. On the pages anyone can read (the home page, the campaign board, the changelog, the legal texts and the page shown after you send the contact form), the Meta and X pixels tell each platform which page you viewed, from which address and browser, with the identifiers in their cookies (_fbp, _fbc, _twclid) and the ad click identifier in the page address if you came from an ad. When you send the contact form, the page shown afterwards tells them that a contact request was sent, never its content, your name or your email address. They do not run on the contact form itself, a campaign page, the page that reports content, the sign-in pages or the dashboard |
To measure which ads lead to a visit or a contact request, and for no other purpose | Consent, art. 6(1)(a). Meta and X decide for themselves how they use what their pixel collects, as joint or independent controllers: read Meta's and X's policies |
Our legitimate interests are keeping fundmysaas secure, fair and working, and answering the people who write to us. You can object to processing based on them (section 7).
What you must give us. An account needs an email address. A pledge needs a card. A campaign needs the founder's verification by Stripe. Without them we cannot provide that part of the service. Everything else is optional.
Automated decisions. We take no decision with legal or similarly significant effect about you by automated means alone. Automated tools may flag a sign-up or a campaign, but a person decides.
3. Where the data comes from
Mostly from you. Some comes from others: the sign-in provider you choose (GitHub, LinkedIn or X), Stripe (the status of a payment and of a founder's verification), the founder of a campaign you back (a refund they made), and people who report content.
4. Who receives it
Founders. When you back a campaign, the founder receives your name, your email address, the reward and the status of your pledge, so they can deliver the reward and serve your rights. They never receive your card details or your password.
The public. Campaign pages show the backers' names, unless a backer chose to hide it, and the founder's verified name.
Our processors, who handle data only on our instructions and under a data processing agreement:
| Processor | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage (EU jurisdiction), email delivery, the bot check (Turnstile), security | Worldwide network; the company is in the United States |
| Stripe Payments Europe, Limited | Payments, saved cards, payouts to founders, Sway's invoices | Ireland, with transfers to Stripe, Inc. in the United States |
| PostHog, Inc. | Product analytics, only with your consent, when analytics are turned on | European Union (Frankfurt) |
| Meta Platforms Ireland Ltd. | Advertising measurement with the Meta pixel, only with your consent, when the pixel is turned on | Ireland, with transfers to Meta Platforms, Inc. in the United States |
| X Corp. | Advertising measurement with the X pixel, only with your consent, when the pixel is turned on | United States |
Before we turn on a fraud and moderation provider or an error tracker, we add it to this list with where it processes data.
Authorities, when the law requires it (for example a court order, a tax authority or a request under the Digital Services Act), and our professional advisers bound by confidentiality.
A buyer, if Sway or fundmysaas is ever sold or merged; we would tell you beforehand.
We do not sell personal data, and we do not use it to train AI models.
5. Transfers outside the European Economic Area
Some processors are based in, or may access data from, the United States (Meta and X, for the advertising pixels you accept, may also transfer data outside the EEA under the safeguards in their own policies). Those transfers rely on the EU-US Data Privacy Framework where the company is certified (Cloudflare and Stripe are), and otherwise on the European Commission's standard contractual clauses of 2021. A founder established outside the EEA who receives backer data must protect it under the same clauses, which our terms impose on them. Write to us for a copy of the safeguards.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account | As long as it is open. After you close it, it is deleted within 30 days, except for what is listed below. |
| Pledges | As long as your account exists, to handle withdrawals, refunds and disputes. The record of a charge is kept up to 10 years where it supports an invoice or our accounts. |
| Saved campaigns | Until you remove the save or stop its reminders, or the campaign or your account is deleted. |
| Launch alerts | Until the campaign opens and we email you, or until you cancel. Not confirmed: 7 days. |
| Fees, invoices and accounting records | 10 years, as Belgian accounting and VAT law requires. |
| Founder verification and DAC7 data | As long as the founder is active, then 10 years, as tax law requires. |
| Messages and reports | In our mailbox and our report queue, 3 years after the matter is closed. |
| Moderation decisions | 5 years, to account for them and handle repeat abuse. |
| Sessions | Until you sign out, or 7 days without use. |
| Audit log of an organization | As long as the organization exists. |
| Abuse-check decisions | 90 days, or until a person settles an open review. |
| Checkouts not completed | 1 day. |
| Analytics | 13 months. |
| Advertising measurement | We keep nothing ourselves. Meta and X keep what their pixel sent under their own policies; the marketing cookies of this site are removed when you withdraw your choice. |
| Your cookie choice | 6 months, then we ask again. |
Backups follow the same deletions within 35 days.
