Privacy Policy

Last updated: 20 September 2026

The Fundamental Wellbeing Foundation (“Foundation,” “we,” “us,” or “our”) respects your privacy and is committed to handling personal information responsibly and transparently.

This Privacy Policy explains how we collect, use, disclose, retain, and otherwise process personal information in connection with the websites, applications, digital platforms, services, content, tools, and other online properties operated by or on behalf of the Foundation, including, without limitation, The Finders platform and application, The Finders website, the Fundamental Wellbeing Foundation website, and related services that link to or reference this Privacy Policy (collectively, the “Services”).

Not every type of information or processing described in this Privacy Policy applies to every Service. For example, some Services may provide only informational content, while others may include accounts, assessments, community features, artificial intelligence, research activities, events, donations, or other functionality.

Please also review our Terms of Use and Disclaimer for important information about your use of the Services.

1. Who Is Responsible for Your Information

Unless a feature-specific notice states otherwise, the Fundamental Wellbeing Foundation, a Wyoming nonprofit corporation recognized as tax-exempt under Section 501(c)(3) of the U.S. Internal Revenue Code, is responsible for determining how and why personal information is processed in connection with the Services.

For purposes of data protection laws such as the European Union General Data Protection Regulation (“GDPR”), where applicable, the Foundation generally acts as the data controller.

In some research projects, events, partnerships, or other activities, another organization may act as an independent controller, joint controller, or other responsible party. Where appropriate, additional information will be provided in connection with that activity.

Privacy contact: privacy@thefinders.org

2. Information We Collect

The information we collect depends on how you interact with the Services and which features you use.

Account and Contact Information

When you create or maintain an account, contact us, subscribe to communications, register for an event, or otherwise interact with us, we may collect information such as:

name;
email address;
username or display name;
account identifiers;
authentication and account-security information;
communication preferences;
support inquiries and correspondence; and
other information you choose to provide.

Profile and Community Information

If you participate in community features, we may collect information such as:

profile photo or avatar;
biography;
optional geolocation, address, city or region;
interests or preferences;
public posts and comments;
reactions and other community interactions;
group membership;
event participation or RSVP status;
partner-work or community-matching preferences;
reports submitted about content or users; and
information you choose to make available through your profile or community activity.

The visibility of this information depends on the feature and settings involved.

Assessments, Reflections, and Wellbeing Information

Certain Services may allow you to complete assessments, questionnaires, exercises, reflections, journals, wellbeing tracking, or similar activities.

Information collected may include:

assessment questions and responses;
assessment scores, classifications, or results;
written reflections;
journal entries;
exercise responses;
personal wellbeing observations;
progress or tracking information;
educational recommendations;
course or program progress; and
information you voluntarily provide about your experiences.

Some of this information may, depending on its content and applicable law, be considered sensitive personal information or special-category personal data, including information that may reveal aspects of physical or mental health, philosophical beliefs, religious beliefs, or other protected characteristics.

Artificial Intelligence Interactions

If you use AI-powered features, we may collect and process information such as:

prompts and questions;
written reflections or other text submitted to an AI feature;
relevant conversation history;
AI-generated responses;
feedback concerning AI responses;
safety or moderation classifications;
technical information necessary to operate the feature; and
contextual information reasonably necessary to generate a response.

Depending on the feature and what you choose to provide, AI inputs may contain sensitive or personal information.

You should avoid including unnecessary identifying, medical, financial, confidential, or otherwise highly sensitive information in AI prompts.

Direct Messages

Where messaging features are available, we process:

message content;
sender and recipient information;
timestamps;
message status;
attachments where supported; and
information associated with abuse, safety, or support reports.

Direct messages are intended for the participants in the conversation but are not end-to-end encrypted unless we expressly state otherwise.

As described in our Terms of Use, authorized personnel or service providers may access messages where reasonably necessary for support, security, moderation, abuse investigation, legal compliance, or other permitted purposes.

Location Information

We may process different levels of location information depending on the feature.

This may include:

a city or region that you voluntarily add to your profile;
approximate location inferred from an IP address; or
precise device location where you affirmatively enable a feature that requires it.

Precise device location is optional unless expressly stated otherwise for a particular feature. You can generally prevent collection of precise location by declining or withdrawing device or browser permissions.

Location information may be used for features such as nearby-member discovery, location-based groups, event functionality, or community matching where those features are available.

Course and Service Activity

We may collect information about how you interact with educational and other Service features, including:

courses or materials viewed;
progress and completion status;
exercises completed;
feature usage;
navigation through the Services;
saved preferences;
interaction timestamps; and
other activity necessary to maintain your account experience.

