Open and Found: Privacy Notice

Last updated: 12 October 2026 · Version: 1.6

1. Who we are

Open and Found ("we", "us"), called Ivy At Yours until 12 October 2026, is the controller of the personal data described here.

Contact for anything privacy-related: hello@openandfound.com. We reply within 30 days.

2. What we collect

When you claim a page:

• Business name and the page address you reserve (for example yourname.openandfound.com)
• The services you offer, and your city, state or province (if you give one) and country
• Your email address, and your WhatsApp number if you add one
• Your consent choice, the wording you agreed to, and when

If you choose to add more (optional): your website, links to your Instagram, Facebook, TikTok or Google Maps profile, how you take bookings today, services, prices, and service area.

If you publish your page: it's public at your page address. It shows your business name, what you do, your city, state or province and country, and the optional details you added. Your email and WhatsApp number appear only if you tick the box to show them. We record when you first published and which version of the Terms you agreed to.

If someone reports a page: we keep a record of the page name, the reason and, if the person gave one, their contact details.

When you sign in: we email you a single-use link. We keep a record of each link (your address, when it was sent and used, and the claim details you typed until the link is used) for a day, so if you never open it those details are deleted after a day. A sign-in session lasts up to 30 days. Only scrambled (hashed) versions of links and sessions are stored. To limit pages per person, we also keep a simplified form of your address (lowercase, without a +tag at providers like Gmail and Outlook that ignore them, and without dots for Gmail).

When you use the site:

• The country and approximate city your connection comes from, worked out from your IP address. We use it to suggest page names and to prevent abuse. We do not store your IP address with your signup.
• Cloudflare Turnstile checks that you're a person, not a bot. It processes technical signals from your browser for that purpose only.

When you use the checker: the website address you enter and the result. This is information about a website, not about you, and we don't link it to your identity.

We don't knowingly collect sensitive data (such as health, religion or ethnicity). Please don't enter any.

3. Why we use it, and our legal basis

Nothing is published until you say so. Your page goes live only after you confirm it, and you can take it offline or delete it at any time. Once published, anyone can see it, and search engines and AI assistants may keep copies. We can't delete copies others have made, but we ask search engines to drop pages that are offline.

We don't sell your personal data, and we don't share it for cross-context behavioural advertising. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share it with

Only service providers that process data on our behalf, under contracts that require them to protect it and use it only for our instructions:

• Cloudflare, Inc. — hosting, database storage, security, Turnstile, and sending sign-in emails

When we start passing customer requests to you, we may share your business details with our affiliated service marketplaces operated by the same owner, only as needed to send you those requests.

We may disclose data if required by law, or to protect the rights and safety of our users or others. If our business is sold or merged, data may transfer to the new owner under this notice.

5. Where it's stored

Your data is stored with Cloudflare in the European Union. Our service providers may access it from other countries (including the United States and Canada). Where data leaves the EU/UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. For residents of Malaysia and Canada: your data may be processed outside your country, in places with data protection laws that may differ from yours; we protect it as described here.

6. How long we keep it

• Signups and page details: until you delete your page or withdraw consent. If your page has never gone live within 18 months of signing up, we delete your details. Taking a page offline hides it but keeps your details, so you can put it back.
• Takedown records (page name, reason, and the reporter's contact if given): 12 months.
• Sign-in link records: 1 day. Sign-in sessions: 30 days, or until you sign out. Your account ends when your last page is deleted, or a day after sign-in if no page was created.
• Consent records (your choice, the wording you agreed to, and when): for as long as we hold your signup. If you delete your page, they're deleted with it.
• The page name you reserved: kept after you delete your page, on its own, so nobody else can take it. It isn't linked to you.
• Backups: deleted data can stay in our database backups for up to 30 days before it's gone.
• Security and abuse logs: up to 30 days.
• Checker results: up to 30 days, or while a site is shown on the public list. Checks of Open and Found page addresses (yourname.openandfound.com) aren't stored.

7. Your rights

Wherever you are, you can ask us to:

• access the data we hold about you, and get a copy
• correct anything that's wrong
• delete your data
• withdraw consent at any time (this doesn't affect what we did before you withdrew)
• object to or restrict how we use it
• move your data to another service (portability)
• stop any direct marketing at any time

Email hello@openandfound.com or reply to any email from us. We may need to confirm your identity. We'll respond within 30 days (one month under GDPR) and won't charge you or treat you differently for using your rights.

California residents also have the right to know what personal information we collect, use and disclose; to delete and correct it; and to opt out of sale or sharing (we don't sell or share it).

You can complain to a data protection authority, for example:

• EU: your local supervisory authority
• UK: Information Commissioner's Office (ico.org.uk)
• Canada: Office of the Privacy Commissioner (priv.gc.ca); Quebec: Commission d'accès à l'information
• Malaysia: Personal Data Protection Commissioner (pdp.gov.my)
• Australia: Office of the Australian Information Commissioner (oaic.gov.au)

We'd appreciate the chance to fix it first, so please contact us.

8. Cookies

We use only cookies and similar technologies that are strictly necessary: Cloudflare's security and Turnstile checks, and one Open and Found cookie that keeps you signed in after you use a sign-in link (__Host-ivy, 30 days, removed when you sign out). We don't use advertising or analytics cookies, so there's no cookie banner. If that changes, we'll ask first.

9. Security

Data is encrypted in transit (HTTPS) and at rest, access is limited to people who need it, and forms are protected against bots. No system is perfectly secure; if a breach affects you, we'll tell you and the relevant authorities as the law requires.

10. Children

Open and Found is for businesses. You must be at least 18 to use it, and we don't knowingly collect data from anyone younger.

11. Changes

If we change this notice, we'll update the date above. If a change materially affects how we use data you've already given us, we'll tell you before it takes effect and ask for consent where required.

12. Contact

Open and Found · hello@openandfound.com