Privacy Policy

1. Scope and application

This Policy describes how the operator of The Founding Few (“Studio,” “we,” “our,” and “us”) collects, receives, produces, uses, analyzes, shares, stores, preserves, secures and deletes information in connection with the Studio website, current-Product creator partnership applications, new-Product idea applications, permitted follow-up verification, communications, website operations and legitimate business development. It covers individuals who browse the site, contact the Studio, submit interest, suggest a Product, or provide authorized creator performance reports.

The Studio is operated from India as a sole proprietorship and determines the purposes and means of processing its own application and visitor information. Actual hosting, email-verification, anti-abuse and analytics providers may act as processors/service providers, or as independent controllers when legally relevant. Merely listing a possible category of provider in this Policy does not mean an unnamed service has already been activated.

This Policy is a privacy notice and does not by itself confer legal company shares, profits, a reserved Creator slot, exclusivity or a confidentiality undertaking for business ideas. Contractual idea-submission and ownership terms are addressed in The Founding Few Creator Application Terms and, where executed, a separate Creator Partner Agreement and Product Schedule. Mandatory legal rights cannot be waived or overridden by a notice.

2. Definitions and relevant records

“Personal Information” or “Personal Data” means information concerning an identified or reasonably identifiable individual under applicable law. This can include public professional information, linked creator accounts, performance dashboards, public posts that identify a creator, email and security/network identifiers, and internal assessments attached to a person. Public availability alone does not necessarily remove privacy-law obligations.

“Applicant Information” encompasses the applicant’s form and verification information, publicly listed creator handles and accounts, relevant written answers, Product selection or idea proposal, correspondence, later evidence of performance, account-control verification observations, reviewer notes and outcomes. “Creator Performance Data” means authorized dashboard exports, screenshots, reports or metrics about reach, impressions, views, engagement, listen/watch time, growth, audience geography, aggregate demographics, conversions and prior legitimate campaigns.

“Evaluation Data” includes Studio-created rankings, authenticity notes, credibility flags, performance comparisons, fit assessments, commercial forecasts, eligibility or suitability scores and review conclusions concerning an identifiable creator. “Studio Intelligence” covers the Studio’s internally developed methodologies, benchmarking calculations, analysis frameworks, statistical reports, models and market research. Studio Intelligence is still personal data where it can reasonably be associated with an individual.

“Anonymous Information” means information that is sufficiently anonymized under the law and cannot reasonably be used to identify the person again. Pseudonymized records, hashed handles, creator IDs or data with an accessible re-identification key remain Personal Information where applicable. “Tracking Technologies” includes cookies, tags, pixels, scripts, device identifiers, local storage and similar storage or access methods when deployed.

3. Information we receive from applicants and correspondents

Our creator-partnership application form collects a public or display name; a contact email address supplied by the applicant; creator country of residence; the single country representing the largest proportion of the applicant’s audience; one or more languages used in content; at least one public social/creator/portfolio URL, with additional links allowed; a description of what they create and whom they serve; the selection of a current eligible Studio Product or the option to submit a new Product idea; and a confirmation that the applicant is at least 18. A new idea choice also involves a written description of the proposed Product. An alternate contact link may be supplied voluntarily.

We may also process the time of submission, verification status, the Product selected, the application’s review and communication status, corrections, applicant follow-up messages, requested supporting material and evidence of agreed communications. Where a creator voluntarily sends other professional information relevant to the collaboration, we may evaluate it within lawful specified business purposes. Submission is not an automatic subscription to promotional marketing.

Applicants are not required in the public form to provide government IDs, complete residential addresses, bank or tax details, login credentials, private audience member identities, social-account passwords or restricted access tokens. The Studio may request additional legal identity, contact, tax, compliance, verification or payout information in separate private stages where legitimately necessary, subject to the applicable legal ground, confidentiality and safeguards.

4. New-Product submissions and business proposals

Where an applicant proposes a Product idea, we may examine the written concept, potential market, proposed audience, production requirements, expected channels of distribution, technical or product feasibility, expected costs, timing, commercial fit and other relevant material provided. We may compare the proposal with other lawfully available research and evaluate whether, how, by whom or when the Studio might pursue a Product opportunity.

Applicant ideas may form part of the Studio’s restricted business evaluation records and be provided on a need-to-know basis to decision makers and authorized advisers or personnel involved in feasibility review. Such processing does not automatically transfer intellectual-property rights or create a binding partnership. Separate Application Terms govern legal treatment of the submitted ideas and the conditions for any future special idea-originator Product participation.

5. Additional creator analytics and requested evidence

At the Studio’s discretion we may request an applicant or creator to provide screenshots, reports, native exports or summaries from platforms or services that they lawfully control, such as social media, video, podcast, newsletter, marketing, commerce or analytics dashboards. The requested evidence may include reach, content impressions, views or listens, audience engagement, engagement rates, saves, shares, average viewing or listening time, followers, subscriber growth, audience language and geography, aggregate age ranges, lawful advertising or collaboration performance, product clicks, conversion rates and campaign economics.

We may assess completeness, age, reliability and authenticity of supplied figures, reconcile them with public indicators and other lawfully obtained information, detect potential manipulation and request clarifications. Our decision to request detailed analytics from one prospect does not require us to request the same information from every prospect. Where material representations cannot be substantiated, we may decline, pause or close the application. The Studio does not request private audience direct messages, passwords, secret tokens or unauthorized access to other people’s data for ordinary applicant evaluation.

The person providing evidence represents that they are authorized to share the relevant material, including any third-party platform conditions. This Privacy Policy does not enlarge a creator’s rights to redistribute their platform’s protected datasets. Where a creator includes unnecessary sensitive data or identifies individual audience members, we may redact, reject or restrict that information as appropriate under applicable law.

6. Lawfully available public and third-party information

The Studio may inspect publicly available creator profiles, public posts, professional websites, publicly disclosed work and collaboration histories, publicly displayed engagement measures, newsletters, community platforms, product feedback and other lawfully accessible evidence relevant to Studio Product selection. We may receive professional introductions, creator referrals, legitimate market research, business contact details and authorized intelligence from service providers or collaborators.

