Privacy Notice

Last updated: 2026-09-11.

Publication permission notice version: publication-permission-2026-09-11-v2. Earlier permission records retain the version originally shown to the provider.

Eduardo Neto, trading as FoundMyPro ("FoundMyPro", "we"), operates foundmypro.com, a directory of mobile service providers. This privacy notice applies to FoundMyPro during beta and public launch. This notice explains what personal data we process, why, and your rights.

Who we are

FoundMyPro is the trading name of Eduardo Neto, a sole trader based in England. Eduardo Neto is the controller for this processing. Correspondence address: Eduardo Neto / Found My Pro, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA. Contact: privacy@foundmypro.com.

What we process and why

1. Provider drafts prepared from public sources

We may prepare a private draft profile for a mobile service provider operating in a live region. Data: business name, trading name, publicly listed contact details (business email, phone, website), services offered, and coverage area. Source: the provider's own public website or an approved permission-first discovery of their public business social media page. We record the source URL and collection date for every draft. The draft stays private unless the provider gives an affirmative instruction to list it. Silence, an expired review link, a delivery failure, or an ambiguous response is not permission.

Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)). Our limited interest is assessing whether public business information belongs in the directory, preparing an accurate preview, and giving the provider control before publication. If the provider chooses to list the draft, we rely on their consent for publication until they claim the profile or withdraw that consent. Claimed and self-submitted profiles are then processed under the provider terms as necessary to provide the requested listing service.

What we deliberately do not do:

• We do not copy reviews, photos, or logos from other platforms.
• We do not publish personal (non-business) addresses.
• We do not publish any discovered profile without recorded provider permission.
• We do not publish profiles in regulated care categories without a claimed profile and completed safeguards.

2. Provider self-listing submissions

Data: business name, contact name, email, phone, profession, coverage, evidence link, description. Lawful basis: contract (taking steps at your request before listing you). Your email is used to verify the submission and to tell you the review outcome.

3. Register-interest submissions

Data: the place you typed, optionally your email and the service you were looking for. Lawful basis: consent. Used only to tell you when your region goes live; withdraw any time via the unsubscribe link.

4. Site analytics and email telemetry

To understand which services and areas are searched for and whether the site works, we record usage events (for example a search, or a visit to a profile review link) on our own servers. These events never store your IP address or browser details: both are replaced with keyed one-way codes, and the code linking events from the same visitor changes every day, so activity cannot be tracked across days. No third-party analytics service receives this data. Raw events are deleted after 13 months; only aggregate statistics are kept longer.

When we email a provider (a transparency notice about their draft profile, or emails they request such as claim verification), our email provider tells us whether the message was delivered, bounced, or reported as spam, so we can stop contacting addresses that do not want or cannot receive our mail. We do not use open-tracking pixels in these emails, and links in them are not routed through click-tracking redirects.

We use only the strictly necessary cookies described in the cookies and local storage section below.

Cookies and local storage

FoundMyPro currently uses only the following strictly necessary cookies:

• fmp_session - keeps a verified provider signed in so they can manage their listing; expires after 30 days.
• fmp_login_request - binds a requested provider sign-in link to the browser that requested it; expires after 15 minutes.
• fmp_review - keeps a provider's secure draft-review capability out of the page URL after the review link is opened; expires when that review link expires and is removed immediately after a keep-unlisted, delete, or never-contact choice.
• fmp_review_pending - supports the brief same-origin confirmation step used when an older review link is exchanged for a secure review session; expires after 5 minutes.
• fmp_listing_retry - temporarily retains the values and validation messages from an unsuccessful no-JavaScript self-listing form submission so the form can be shown again without retyping; expires after 2 minutes and is removed after a successful submission.

FoundMyPro does not currently use browser local storage.

We do not use advertising, affiliate tracking, tracking pixels, or third-party analytics cookies. We will not use non-essential cookies or similar storage unless a compliant consent mechanism is live first.

Sources, recipients and processors

For provider drafts created from public sources, the source categories are provider-owned public websites and public business social media pages used only in an approved permission-first workflow. We share profile data with site visitors and API users only after the provider asks us to list it. Our current service providers are Vercel for application hosting, Supabase for managed database services, Resend for transactional email, and Apify when an approved discovery workflow uses it. Each service receives only the data needed for its role. For AI-assisted categorisation, our selected service is OpenAI's API, which receives relevant business-page excerpts to propose professions and structured facts for validation. This use is separate from consumer ChatGPT, and starts only after the applicable API data-processing terms and transfer safeguards have been recorded. OpenAI does not use API content to train its models by default; we do not opt this workflow into training-data sharing. We request that responses are not stored as application history, but this does not eliminate provider-side processing or retention: standard API abuse-monitoring logs may retain content for up to 30 days, with longer retention in the circumstances described in OpenAI's data controls. OpenAI data controls: https://developers.openai.com/api/docs/guides/your-data An Apify Actor or another service that sends data to an additional party must pass a separate processor and data-flow review before use. We do not use a processor for provider data until its current data processing terms and any required international-transfer safeguards have been recorded in our processor approval register. We do not sell personal data.

