Privacy policy
Last revised: internal draft, November 2026.
1. Who the data controller is
Foro [PENDING: registered name, tax ID, registered office and companies register details of the owning company once incorporated] is the controller of the personal data collected through this website. For anything to do with privacy, write to [PENDING: privacy contact email].
2. What data we collect
Data you give us directly
- Registration: email address and password (the password is stored encrypted by our authentication provider, never in plain text and never accessible to the Foro team).
- Investor profile: if you self-certify as a qualified investor, the answers you voluntarily give to the MiFID II criteria questionnaire.
- Investor profile on Foro: the firm you invest through, your investor type and, if you choose to give it, the range of assets you manage or invest.
- Questions: the text of the questions you send about a company and, if you ask without an account, the name you choose to give.
- Messages to companies: what you write to a company through its private channel, and its reply.
- Waitlist and company sign-ups: if you work at a company, your name, email, company and role, and whether you ask for a call.
- Shareholder channel: if a company invites you, the email and name it invites you with, and your requests in that channel.
Data we collect from your use of the service
- Companies followed: which companies you follow, and when.
- Browsing behaviour: which profiles you visit, in which language you read them, which tabs you open, which podcast episodes you listen to and for how long, and which questions you send or read, tied to your account if you are signed in, or to an anonymous session cookie if you are not (see the cookie policy).
- Technical data: IP address, browser and device type, collected automatically for security and for the site to work.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, showing you content | Performance of a contract (art. 6(1)(b) GDPR) |
| Checking your qualified investor self-certification | Performance of a contract |
| Drafting and publishing answers to your questions | Performance of a contract |
| Showing a company your firm and investor type when you follow it, ask it, write to it or are in its channel | [PENDING: confirm legal basis (consent or performance of a contract) with counsel] |
| Analysing which companies and content draw most interest, to build aggregate investor interest per company | Explicit consent, collected at registration (art. 6(1)(a) GDPR) |
| Site security, fraud and abuse prevention | Legitimate interest (art. 6(1)(f) GDPR) |
| Messages about news from companies you follow | Explicit consent, ticked separately |
Consent for the analytical use of behaviour is asked for explicitly and separately in the registration form, and you can withdraw it at any time from your account without affecting the rest of the service.
4. Who we share your data with
We do not sell identifiable personal data to anyone. We share data with the following providers, as processors, strictly in order to run the service:
- Supabase (database, authentication and file storage).
- Anthropic (drafting company profiles and answers with language models, from each company's official documents; it receives the text of questions and of what you write to Lumia, never your account data).
- ElevenLabs (speech synthesis for podcast episodes, from editorial scripts; it processes no personal user data).
- Vercel (hosting the web application).
Some of these providers may process data on servers outside the European Economic Area (in the United States, for example). Where that happens, the transfer relies on the European Commission's standard contractual clauses or another valid mechanism under Chapter V of the GDPR. [PENDING: confirm the specific mechanism for each provider against their data protection documentation in force at launch].
What a company sees about you. In its panel, a company sees in aggregate how many people visit its profile, which sections they open and what type of investor they are. Only when you interact with it directly (you follow it, ask it, write to it or are in its shareholder channel) does it also see your firm and investor type, and which of those actions you took. It never sees your email unless you give it in a message or it invited you to its channel.
5. How long we keep your data
For as long as your account is active. If you close it, we delete or anonymise your identifiable personal data within a reasonable period, unless the law requires us to keep certain information (for tax obligations, for example, or to defend claims).
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to [PENDING: privacy contact email]. You also have the right to complain to the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with the rules.
7. Minors
Foro is not aimed at anyone under 18. We do not knowingly ask for or process data about minors.
8. Changes to this policy
We may update this policy to reflect legal or service changes. If a change is substantial, we will tell you by email or with a prominent notice on the site before it takes effect.
This is a translation provided for convenience. The Spanish version is the one that governs.