We may compare information from different permitted sources to detect duplicate applications, investigate false claims or suspicious traffic, assess professional reliability, evaluate niche and geographic audience alignment, understand a creator’s publicly visible editorial or commercial work, and determine whether further discussion is commercially warranted. Public data linked to an individual will be treated as Personal Information where the relevant law so requires. We will not claim that public availability overrides privacy, intellectual-property or platform access restrictions.

When information is collected indirectly, we will provide legally required information about the categories and sources, within applicable notification timeframes and subject to applicable statutory exceptions. Access to one public profile does not authorize the Studio to enter private accounts, bypass technical barriers or acquire confidential third-party datasets.

7. Technical data, security records and site interactions

Depending on the live configuration, our hosting and security systems may process IP and network addresses, approximate IP-based location, timestamps, language and browser settings, user-agent and operating system, URLs accessed, referrer information, request volume, session or anti-abuse signals, device or request identifiers, HTTP status or error information, submission attempts, fraud or bot flags, verification results, basic performance diagnostics and security event logs. We may use such information to deliver the site and forms, manage necessary sessions, secure networks, block excessive requests, prevent forged submissions, detect attacks, troubleshoot faults and defend legitimate Studio rights.

We use Cloudflare for website hosting, content delivery, network protection and email routing. Messages sent to [email protected] are forwarded through Cloudflare to our Google/Gmail inbox, where application emails and correspondence are received and stored. Hosting and security systems may necessarily receive technical request data described above. Cloudflare Web Analytics is active for traffic and performance measurement as described in Section 20. Additional optional measurement technologies are subject to the applicable disclosure and choice requirements. The initial Creator application service does not include undisclosed behavioral retargeting or session-replay tools; additional technologies will be described and subjected to any legally required choices before activation. A privacy notice does not replace technical enforcement of a required consent or opt-out choice.

8. Sensitive categories and data minimization

We do not design the ordinary creator application to collect medical diagnoses, biometric identifiers, political beliefs, ethnicity, religion, criminal history, personal financial accounts or the identities of individual followers. Please do not submit sensitive or unrelated information unless a legitimate private process explicitly requests it. We may delete or isolate incidental information that is unnecessary for the assessment, subject to our genuine duty to preserve relevant evidence and applicable law.

Aggregated audience demographics can be relevant to Product market evaluation, but we do not generally need the names or individual records of an applicant’s audience members. A later Studio Product that requires materially different categories of data will receive the separate disclosures and operational measures necessary for that Product, rather than silently treating this website applicant policy as a universal authorization.

9. Business purposes and operational rights

9.1 Applicant assessment and partner selection. We use information to evaluate interest in Studio Products, review content quality and market relevance, confirm identity or account authenticity when appropriate, assess commercial suitability, decide whom to contact or invite, negotiate collaboration opportunities and document acceptance, postponement or closure. We retain commercial discretion to prioritize one Product, niche, location, audience or creator over another and to decide which evidence is sufficiently persuasive, subject to applicable legal restrictions. No applicant receives a guarantee of review, a minimum processing priority or a particular decision.

9.2 Future-product opportunities. A Studio applicant may be relevant to a different or later Product, even where the first relevant Product closes or the applicant is not selected for that particular opportunity. We may lawfully maintain a curated internal prospect record for that stated multi-product selection purpose, reconsider a prospect against actual future opportunities and directly approach them about genuinely related potential partnerships within the approved retention period and applicable communication restrictions. We will not interpret an application as automatic permission to put the person onto an unrelated promotional newsletter or consumer advertising campaign.

9.3 Business intelligence, benchmarking and internal commercial development. We may create or use professional fit notes, categories, internal ranking frameworks, suitability profiles, credibility and brand-safety flags, performance comparisons, research summaries, marketing analyses, audience-market maps, partner economics, forecasts and aggregate benchmarks to determine where the Studio should allocate time, engineering effort, marketing expenditure, Product ownership capacity and other commercial resources. A contributor does not receive a contractual right to inspect other applicants’ evaluations, impose a particular rating method, approve the Studio’s scoring framework or receive compensation merely because lawfully supplied information informs Studio-created business analysis, except for applicable mandatory personal-data rights.

9.4 Platform growth and product performance. We may measure lawful website traffic and conversion pathways, determine which sources bring relevant prospective creators, identify forms or pages that require improvement, evaluate site performance, develop better communications and review business or campaign results. Actual optional analytics and marketing tracking remains subject to the cookie choices and legal requirements applicable to deployed technologies.

9.5 Security, fraud, reputation and compliance. We may authenticate submissions, investigate duplicated or automated entries, spot misleading representation of reach or audience, assess lawful public evidence of relevant professional conduct, enforce published application terms, identify prohibited conduct, defend Studio resources and systems, and retain information proportionately where needed for documented legal disputes, claims, audits, legitimate accounting requirements or security incidents.

9.6 Studio financing and continuity. We may use relevant appropriately controlled information to evaluate investors, financing structures, product commercialization, lawful business reorganizations, acquisition opportunities and the transfer of Studio operations to a future incorporated company or other lawful successor. Such use does not itself assign a creator’s separate signed contractual rights, transfer a person’s pre-existing intellectual property or extinguish proprietor liability where the applicable law or signed documents do not permit it.

10. Lawful grounds for processing where EU/UK privacy law applies

Where EU GDPR or UK GDPR governs particular processing, the Studio identifies the lawful basis applicable to the purpose and does not claim that browsing a webpage, providing an email or accepting an unrelated set of Terms equals unrestricted permission to process all Personal Data for every possible future use. Depending on circumstances, the lawful ground may be taking steps at an applicant’s request before considering a possible contract; legitimate interests in evaluating prospective professional relationships, protecting systems and preventing abuse; performance of a concluded lawful contract; compliance with legal obligations; or valid consent for a purpose that legally requires it, such as non-exempt cookies and applicable marketing practices.