Research Information

Where you voluntarily participate in a research study or other research activity, we may collect information described in the applicable research notice or consent materials.

This may include:

research responses;
study identifiers;
consent records;
eligibility information;
study participation records;
assessments;
follow-up responses; and
other information relevant to the particular research project.

Research activities may be subject to additional privacy disclosures, consent forms, protocols, or other documentation.

Donation and Transaction Information

If you make a donation, we may process information such as:

name and contact details;
donation amount;
date and transaction status;
donation history;
billing-related information;
tax receipt or acknowledgment information; and
communications relating to your donation.

Payment card information may be collected and processed directly by third-party payment processors. We may receive transaction information without receiving or retaining complete payment-card details.

Communications and Email Activity

If you subscribe to newsletters, participate in programs, or receive other communications, we may process:

your email address;
subscription preferences;
mailing-list membership;
delivery and bounce information;
unsubscribe information; and
where permitted by applicable law and your applicable choices, engagement information such as email opens or link clicks.

We may use third-party communications platforms to send and manage these communications.

Technical, Device, and Usage Information

When you use the Services, we or our service providers may automatically receive information such as:

IP address;
browser type;
device type;
operating system;
application version;
language and regional settings;
cookie or similar identifiers;
session information;
referring pages or sources;
pages or features accessed;
interaction and navigation information;
timestamps;
crash reports;
performance information; and
security and diagnostic logs.

Moderation and Safety Information

To maintain community and Service safety, we may process information relating to:

reported content;
reported accounts;
potential violations of our Terms or Community Guidelines;
automated moderation indicators;
keyword or pattern matches;
AI-generated safety classifications;
manual moderation decisions;
restrictions or enforcement actions; and
related communications and appeals.

3. Information We Receive from Other Sources

Most information we process is provided directly by you or generated through your use of the Services.

We may also receive information from:

other users, such as when another member reports content or interacts with you;
event organizers or partners where you participate in an applicable activity;
authentication or identity providers where you choose to use such a service;
analytics and technology providers;
payment and donation processors;
communications platforms;
service providers assisting us with security, fraud prevention, or support; and
other sources where permitted by law and relevant to providing or protecting the Services.

Where applicable law requires us to tell you about personal information obtained indirectly, we will provide the required information.

4. How We Use Personal Information

We process personal information for purposes including the following.

Providing the Services

We use information to:

create and maintain accounts;
authenticate users;
provide requested content and functionality;
maintain profiles and preferences;
provide assessments and educational tools;
calculate and display assessment results;
maintain progress and history;
provide community features;
operate direct messaging;
enable groups and events;
provide location-based functionality where enabled;
respond to requests; and
provide technical and customer support.

Educational Personalization

We may use assessment responses, previous activity, preferences, or other relevant information to personalize educational content, recommendations, or the presentation of Service features.

Such personalization is intended for educational purposes and is not medical diagnosis or treatment.

Artificial Intelligence Features

We may process information submitted to AI Features to:

generate requested responses;
provide interactive reflections;
maintain relevant conversational context;
operate AI-assisted educational experiences;
identify potentially unsafe or inappropriate outputs;
evaluate technical performance;
troubleshoot errors; and
improve the reliability and safety of the Services.

Information necessary to perform these functions may be transmitted to third-party AI and technology providers as described below.

Community and Communications

We use information to:

display information you choose to share;
facilitate interactions between members;
deliver messages;
operate groups and events;
provide community matching;
manage reports;
communicate about relevant Service activity; and
maintain community functionality.

Safety, Moderation, and Abuse Prevention

We may process User Content and related information to detect or respond to potential violations, harmful content, abuse, security threats, fraud, or other misuse.

We may use automated systems including:

keyword detection;
rule-based triggers;
pattern recognition;
machine-learning systems; and
artificial intelligence moderation tools.

Content submitted through certain features may be automatically screened before or after submission.

If automated systems flag content as potentially harmful, dangerous, inappropriate, or otherwise requiring review, we may temporarily withhold the content from publication and route it for manual pre-moderation before it becomes visible to other users.

Automated moderation systems may produce false positives or fail to identify problematic material.

The Foundation does not undertake an obligation to continuously monitor all users, communications, or content, and users must not rely on moderation systems as emergency, medical, mental health, or crisis-monitoring services.

Analytics and Service Improvement

We may analyze information to:

understand how Services are used;
measure traffic and engagement;
identify technical problems;
improve usability;
evaluate feature performance;
develop new functionality;
understand general usage patterns; and
maintain the reliability and security of the Services.

Where required by applicable law, non-essential analytics technologies are used only with appropriate consent.

Research, Scientific, and Statistical Purposes

The Foundation may conduct, support, facilitate, or collaborate on research concerning Fundamental Wellbeing and related topics.