Automated decision-making

We use automated tools to help collect, classify, and validate provider records, but they cannot grant publication permission. Publication requires the provider's affirmative choice and every applicable safety gate. Suppression, deletion, and regulated-category decisions remain subject to the documented safeguards and human review where required. We do not make solely automated decisions with legal or similarly significant effects.

Requests received by email

You can reply to our notice or contact privacy@foundmypro.com without opening a review link. We use your message, reply headers and the original recipient address to identify the relevant business and request. We also identify FoundMyPro requests sent to another monitored business address; this does not give us permission to apply the request to a different business or profile. When AI-assisted email interpretation is enabled, OpenAI's API receives only the relevant, minimised reply text to help identify the request. We exclude attachments and unnecessary quoted history, and mask contact details where they are not needed for interpretation. This reduces the personal data shared; it does not make the text anonymous or guarantee that every sensitive detail can be recognised automatically. We do not treat a sender address or a model's interpretation alone as permission to publish or change a profile. Routine requests may be handled automatically after identity and request checks. Where clarification is needed, we may send a secure confirmation link or ask for proportionate information before acting. We refer requests for human review when those checks cannot safely resolve them, including legal disputes and conflicting authority. We send service acknowledgements and outcomes where appropriate, not promotional follow-ups. A keep-unlisted, delete or never-contact choice does not trigger an automatic acknowledgement email; the secure page confirms the choice on screen.

Required or optional data

Self-listing and register-interest forms identify which fields are required. If required fields are not provided, we may not be able to process the submission or send the requested launch notification.

Your rights

You can request access, correction, deletion, or restriction, and you can object to processing based on legitimate interests. Providers can use the secure review controls to object, correct information, keep a business unlisted, or stop further contact. Choosing never to be contacted again also withdraws any earlier permission to list a discovered profile. On the secure review path, a never-contact or keep-unlisted choice removes any identity-matched live listing from public search immediately. Access, restriction, and erasure requests can be made at any time by emailing privacy@foundmypro.com; published-profile controls provide the additional options shown on that profile. Withdrawing publication consent is as easy as giving it and does not affect processing that was lawful before withdrawal. Suppression requests are honoured permanently: a suppressed provider is never re-published by our data collection. We respond within one calendar month. You can complain to the ICO (ico.org.uk) if you are unhappy with our answer.

Retention

See the data retention policy summary: a provider review link expires after 90 days, and its unanswered web review-queue copy is deleted 30 days later. An unapproved private discovery working draft is deleted no later than 12 months after its last evidence collection unless an active correction or legal obligation requires a documented exception. The private store is reviewed monthly, and unapproved drafts are removed once they reach 11 months after their last evidence collection so the 12-month maximum is never exceeded. Suppression records are kept indefinitely (that is what keeps you suppressed); register-interest records are deleted when the region launches or after 24 months, whichever is sooner. Feedback reply emails are removed once the report is resolved - no sooner than 30 days after submission, so a reply is always possible - and no later than 180 days after submission; the report text is kept without the address. Provider sign-in tokens and sessions are deleted within 7 days of expiry; provider account records are kept while the profile is listed. Undelivered transactional email records are encrypted and deleted within 30 days after delivery is abandoned; ambiguous delivery-audit rows keep a tombstone after the encrypted payload is cleared. Records of blocked profile edits (kept to review the block and handle appeals) are deleted after 90 days; abuse blacklist records are kept indefinitely to enforce the bar (legitimate interest, security). The web time-based removals (feedback emails, sign-in records, expired unanswered review-queue rows, raw analytics events, terminal mail payloads, the 24-month register-interest limit, and 90-day blocked-edit records) run automatically every day. The monthly private-draft review and launch-time register-interest deletion are controlled operational steps.

International transfers

Some processors or their sub-processors may handle personal data outside the UK. We use UK adequacy regulations where they apply. Otherwise, we use an approved safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with the required transfer assessment. Contact privacy@foundmypro.com for information about the safeguard relevant to your data.