Where we rely on legitimate interests, those interests include carefully selecting commercial counterparties, assessing verified audience distribution and credibility, forecasting and controlling Studio marketing/engineering spending, building a viable product portfolio, deterring abusive or deceitful applications, securing systems, enforcing lawful rights and preserving appropriate evidence. We assess whether an activity is necessary and proportionate, whether the individual could reasonably expect it, what less intrusive means are available, and whether rights override the intended interest. We document relevant balancing assessments where required.

The same personal information may be used for several distinct and compatible disclosed purposes, and a particular type of data does not always have the same legal basis for every use. Security logs necessary to maintain a legitimate website differ from optional behavioral advertising. Initial applicant screening differs from maintaining a future-opportunity pool or using identifiable dashboards to train a new automated decision model. If we seek a substantially new and incompatible use, we will first determine the additional notices, valid basis and consent, if any, necessary under the law.

Where legal obligations require a particular record to be retained or disclosed, we may act on that obligation to the extent required. Where we process information to establish, exercise or defend legal claims, we may maintain appropriate restricted evidence, rather than automatically erasing necessary claim records upon a routine application closure. This does not authorize indefinite retention of an entire applicant database for hypothetical future disputes.

11. Human evaluation, scoring and automated assistance

The Studio may evaluate creator credibility, audience quality, commercial fit, content relevance and operational risk through manual review, spreadsheets, rules-based comparison, private qualitative scoring, statistical techniques, internal software or AI-assisted analytical tools that are lawfully used and appropriately configured. We may combine authorized creator-provided dashboards with public creator profiles, application answers and Studio-generated data to produce estimates, hypotheses and internal comparative analyses.

Internal scores and reviewer opinions can be Personal Data when attached to an identifiable creator. We intend to rely on appropriate business judgment in consequential partnership decisions. If the Studio later adopts solely automated decisions producing legal or similarly significant effects that trigger specific law, we will implement any required notices, human-review rights, contest mechanisms, lawful basis and risk safeguards before their deployment. This Policy does not represent that a significant solely automated decision system is presently active.

Applicants may dispute factual inaccuracies through an applicable privacy request process; however, the Studio is not required to treat a difference in commercial opinion as a demonstrably false fact. We may preserve lawful factual evidence, integrity flags and genuinely held professional assessments where justified. Privacy access rights, when applicable, may be subject to lawful limitations needed to protect third-party data, trade secrets, other applicants and rights and freedoms; such exceptions will not be invoked beyond what the law allows.

12. Retention of future creator prospects

The Studio’s approved default business policy is to retain genuinely relevant inactive Creator-applicant records for up to 24 months after their last meaningful interaction with us, unless the information is no longer needed sooner or a legally applicable right, obligation or stricter limit requires a different result. Meaningful interaction includes a substantive application or a genuine fresh applicant response or conversation; silent internal reassessment, an automatic acknowledgement, a generic bulk mailing or a self-serving artificial contact does not restart the clock.

We maintain a selective pipeline, not an unlimited archive of every rejected or incomplete form. Clearly unsuitable, irrelevant or unnecessary applications may be closed and deleted or anonymized earlier. We may periodically review continued relevance, remove excessive dashboard files once comparisons no longer require them, and distinguish open prospects from closed cases. Sensitive or unrelated data will not be retained simply because an applicant happened to send it.

Actual signed Creator Partner records, legal identity or payout details, contractual milestone proofs and lawful accounting/tax information may be governed by separate operational and statutory retention periods, disclosed when those processing activities become relevant. Restricted fraud evidence, security-incident records, an identified legal hold or material litigation files may be retained for the specific necessary period rather than routinely reused as a prospective partner database. Lawful anonymized aggregate statistical data and independently created Studio methods may be retained and used longer where they cannot reasonably identify individuals and do not violate platform or intellectual-property restrictions.

13. Communications and lawful outreach

We may contact applicants using the contact email address supplied by the applicant or a deliberately supplied appropriate alternative professional link to acknowledge submissions, request relevant additional information, discuss opportunities, clarify performance claims, communicate partnership decisions, provide application-related notices and maintain necessary administrative records. The Studio may contact a retained prospect about a genuinely relevant later Product in accordance with the original stated purpose and any applicable electronic marketing laws. We do not guarantee that every expression of interest receives a personal response.

General promotional newsletters, unrelated consumer marketing, cross-context behavioral advertising and other communications requiring consent or additional opt-outs will not be treated as automatically authorized by merely submitting a creator interest form. Where a marketing list is lawfully operated, we will describe the category, honor applicable communication preferences and provide required unsubscribe options. Operational security, legal, requested transactional and application-response communications may be treated differently from optional marketing, subject to the law.

14. Studio intelligence, anonymization and independent business methods

The Studio may develop its own creator comparison methods, performance benchmarks, statistical measures, demand forecasts, opportunity scoring, product-market analyses and internal business models based on legitimately obtained information. Such internally developed analytical structure, original work and nonpersonal commercial know-how may be used to operate and grow the Studio without giving the applicant a veto, joint ownership in Studio methodologies or a fee merely because they supplied data assessed as part of an application.

Where we produce genuine anonymous or sufficiently aggregated output, we may use or retain it for broader product planning, historical comparisons, general market intelligence and improved estimation models, provided it remains anonymous under the applicable legal standard and any necessary third-party licences permit that use. If an output, embedding, risk score, pseudonym or dataset can reasonably identify a creator, we will treat it as Personal Information and apply the relevant processing purposes and retention requirements.

Studio valuation, benchmarking or commercial projections may contain confidential Studio financial assumptions or knowledge about other creators. We do not promise to reveal all internal algorithms, commercial trade secrets or unrelated third-party information beyond lawful privacy access, explanation or automated-decision requirements. No sentence in this Policy assigns ownership to the Studio of a creator's account, lawfully protected original content or someone else’s platform infrastructure.

15. Categories of recipients and permitted disclosure

15.1 Studio personnel and contractors. Relevant Personal Information may be accessed on a need-to-know basis by the proprietor, authorized future employees, relevant product collaborators, project contractors and approved internal reviewers whose responsibilities involve screening, communications, evidence verification, operations, security, market research or legal matters. We may impose reasonable access controls and confidentiality obligations appropriate to the actual relationship.