Identifiable personal information used for formal research will be handled in accordance with applicable law and, where appropriate, research-specific notices, consent materials, or other safeguards.

We may also create aggregated or anonymized information from information collected through the Services.

Where information has been lawfully anonymized so that it no longer identifies you and cannot reasonably be linked back to or used to reidentify you, we may use and disclose that information for:

scientific research;
statistical analysis;
publications;
educational research;
understanding Fundamental Wellbeing;
improving assessments and methodologies;
improving the Services; and
other lawful research or analytical purposes.

Where permitted by applicable law, genuinely anonymized or aggregated information may be used for these purposes without obtaining additional consent, because it is no longer treated as personal information.

We do not intend to attempt to reidentify information that has been intentionally anonymized, except where reasonably necessary to test the effectiveness of anonymization safeguards or where otherwise permitted or required by law.

Communications

We may use contact information to send:

account and security notices;
administrative messages;
Service updates;
requested information;
event reminders;
research-related communications where applicable; and
newsletters, fundraising communications, or other marketing where permitted by applicable law.

You can unsubscribe from promotional communications using the unsubscribe mechanism included in those communications and/or the Services.

Certain essential administrative, security, legal, or transactional communications may still be sent where necessary.

Legal, Security, and Organizational Purposes

We may process information to:

comply with legal obligations;
respond to lawful legal process;
establish, exercise, or defend legal claims;
investigate violations of our Terms;
protect the Foundation, users, or third parties;
detect and prevent fraud or security incidents;
maintain records required by law; and
manage organizational governance and operations.

5. Legal Bases for Processing in the EEA, United Kingdom, and Similar Jurisdictions

Where the GDPR, UK GDPR, or another law requiring a legal basis applies, the legal basis depends on the purpose and circumstances of the processing.

We may rely on:

Performance of a Contract

Processing may be necessary to provide Services you request under our Terms of Use, such as:

creating and maintaining your account;
providing requested features;
processing assessment functionality;
delivering community functionality;
providing AI Features you choose to use; and
responding to Service requests.

Legitimate Interests

We may process information where necessary for legitimate interests pursued by the Foundation or another party, provided those interests are not overridden by your rights and interests.

These interests may include:

operating and improving the Services;
maintaining security;
preventing fraud and abuse;
enforcing our Terms;
understanding general Service usage;
providing appropriate support;
protecting our organization and users; and
developing and improving educational functionality.

Where required, we assess whether those interests are proportionate and compatible with your reasonable expectations.

Consent

We may rely on consent where appropriate, including:

cookies and analytics technologies;
marketing communications;
precise-location features;
optional research participation;
sensitive information processing;
AI or personalization features; or
other activities for which applicable law requires consent.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before the consent was withdrawn.

If certain Services or features require the processing of information for which you withdraw consent, those Services or features may become unavailable or may no longer function as intended. We will not condition access to unrelated Services on consent where such consent is not necessary for those Services.

Legal Obligations

We may process information where necessary to comply with a legal obligation applicable to the Foundation.

Vital Interests

In rare circumstances, we may process or disclose personal information where permitted by law and reasonably necessary to protect the vital interests of an individual.

Nothing in this provision means that the Foundation undertakes a duty to monitor users, identify emergencies, diagnose crises, or provide emergency response.

6. Sensitive and Special-Category Information

Some information you provide may qualify as sensitive personal information under applicable law.

Under the GDPR and similar laws, certain information receives additional protection, including information concerning:

physical or mental health;
racial or ethnic origin;
religious or philosophical beliefs;
political opinions;
trade-union membership;
genetic or certain biometric information;
sex life; or
sexual orientation.

We do not require users to disclose most of these categories in ordinary use of the Services.

However, because users may freely describe personal experiences in assessments, reflections, journals, AI interactions, messages, or community content, information of this nature may sometimes be provided voluntarily.

Where processing is subject to additional legal restrictions, we will rely on an applicable condition permitting that processing, such as:

your explicit consent where appropriate;
processing necessary to establish, exercise, or defend legal claims;
protection of vital interests where legally permitted;
scientific research carried out under applicable legal requirements and safeguards; or
another basis expressly permitted by applicable law.

We seek to limit collection and use of sensitive information to what is reasonably necessary for the applicable purpose.

7. Automated Processing, AI, and Moderation

We use automated technologies in certain parts of the Services.

These may include systems that:

generate AI responses;
personalize content;
calculate assessment results;
identify patterns in Service use;
detect spam or abuse;
identify keywords or potentially concerning content;
assign moderation or safety indicators; or
route content for manual review.

Automated systems may analyze information you submit together with relevant contextual or technical information.