7. Your rights
You have the right to access your data, to have it corrected, deleted or its use restricted, to receive it in a portable format, and to object to processing based on our legitimate interest. When processing relies on your consent, you can withdraw it at any time, without affecting what was done before.
Write to contact@fundmysaas.io from the address of your account. We may ask you to confirm your identity. We answer within one month; for complex requests, we may extend that by two months and tell you why. Exercising your rights is free.
For data a founder holds about you, you can also write to the founder directly. If you write to us, we pass your request on.
You also have the right to lodge a complaint with a data protection authority. In Belgium, that is the Data Protection Authority (Autorité de protection des données), rue de la Presse 35, 1000 Brussels, which takes complaints online at autoriteprotectiondonnees.be. You may also go to the authority of the EU country where you live or work.
8. Cookies
fundmysaas sets the cookies below without asking, because the site cannot work without them or because they keep a choice you made. Cookies for analytics and for advertising measurement are set only if you accept them, as described below.
| Name | What for | Lifetime |
|---|---|---|
__Secure-better-auth.session_token and related better-auth cookies |
Keep you signed in, and protect sign-in and two-factor steps | 7 days, renewed while you use the site; deleted when you sign out |
i18n_locale |
Remember the language you chose | Up to 1 year |
om-theme, admin-sidebar-mode |
Remember the theme and the sidebar layout you chose in your dashboard | 1 year |
om-cookie-choice (browser storage, not a cookie) |
Remember your cookie choice | 6 months |
The bot check on forms (Cloudflare Turnstile) runs in your browser to tell people from bots; Cloudflare handles that data under its own privacy policy.
Analytics cookies (PostHog, set by the site itself) are only set if you accept them in the cookie bar, and only when analytics are turned on. They measure the public pages, the sign-up page and, for founders, the campaign and payout pages of the dashboard (page views and a short list of steps, such as creating or submitting a campaign, never what you type). Only the public pages are recorded, with every field masked. The sign-in page, the keys, billing, team and operator screens are never measured. A visit from the team is marked and left out of the figures. They hold a random identifier for up to 1 year; once you are signed in, it is linked to your account's internal id (not your name or e-mail address). Rejecting them is as easy as accepting them, and the site works the same either way.
Marketing cookies (the Meta and X pixels) are only set if you accept them in the cookie bar, and only when we run ads. They are _fbp and _fbc for Meta and _twclid for X, written by the site's own pages, plus the cookies each platform sets on its own domain. They run on the public pages listed in section 2, never on the contact form, a campaign page, the page that reports content, the sign-in pages or the dashboard. Withdrawing marketing removes the marketing cookies of this site and reloads the page without the pixels; the cookies Meta and X set on their own domains are theirs, and your browser's settings clear them.
You can change your choice at any time with the Cookie preferences link at the bottom of every page; we ask again after 6 months.
9. Security
Data travels encrypted (HTTPS). Passwords are stored as hashes, sessions can be ended from your settings, and two-factor authentication is available. Access to production data is limited to the people who need it. If a breach puts your data at risk, we tell the authority within 72 hours and you without undue delay when the law requires it.
10. Children
fundmysaas is for people aged 18 and over. We do not knowingly collect data about children; if we learn that an account belongs to a minor, we close it and delete its data.
11. Changes
We may update this policy when the service or the law changes. We tell account holders by email at least 30 days before a material change takes effect. The date of the current version is at the top of this page.