15.2 Service providers and supporting operations. Cloudflare provides website hosting, content delivery, network protection, website traffic and performance analytics, and email routing. Google/Gmail receives and stores application emails and Studio correspondence, including messages forwarded through Cloudflare. We may also share the minimum appropriate information with genuine hosting/storage and backup providers, email and verification delivery services, form and communications services, anti-abuse/security providers, lawfully implemented analytics or consent systems, authorized collaboration/documentation tools, professional advisers and actual payment or signing providers when needed. A provider may process information for us or act as an independent controller for specified functions under its own legal obligations. We use legally necessary provider agreements and protections where required. A provider named here is not a claim that every optional feature or vendor category is active.

15.3 Advisers and commercial counterparties. Subject to any applicable legal basis, proportionality requirements and mandatory safeguards, we may share relevant application and business information with legal, tax, accounting, financial, banking, insurance and compliance advisers; payment providers; authorized product collaborators; existing or prospective investors, lenders, due-diligence teams, financing or transaction counterparties, potential acquirers, and their representatives. The Studio determines the permissible scope, format and controls appropriate to each legitimate purpose and may use direct disclosure, restricted access, summaries, redactions, aggregation or confidentiality arrangements as commercially appropriate or legally required. This Policy does not grant applicants an additional contractual right to preapprove lawful disclosures or dictate our diligence procedures.

15.4 Authorities and enforcement. We may disclose or preserve information when reasonably needed to comply with applicable legal obligations, enforceable court orders, valid government or regulatory processes, required tax or financial compliance, investigations into fraud or security threats, serious misconduct prevention, or the establishment, exercise or defense of lawful claims. We may seek to verify the scope and validity of a request and disclose no more than reasonably required by its legal basis.

15.5 Other parties at the individual’s direction; signed Creator publicity rights. If a prospective creator requests an introduction or expressly provides a third-party professional contact for a legitimate collaboration, we may share proportionate relevant information in accordance with that direction and applicable law. For an actual SIGNED Creator Partner, the separate Master Creator Partner Agreement and selected Product Schedule may grant the Studio broad ONCE-AT-SIGNING commercial rights to use partnership-related Creator materials and the Creator's supplied or recorded name, image, likeness, voice, handle and performances in organic and paid promotion across Studio Products, with permitted editing, redistribution, licensing and post-departure use. Where that effective upfront grant covers the proposed use, no additional Creator CONTRACTUAL consent, campaign-by-campaign content approval, separate royalty or fresh authorisation is required merely because the Studio later exercises it. The underlying contracts, relevant third-party/platform permissions and any applicable non-waivable rights or privacy processing requirements remain distinct; an applicant who has not signed such terms does not automatically grant a publicity licence by visiting or applying.

16. Business transfers, successor entities and corporate restructuring

The Studio may consider incorporation, an acquisition or sale of all or a material part of the Studio’s legitimate business, a merger, reorganization, asset or Product transfer, financing transaction, investment, liquidation or other lawful business succession. Where reasonably necessary for diligence or implementation, Personal Information may be made available to genuine prospective advisers and counterparties under appropriately controlled arrangements, or transferred to a successor or receiving organization with the lawful purposes and safeguards required by applicable data-protection rules.

A change to the Studio’s legal form or ownership may lead to a change in responsible controller and updated contact information. We will provide legally required notice and a lawful transfer mechanism and honor rights that continue to apply. A privacy-data transfer does not by itself transfer a creator's protected intellectual property, issue company stock, convert the founder’s existing debts into corporate liabilities or novate a signed Creator Partner Agreement; any such contractual change must comply with the underlying agreement and applicable law.

The Studio will not create additional contractual applicant approval or veto rights over a lawful corporate transaction merely through this Privacy Policy. Mandatory approval, notice, choice, objection or other requirements continue to apply wherever the relevant law prescribes them.

17. No standalone sale of creator or applicant data

The Founding Few’s declared commercial policy is not to sell, license or broker individually identifiable creator and applicant information, contact lists, application records or performance dashboards to unrelated advertisers, data brokers or standalone data buyers as a paid dataset or similar product. This does not prohibit properly authorized sharing with operational vendors and advisers, appropriately controlled business due diligence or a lawful transfer of relevant records as part of an actual Studio business transaction as described above.

Some privacy statutes treat cross-context advertising disclosures, certain analytics relationships or value exchanges as a regulated “sale” or “sharing” even where no money changes hands. Before activating any such practice, the Studio must identify the actual statutory treatment, make necessary disclosures, obtain required consent or offer mandated opt-outs, and ensure that the implementation remains consistent with the founder’s decision not to commercialize creator personal data as a standalone commodity.

Subject to applicable law, the Studio's no-standalone-data-sale position does not restrict the use of legitimate operational providers, advisers or collaborators; proper due diligence and financing discussions; lawful business or Product transfers; disclosure under valid legal process; or commercial use of genuinely anonymized nonpersonal Studio analysis and methodology. The Studio retains discretion to decide which appropriate parties receive which lawfully disclosable information, while implementing any required notice, legal basis, consent, objection or protection.

18. International processing, data location and cross-border disclosure

The Studio operates from India, and our intended creator network may include individuals in the United Kingdom, the European Union, other European countries, the United States, Canada, Australia, New Zealand and elsewhere. Relevant Personal Information may be accessed, processed or stored in India and in other countries where our actually selected hosting, communications, verification, security, documentation or professional service providers lawfully operate. Privacy laws and government access rules may vary among those countries.

Where a particular international transmission is a restricted transfer under EU GDPR, UK GDPR or another applicable regime, we will identify an appropriate transfer route and put legally required safeguards in place, which may include applicable adequacy arrangements, approved standard contractual clauses, UK transfer addenda or other lawful mechanisms and supplemental measures where needed. We will make legally required information about available safeguards accessible through the stated privacy contact. A Privacy Policy does not, by itself, constitute a valid restricted-transfer safeguard or create an adequacy finding for India.

