Privacy

Draft for review. This has not been checked by a lawyer yet. Items in [square brackets] need filling in before the site is used by the public.

Open2Build helps people with an idea find the people to build it with. This page explains, in plain English, what we collect, why, and what you can do about it. Open2Build is run by [COMPANY NAME], [ADDRESS]. You can contact us at [CONTACT EMAIL].

What we collect

• Your email address, so you can sign in and so people you agree to talk to can reach you.
• If you sign in with LinkedIn or Google: your name, your email address and an account number from them, so we know it is you next time. We never see your password there, and we do not get your contacts, posts or anything else.
• Your Open2 profile, if you create one: your name, where you are based and your country, what you are Open2, skills, industries, past employers, time available, terms, what you're looking for, your startup experience, any short answers you write about yourself, who you'd like to work with, and anything else you choose to add, including your photo and, if you upload one, a banner picture. Both are seen where your profile is. If you change your photo's background, that happens on your own device: the photo is only sent to us when you save it. If you upload a CV to fill in your profile, we don't keep the file or its text. We keep only the skill and industry words it names, to offer them back to you as suggestions on your profile; they are included when you download your data and deleted with your account.
• Ideas you describe, and the analysis and team blueprint we create from them.
• Replies you send to a project page, including any details about a person you offer to introduce.
• If a founder invites you to join their team for a role: the name and email address they gave us, the role, their note and whether you accepted. We use your email only to send that invitation. If you accept, your name shows on the role and you join the project's team space. If you decline or never answer, we keep the record so the founder can see what happened; it is deleted with the project.
• If you are a founder and note someone you contacted on LinkedIn about a role: the name and profile link you typed, so you can invite them later. Only you see it, and it is deleted with the project. We never collect anything from LinkedIn or send anything there.
• Recommendations you write about other members, and ones they write about you, with how you know each other.
• What you share in the feed: your posts and any photos in them, comments, likes, who you follow, and any project you add to a post. When you react to or comment on a post, people who follow you or are connected with you may see a line such as "Priya likes this" above it. If you report something, we keep your report and the reason you gave.
• Connections: who you asked to connect with, who asked you, any note sent with the request, and the answer. If you say no, the person who asked is not told. People you block, so they can't contact you.
• Messages you send and receive in chats on Open2Build, the emoji reactions people add to them, and when you last read each chat. If you start a video call from a chat, we post “started a video call” in it. Calls run on a free Jitsi room under Jitsi's own privacy terms; we never record or see them. When you delete your account, the messages you sent are deleted; the other person keeps their own.
• Coffee: whether you are open to a coffee, the words you add about what you're happy to talk about and how you like to meet, and coffee requests you send or receive with their notes and answers. If you say no, the person who asked is not told.
• Spaces you start or join: your level in each (owner, admin, contributor or reader), and what you add there, such as things to do, ideas, notes and meetings in the calendar, and whether you said you are going to a meeting. Only members of that space see them. Your replies to meetings are deleted with your account; meetings you added stay for the rest of the group. If you ask to join an interest group, its admins see your name and profile so they can say yes or no; the request is deleted with your account. An interest group whose admins let anyone find it shows its name, its About and how many members it has to signed-in members; everything else stays for its members.
• If you ask to join a Circle: the kind of work you do, your career stage, the times and time zone that suit you, and anything you add. Only the Open2Build team sees these, to form the groups. In a Circle, members see each other's weekly check-ins (what you plan to do and how it went). Your request and check-ins are deleted with your account. When you open a space's call, we count that a call was opened, not who was in it or what was said. Calls run on the video service the space uses (a free Jitsi room, or a link the space chose), under that service's own privacy terms.
• If you accept a project's confidentiality agreement: your name, email, the project, when you accepted, and the exact wording you accepted. We keep this record even if you later delete your account, because the founder may need to rely on it. It is deleted if the project is deleted.
• Simple records of what happens on the site, such as a project being published or a conversation starting, so we can see whether Open2Build is working. These are not used to track you across other sites.
• If you joined through an invite link, such as one shared on LinkedIn, the short name in that link (for example “linkedin”), so we can count which invitations work. It is carried in the web address, not a cookie, and we count visits to the page without recording who you are.