Where non-EU/UK operations intentionally offer relevant services to or monitor individuals in those territories, applicable extraterritorial rules may require an EU or UK representative, particular notices and records, or additional processing conditions. We will assess whether an exemption actually applies rather than incorrectly assuming that working from India eliminates foreign obligations. We will include the verified representative information in this Policy if a designation becomes required.

Business continuity planning may include disaster recovery, restricted backups, outsourced technical administration and temporary access from additional regions, when consistent with applicable contracts, lawful purposes, security requirements and transfer rules. The Studio does not promise that every byte of information will remain in a single country or that no provider will ever change its physical infrastructure.

19. Retention framework and deletion triggers

19.1 Active and relevant creator prospects. We ordinarily retain qualified, genuinely relevant yet uncontracted creator application information for no longer than 24 months after the last meaningful applicant interaction, unless an earlier deletion is appropriate or a more restrictive applicable requirement controls. A meaningful interaction includes a substantive initial application, genuine follow-up correspondence or a fresh applicant-initiated engagement. Our silent internal profile review, a scheduled reminder, an automated email receipt or generic promotional message will not automatically reset the period.

19.2 Irrelevant, incomplete or withdrawn prospect information. A submission lacking a legitimate business basis to continue, a clearly unsuitable applicant or an irrelevant idea may be deleted or de-identified sooner. Incomplete submissions, unverified contact attempts and low-value application drafts should not be retained for the full future-prospect period merely by default. Necessary small proof records of attempted abuse or consent, where separately justified, may follow an applicable technical or legal-hold schedule.

19.3 Public creator-profile snapshots, dashboards and evaluation notes. Relevant screenshots, exports, comparisons and notes identifying an inactive prospect ordinarily follow the prospect retention ceiling, subject to shorter necessity and lawful deletion requirements. Where a particular raw dashboard report ceases to be necessary before the prospect record does, we may remove that file and keep only the narrower lawful evaluation summary. An applicant’s account link does not justify retaining sensitive, obsolete or unrelated materials indefinitely.

19.4 Site, email-verification and security logs. Technical request, security and abuse-prevention records are retained according to genuine operational necessity, the relevant provider’s actual storage and log settings, required security incident investigation, backup rotation and applicable legal duties. Routine low-value records are not retained longer than reasonably necessary merely because the infrastructure permits it. A documented incident, fraudulent activity or specific legal preservation obligation can justify restricted evidence for the applicable purpose. We do not promise that every network or backup record expires on an identical date.

19.5 Cookie choices and consent records. Where a consent or preference mechanism applies, the Studio may retain proportionate evidence of the selection, withdrawal, notice version, time and relevant technical context for the period reasonably necessary to establish compliance. If the website uses cookie or device-storage technologies whose identity, function, provider or duration must be disclosed, their current details and any choices are supplied through the relevant cookie notice or preferences interface. These records are kept for justified operational or legal periods and are not an authorization for unrelated tracking.

19.6 Signed creator partner, publication, advertising and payment records. Executed agreements, product-specific contractual participation rights, validated Content Credits and milestone evidence, Studio-approved Creator-supplied partnership videos, photographs, audio, name/handle, recorded face, likeness or voice, properly licensed publicity assets, paid/organic campaign versions and reasonably necessary authorisation/rights-clearance evidence may be processed to perform, administer, publicize, license and enforce an actual signed Creator relationship; operate, advertise and grow Studio Products; undertake relevant lawful commercial transactions; and establish or defend Studio rights, subject to the processing grounds and privacy obligations applicable to those activities. Such content may be lawfully published in marketing materials and advertising under the separate signed commercial licence, which can survive ordinary creator departure; the contractual intellectual-property licence does not in itself displace applicable Personal Data rights. Partner records, tax/withholding documents, accounting records, and evidence of lawful advertising or claims may follow separate necessity-based or mandatory record-retention periods rather than the 24-month inactive applicant pool. The Studio's commercial rights under a signed agreement should not be confused with optional cookie/tracking consent or assumed to authorize processing unrelated to the stated purposes.

19.7 Legal claims and statutory holds. Data actually relevant to an identifiable claim, dispute, security breach, fraudulent conduct, governmental requirement or legally required record may be restricted and retained for the appropriate proceeding, limitation period or documented lawful purpose. Ordinary prospecting does not resume merely because evidence was retained for this separate purpose. We may remove or mask unnecessary elements rather than retaining a complete historic profile where a narrower evidentiary extract suffices.

19.8 Anonymized research. Genuinely anonymized aggregate statistical data and the Studio’s lawfully developed methodology may be retained longer while the information remains sufficiently anonymous and relevant to legitimate business purposes. Data that can be reasonably re-identified, including merely pseudonymized performance histories or protected source account materials, remains subject to applicable Personal Data or intellectual-property controls.

19.9 Deletion mechanics. Deletion may occur by removing a primary live record, expiring it under an actual retention rule, limiting it to a restricted legal hold, replacing it with properly anonymized statistics, or removing it from backup rotation under an appropriately documented cycle. Backup, compliance, deletion-request and data-restoration procedures will be configured according to the actual website architecture and applicable law. We will not misstate that electronic deletion is instantaneous in every secondary system.

20. Cookies, consent and other tracking technologies

20.1 General approach. The Studio may use necessary storage or access technologies for genuine site delivery, security, bot protection, form submission and verified email processing, session integrity and lawful consent-preference handling. Optional traffic measurement, usability experiments, campaign analytics and advertising technologies, if deployed, will be separately assessed by purpose and jurisdiction. This Policy incorporates the Studio’s cookie disclosure; an additional technical cookie inventory or settings panel can provide necessary vendor-by-vendor details without requiring a wholly separate general privacy policy.

20.2 Essential and security technologies. Technologies genuinely necessary for a service requested by the user or for communications or security may operate without optional marketing consent where a specific local legal exception applies. The fact that a provider labels a cookie “essential” is not dispositive. We may describe such items as always active only if their actual function qualifies and users are informed as required. Essential services should remain available when visitors decline optional analytics or marketing.

20.3 Optional analytics, research and optimization. Depending on their implementation, technologies may measure visitor counts, referral sources, aggregate location, navigation pathways, form progression/abandonment, site performance, eligible experiments, product interest, conversion and campaign effectiveness. UK rules provide some narrow statistical-use and appearance/functionality exceptions where applicable conditions—including clear notice and a simple free objection—are met. EU member-state rules differ. The Studio will not assume that all general analytics qualify for consent exemptions; nonexempt access/storage remains inactive before valid consent where required. Cloudflare Web Analytics is enabled to measure website traffic and performance. Its standard service does not use analytics cookies, local storage or fingerprinting to collect usage metrics. It is distinct from cross-site advertising and behavior-retargeting technology; its actual configuration, and other network or security functions, remain subject to the relevant disclosure and legal requirements.

20.4 Advertising and marketing technologies. If the Studio later wishes to run advertising attribution, behavioral retargeting, remarketing audiences, conversion pixels or other marketing integration, the actual vendor, identifiers, data categories, purposes and legally relevant sharing/opt-out consequences must be assessed before activation. Where law requires it, these technologies remain disabled until meaningful consent has been given and must respect its withdrawal. We do not treat simple application acceptance as a legal substitute for required tracking consent.

20.5 Optional-consent interface. If deployed technologies require prior consent, the website will provide an accessible first-layer choice such as “Accept all,” “Reject optional,” and “Preferences,” with comparably easy actions where required. Any second layer describes the categories, purposes and settings available for the actual tools in use. No optional category is preselected where law prohibits that practice, and refusing optional tracking does not prevent a Creator from submitting an otherwise valid application. A cookie banner will not be displayed merely as decoration when no consent-requiring technology is active.

20.6 Preference changes and withdrawal. When optional tracking choices apply, visitors may revisit them through a reasonably accessible website control, including a Cookie Preferences link where appropriate. The Studio will apply updated choices to subsequent nonexempt device access/storage and take required action regarding data already collected where the law provides. We may retain limited records reasonably needed to evidence lawful consent and withdrawal, without using the consent record for unrelated marketing.

20.7 Regional signals. Where an applicable United States state law requires recognition of a valid opt-out preference signal, including Global Privacy Control, or permits specified alternate disclosures or links, the actual tracking implementation and notice will respond accordingly. We will not assume consent under UK/EU rules merely from a browser’s default acceptance of storage. A website visitor may also configure their browser to block or erase cookies, but those settings do not always replace the specific legal obligations of the Studio.

20.8 Current technology details and later changes. Any new optional tracker must be assessed for its purpose, provider, device or browser identifiers, duration, onward disclosure, country of processing, required legal basis and applicable consent or opt-out controls before it is used. Material changes to tracking technologies or purposes will be reflected in the relevant disclosure and preferences when required. This Policy does not grant unlimited advance consent to new and unspecified third-party advertising systems.

21. Security, authorized access and defensive operations

We intend to use security measures reasonably suited to the type, sensitivity and scale of data held and the risks posed by its use. Those measures may include authenticated administrative access, role-based restriction, reasonable vendor scrutiny, protections for stored/transmitted data, carefully configured server-side validation, abuse detection, access monitoring, backups, retention controls and appropriate response to incidents. The actual controls must be verified in the live infrastructure rather than assumed from hosting on a particular platform.

Access to unpublicized idea descriptions, creator analytics, detailed reviewer notes or identity records should be limited to legitimate Studio responsibilities. We may use service providers, advisers and authorized contractors to support necessary processes, with legally required contract and confidentiality arrangements where appropriate. We reserve discretion to investigate suspected unauthorized use or material misrepresentation and to retain appropriate evidence while protecting the Studio’s systems and rights.

No electronic system or communication channel can be guaranteed to be completely secure, available or free of interception, loss or misuse. We do not make such absolute guarantees or voluntarily assume any particular security certification, audit standard, recovery-time commitment or liability beyond what applicable law or a separately executed agreement requires. Required security precautions, investigation, incident notices and remedies remain governed by applicable law and the actual services and circumstances.

22. Security incidents, preservation and legal compliance

If a suspected incident affects Studio-controlled Personal Information, we may investigate, contain and remediate it, coordinate with actual providers and legal advisers, restore systems, record actions and evaluate whether notification to individuals, counterparties or regulators is legally required. Applicable timing, recipient, content and investigation requirements will control. The Studio will not promise every cybersecurity event triggers a universal public disclosure if it does not meet the relevant legal threshold.

Where a genuine legal obligation, litigation hold, enforcement request or suspected fraud requires preserving a restricted record, we may keep the minimum relevant evidence needed and maintain a defensible chain of handling, subject to applicable disclosure and deletion requirements. A legal claim or valid deletion request may require balancing and excluding information not actually relevant to the preservation purpose.

Security and fraud tools may evaluate suspicious technical patterns automatically, including unusual IP activity, repeated email validation failures, automation and potential spam. The fact that security systems block or flag certain behavior does not necessarily mean the Studio has undertaken a significant automated decision about a person’s partnership eligibility under applicable law; actual effects and data practices must be assessed.

23. External links and independent platform practices

Our website may link to creator social channels, marketplaces, payment processors, professional services, external Studio products and other third-party websites. Those third parties may operate under their own privacy policies, controls and contractual terms. We do not control the practices of independent external platforms merely because an applicant supplied their URL or a visitor followed an outbound link.

If third-party content or code is embedded into our website, we will assess whether the embedded provider places trackers, accesses devices or receives Personal Information and provide the legally required notice and consent handling. This Policy does not promise that every third-party website will comply with its obligations or that our use of authorized public information entitles us to circumvent its restrictions.

24. Privacy rights and request administration

Depending on the law applicable to the particular individual and processing, people may have rights to receive privacy information, request access, correction, erasure, restriction, portability, objection, withdrawal of consent, or review of certain significant automated decisions. Some rights are conditional, subject to exemptions, identity verification, legal holds or other statutory restrictions. We will evaluate legitimate requests under the relevant legal framework and will not create additional discretionary applicant rights beyond the law and any separate executed agreement.

We may ask for information reasonably necessary to verify the identity and authority of a requester, prevent an unauthorized person from receiving private creator records, clarify a vague request, establish whether the person is covered by a particular law and locate relevant systems. We will avoid demanding excessive verification information beyond what is appropriate to the specific risk and law. We may respond through the privacy-contact address or another lawfully established rights-handling process.