Why we use it

• To run the service you asked for: analysing your idea, showing your profile to projects it matches, and passing on replies and introductions.
• To keep the service safe, for example limiting how many sign in links or replies one address can send, and how many people a new account can contact in its first week. The Open2Build team sees a list of new accounts that contact a lot of people or are reported. We keep a record of each sign in (the email address, when, whether you used LinkedIn, Google or an email link, and whether it worked), so we can see if sign in is not working and help people who cannot get in.
• To improve Open2Build, using the records above.

We never sell your data, never scrape other sites for profiles, and never message people on your behalf without you asking.

Who can see what

• Your projects are private unless you publish a project page. A published page shows only the working name, summary and open roles, never your original description or your email.
• You choose who sees your whole profile: signed-in members (the default for new profiles), anyone with the link, or only your connections and founders you are matched with. Anyone else sees just your name. Members who type your name in search find your name even if your profile is private, so people you know can connect with you; you can turn this off on your profile. If you ask someone to connect, ask them for a coffee or send them a message, they can see your profile too, so they know who is asking. Your email is never shown on your profile.
• Messages are seen only by the people in the chat: the two of you, or in a project's team chat, everyone in that team's space. The Open2Build team reads a message only if someone in the chat reports it. Replies to projects, and founders asking matched people to help, go into these chats, so nobody's email address is shared. People you chat with see your status by your photo, like Teams (available, away, busy or offline); we keep only when you last had the site open and last used it, and any status you set. You can turn it off on your profile, or appear offline. We email you when someone writes to you, with the start of their message.
• While you say you are open to a coffee, signed-in members see your name, headline, photo, location and your coffee words on the Meet page. Saying “not now” takes you off the list straight away.
• A recommendation someone writes about you is seen only by you until you approve it. Approved ones are shown wherever your profile is, with the writer’s name and headline. You can hide any of them at any time. A recommendation you write shows your name and headline to the person you recommended.
• When someone starts a conversation with you, or you reply to them, we share email addresses between the two of you so you can talk directly.
• The feed is seen only by signed-in members with a profile, never by visitors or search engines. Your posts and comments show your name, headline and a link to your profile. Your photo shows next to them only if your profile is set to anyone with the link, or to your connections; otherwise members see your initials. Who you follow is not shown to anyone else.
• If you report a post, comment, message or coffee request, the Open2Build team sees who reported it, why, and what was reported; the person reported does not. The team can remove anything that breaks our terms, and stop someone posting or contacting members.
• If we remove something you wrote, we keep a copy with the mark it gave, so an appeal can be judged and there is a record if anyone complains. You can see your marks and appeals on your profile, they are included when you download your data, and they are deleted with your account.
• The Open2Build team can see profiles and projects in order to suggest matches.

Services we use

These companies process data for us, only to provide Open2Build:

• Anthropic, which provides the AI that analyses ideas. Your idea description is sent to it for analysis, and when a project team asks, its agreed project brief, to draft how the project will work. If you upload a CV, its text is sent to it to be read into a draft of your profile. [Confirm Anthropic's data terms and where data is processed.]
• [HOSTING PROVIDER, for example Vercel], which runs the website.
• [DATABASE PROVIDER, for example Supabase or Neon], which stores the data and pictures, in [REGION, for example London].
• Resend, which sends our emails.
• Cloudflare, which runs a check on the sign in form that you are a person and not a bot. It looks at technical details of your browser when you ask for a sign in link, under Cloudflare's own privacy terms. We only learn whether the check passed.
• LinkedIn and Google, only if you choose to sign in with them. They confirm who you are, under their own privacy terms.

Some of these may process data outside the UK. Where they do, we rely on the safeguards UK law requires. [Confirm for each provider.]

Cookies

We use one cookie, which keeps you signed in. It is needed for the site to work, so we do not ask for consent for it. We do not use advertising or tracking cookies, and no other company's tracking code runs on our pages.

How long we keep it

We keep your data while you have an account. Sign in links expire after 15 minutes, and the record of each sign in is deleted after a year. You can delete your account at any time from Settings → Data and privacy, which removes your profile, your projects and the replies you sent. [Set a retention period for inactive accounts.]

Your rights

You can see, download, correct or delete your data. Download or delete it from Settings → Data and privacy, or contact us for anything else. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Last updated: [DATE].