Where the law permits, we may redact information concerning other applicants, counterparties, sources, privileged professional advice, genuine trade secrets, unrelated commercial data or sensitive security controls when responding to a request. Such exceptions are limited by law; they are not an all-purpose basis to refuse every access request or suppress valid facts concerning a requester. We will track request outcomes and retain proportionate processing records where justified by compliance and claims purposes.

Where consent is the actual legal basis, a person can withdraw that consent as the law provides, without undoing lawful processing already completed before withdrawal. Consent withdrawal may disable an optional feature or tracking category that relies on consent but does not necessarily prevent independent lawful processing for security, regulatory obligations or actual legal claims. Rights concerning marketing opt-outs are administered separately where an applicable statute requires them.

25. European Union and European Economic Area disclosures

25.1 Applicability. If the processing comes within EU GDPR territorial scope, the Studio acts as controller for the described applicant/visitor processing and applies the GDPR requirements relevant to its activity. Lawful bases may include requested pre-contract steps, assessed legitimate interests, binding contractual necessity, legal obligations and consent for appropriate purposes. Material purposes, recipient categories, origin of public-source information, retention periods/criteria and appropriate third-country safeguards are described across this Policy.

25.2 Applicant and public-source processing. Information actively provided in a creator application is treated differently from information collected indirectly from public profiles or business contacts. Where Articles 13 or 14 require additional notification, source disclosure, timing or a valid exemption, we will follow them. Public creator profiles and lawfully acquired dashboard metrics may still be Personal Data even if their commercial value lies in aggregate audience indicators.

25.3 Profiling and further use. Internal reviews, analytics and scores are processed only under an applicable ground and disclosed compatible purpose, with legitimate-interest balancing or assessment of risks where required. Significant solely automated decisions trigger the relevant safeguards under EU law if they are in fact employed. Truly anonymous aggregate industry statistics and nonpersonal analytical methodology fall outside personal-data rules only insofar as no reasonable identification remains possible.

25.4 Transfer and representation. If EU GDPR applies to the Studio’s targeted dealings, we will assess whether a representative under Article 27 is required and identify the representative in this notice if appointed. Where a legally restricted transfer occurs to an overseas recipient without an adequacy basis, we will use valid transfer arrangements and legally required supplementary measures. This Policy is not an invented EU adequacy decision, standard contractual clause or representative appointment.

25.5 Rights and supervisory authorities. Applicable rights may include access, rectification, erasure, processing restriction, portability in eligible situations, objections to certain legitimate-interest processing or direct marketing, and rights concerning qualifying automated decisions. Individuals may also have a statutory right to complain to a competent data protection supervisory authority. The Studio will respect such requirements without separately creating a general entitlement to compensation, a partnership invitation, access to others’ records or disclosure of unrelated protected commercial know-how.

26. United Kingdom disclosures

Where UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, apply, the Studio will use the appropriate UK legal basis, data-protection principles, disclosure and request-handling rules. UK requirements for certain storage/access technologies and marketing are governed by applicable PECR provisions as amended. Some qualifying statistical or appearance/functionality storage may have narrow exceptions to prior consent with clear information and a simple free way to object; nonexempt tracking still requires the correct consent mechanism.

If the Studio’s intentional UK activity requires a UK representative under UK GDPR, it will appoint and identify an appropriate representative before the relevant processing continues, unless an applicable actual exemption applies. Restricted international transfers, significant automated decisions, rights requests and lawful exceptions will be handled under the UK legal framework actually in force at the relevant time. A UK individual may be entitled to complain to the UK Information Commissioner’s Office under the conditions prescribed by law.

27. United States and state-specific disclosures

U.S. privacy obligations may differ by state, business size or activity, and processing category. We do not assume that every U.S. state consumer statute automatically applies to a small overseas Studio; equally, the availability of the website to U.S. visitors does not exempt a business from laws whose territorial and commercial thresholds it satisfies. We will evaluate applicable notice, choice, data-security, marketing and breach-notification rules against the actual services and tracked data.

If the California Consumer Privacy Act and its applicable regulations govern the Studio’s activities, a California-specific disclosure and a notice at or before the point of collection must accurately identify the categories of Personal Information collected, their sources, business purposes, retention periods/criteria, the categories of recipients and any covered sale or sharing in the legally relevant look-back period. Applicable access, correction, deletion, opt-out, limit and anti-discrimination rights will be administered as required. We will not falsely claim to have sold data that we have not sold, nor treat noncash cross-context advertising relationships as categorically exempt from California’s broad defined concepts of sale and sharing.

27.3 Browser tracking signals and third-party collection. At launch, the Studio does not authorize cross-site behavioral-advertising pixels or retargeting on this Creator application website unless they are separately disclosed and lawfully activated. The browser’s legacy “Do Not Track” header does not, by itself, alter processing genuinely necessary for site delivery, security, email verification or application handling. If the Studio engages in an activity for which a valid Global Privacy Control or comparable preference signal must legally be recognized, we will honor that signal for that activity. Third parties providing necessary network, hosting, security, verification, communications and optional disclosed measurement services may independently receive technical data in the course of their functions; their actual roles and permitted uses are subject to the relevant terms and applicable law. The Studio will revise this disclosure if it enables additional cross-site tracking.

The Studio’s no-standalone-sale-of-creator-information commercial commitment remains as stated above. Independent creator-partnership applications must not automatically be treated as applications for U.S. employee positions; laws addressing employment applicants may impose additional duties only when the relevant legal definitions and entities are actually involved. Other U.S. state laws and consumer protection rules are considered where applicable.

28. India and the phased digital personal data framework

The Studio’s legal operator is based in Rajasthan, India. The Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 include provisions commencing on different notified dates, not one simultaneous date. We will determine the provisions in force at the time of collection or processing and comply with applicable notice, consent/legitimate-use, reasonable security, grievance handling, data-rights, processor and cross-border requirements as each becomes operative. The Studio will also honor any other binding Indian legal requirements governing information-security practices, communications, finance or lawful records.

Where applicable Indian law requires an accessible notice describing the particular Personal Data being processed and purpose, or a way to request correction, erasure or another statutory action, we will provide a compliant mechanism rather than claim that the general text of a privacy policy replaces operative notice/consent requirements. Language or accessibility requirements under Indian law will be addressed when applicable. The Studio may continue legitimate business data processing on a lawful basis, including for permitted legal obligations and claims, without inventing unconditional rights or exemptions.

The Studio may contract with a future incorporated company or otherwise transfer appropriate records as part of a lawful reorganization, but a successor controller and its obligations must be documented where required. Incorporation by itself does not retroactively erase any legal responsibility the sole proprietor had under applicable law.

29. Other countries and region-specific notices

Creators and potential collaborators in Canada, Switzerland, Australia, New Zealand and other jurisdictions may have additional privacy rights, statutory disclosure requirements or cross-border restrictions. Where a law is genuinely applicable, we will observe the relevant minimum disclosure, safeguards, communication and request procedures and add a suitable regional section or supplementary notice if needed. Describing this possibility does not represent that every jurisdiction’s rules presently apply to every website visitor.

Where a jurisdiction requires a shorter retention period, different consent mechanism, specific local contact or further permission for particular analytics or marketing, the Studio will implement the legally necessary measure in that jurisdiction rather than promising one uniform rule that is either unworkable or unlawfully broad. We will not issue unverified country-specific certifications, security compliance labels or contractual transfer statements.

30. Adults, children and unintended submissions

Current creator partnership applications are designed for adults aged 18 or over. We do not intentionally invite children to submit partnership applications or provide detailed information about themselves. If the Studio learns that an ineligible minor has submitted personal details, we may take appropriate steps to restrict, remove or otherwise lawfully handle that information, subject to relevant safeguarding and recordkeeping obligations.

Merely declaring that a website is for adults does not displace any law that protects minors who actually access an online service. If the future Studio expands into products directed to or likely accessed by children, the Product team must conduct a separate assessment and provide appropriate privacy protections and disclosures rather than silently using this adult creator-intake policy.

31. Accuracy, responsibilities and limitations of data sources

Applicants should provide materially accurate contact and professional information and keep their own submissions up to date as reasonably necessary to an ongoing assessment. The Studio may correct evident errors or note credible factual disputes. We may use reasonable verification measures to detect fabricated engagement or altered reports. A positive evaluation is not a warranty by the Studio of an applicant’s audience size, future performance or the accuracy of third-party platforms.

Public figures, engagement and platform dashboards can contain inaccuracies, platform-defined metrics and sampling limitations. The Studio may interpret those figures using its own legitimate commercial judgment. We are not obligated to disclose confidential review notes, third-party data or business formulas merely because an applicant disagrees with a commercial decision, except where access or other disclosure is legally required.

32. Changes to processing and this Policy

We may amend this Policy as the Studio evolves, including when creating or closing Products, reorganizing the business, introducing lawful verification methods, adopting new hosting or email systems, activating permitted analytics, adjusting retention or implementing new data-protection rules. Changes apply prospectively to the extent required by law; material new or incompatible processing may require additional notice, a lawful ground, refreshed consent or other local requirements before it begins.

This Policy carries its effective and revision dates above. The Studio may revise it prospectively to describe changed lawful processing, purposes, providers or legal obligations, and will provide notices or new consent where actually required. Continued browsing by itself is not consent to nonessential tracking, a materially incompatible new use or a waiver of mandatory privacy rights. No change to this Policy silently amends an executed Creator Partner Agreement or removes legitimately earned contractual rights.

33. Relationship to application terms, business decisions and legal rights

This Privacy Policy explains Personal Data practices; it does not require the Studio to evaluate, contact, fund, select or continue negotiating with any prospective applicant, nor does it grant or extinguish Product-specific economic rights. The separate Application Terms govern the nonbinding idea/application process, and actual Product participation only exists if a legally effective signed contract grants it and agreed conditions are fulfilled.

Nothing in this Policy prohibits the Studio from protecting its own legitimate intellectual-property interests, independently analyzing unprotected general ideas, refusing proposals, selecting qualified counterparts, investigating abuse, documenting genuine legal claims or pursuing lawful commercial transactions. Nothing in this Policy attempts to contract away mandatory data-protection obligations or applicable legal remedies; trying to do so would undermine the enforceability of the legitimate studio-protective provisions.

34. Contact, identity of the operator and required representatives

For questions about the processing described here, or to submit a request for which applicable law provides a right, contact [email protected]. Data controller/operator: Gunveer Sandhu, sole proprietor trading as The Founding Few, B-16, Sadul Ganj, Bikaner, Rajasthan 334001, India. Website: thefoundingfew.com. Where a validly appointed data-protection officer, EU representative, UK representative, statutory grievance contact or additional local contact must be identified, the Studio will provide the true relevant details through an applicable website or individual notice rather than naming a person who has not been appointed.

We may use reasonable identity verification and scope clarification when responding to a person-specific request, consistent with applicable law and security risks. We may also provide information through the required channel when a jurisdiction demands a particular grievance or complaint handling mechanism. A general privacy inquiry is not itself a commitment to a Creator partnership or an agreement concerning a submitted Product idea.

35. Supplemental country-specific and cookie disclosures

Information about actual device-storage or tracking categories, choices, purposes, recipients and retention is provided through this Policy and any cookie preferences/details that accompany the technology actually used. A region-specific supplement may apply when a particular jurisdiction legally requires additional details, representatives, links or choices. Such a supplement governs only the processing and individuals specified and does not extend every foreign regime to all visitors or create unrelated Creator commercial entitlements.

Where an applicable United States state, European or Indian privacy law requires more specific notice at the point of collection, a lawful opt-out or consent mechanism, a representative's verified contact details, or a particular complaint procedure, the Studio will supply the applicable information through its website or direct communications. The underlying scope of legally effective processing, including any required disclosure of a paid-data sale or cross-context sharing, follows the actual practices and binding law; this notice is not a claim that the Studio currently carries out every optional practice discussed above.