A moderation trigger may result in content being temporarily withheld from publication pending manual review.

Automated systems are imperfect. They may misunderstand context, generate incorrect outputs, fail to identify problematic material, or incorrectly flag acceptable content.

Where applicable law provides rights concerning decisions made solely by automated means that produce legal or similarly significant effects, we will provide the disclosures, safeguards, and rights required by that law.

Our AI, assessment, and moderation systems are not intended to perform medical or mental health diagnosis or to function as emergency-monitoring systems.

8. When We Share Personal Information

We do not disclose personal information indiscriminately. We may disclose information in the circumstances described below.

Service Providers and Technology Partners

We use third-party providers to help operate, secure, deliver, analyze, and support the Services.

Depending on the service involved, these providers may process information on our behalf or, in some circumstances, under their own applicable responsibilities.

Examples currently may include:

Type of provider	Examples	Information that may be processed
Analytics	Google Analytics and similar providers	device, browser, IP, cookie or device identifiers, Service interaction and usage information
Artificial intelligence	OpenAI, Groq, and other AI/model or infrastructure providers	prompts, responses, relevant conversation context, safety information, and technical metadata necessary to operate AI Features
CRM and supporter management	NeonOne and similar providers	contact details, supporter records, communication preferences, donation history, and related CRM information
Video hosting and content delivery	video hosting/CDN providers	IP address, device/request information, video or content requests, and delivery logs
Hosting, databases, infrastructure, and security	cloud hosting, database, monitoring, authentication, backup, security, and infrastructure providers	information reasonably necessary to host, store, secure, transmit, authenticate, or maintain the Services
Email and communications	email delivery, newsletter, messaging, and communications providers	contact details, message delivery information, preferences and, where permitted, engagement information
Payment and donation processing	payment processors and financial service providers	transaction, billing, payment, fraud-prevention, and donation information
Support and operational services	customer support, technical, development, moderation, and professional service providers	information reasonably necessary to perform the relevant service

This list is illustrative and not exhaustive.

Our providers may change over time as technologies and operational needs change.

Not every provider receives every category of information. We seek to limit disclosures to information reasonably necessary for the relevant purpose.

Some providers may use additional infrastructure providers or subprocessors in providing their services. Where applicable, these downstream providers may therefore process information as part of the relevant processing chain.

We seek to use contractual, organizational, and technical safeguards appropriate to the nature of the information and applicable law. However, the use of complex global technology infrastructure means that information may be processed by multiple authorized parties and in multiple jurisdictions.

AI Providers

When you use an AI Feature, relevant information may be transmitted to one or more AI, model-hosting, inference, safety, or infrastructure providers.

Depending on the feature, this may include:

the text you submit;
relevant prior conversation context;
instructions necessary for the feature;
AI responses;
moderation or safety information; and
limited technical information.

We seek to avoid transmitting unnecessary directly identifying account information where it is not required for the relevant AI function. However, we do not promise that all information transmitted to AI systems will always be anonymous or incapable of identifying a user, particularly where a user includes personal information within their own input or where context is required to provide the requested Service.

AI providers may use authorized subprocessors or infrastructure partners in providing their services.

The exact providers used may vary by feature and may change over time.

Other Users

Information you intentionally publish or share through community features may be disclosed to other users according to the nature and settings of the feature.

For example, other signed-in members may be able to see:

your display name;
profile image;
profile biography;
optional city or region;
public posts;
comments;
group participation;
event participation; or
other information you choose to make visible.

Direct messages are made available to their intended participants but are not end-to-end encrypted unless expressly stated otherwise.

We cannot control how another person may use, copy, retain, screenshot, or redistribute information you voluntarily disclose to them.

Research Partners and Collaborators

Where the Foundation collaborates with researchers, universities, research organizations, or other partners, information may be shared as described in the relevant research notice, consent materials, agreements, or applicable law.

Where reasonably possible and appropriate, research information may be anonymized, aggregated, coded, or otherwise protected before disclosure.

Genuinely anonymized information that no longer constitutes personal information may be shared for research, publication, statistical, or educational purposes without identifying individual users.

Legal and Safety Reasons

We may disclose information where we reasonably believe disclosure is permitted or required to:

comply with law;
respond to a valid legal request;
protect legal rights;
investigate fraud or unlawful activity;
protect the security or integrity of the Services;
enforce our Terms;
investigate abuse or threats; or
protect the rights or safety of the Foundation, users, or other persons.

A right to disclose information for safety purposes does not create an obligation to monitor all users or identify medical, mental health, or crisis situations.

Professional Advisers

We may disclose information where reasonably necessary to professional advisers such as attorneys, accountants, auditors, insurers, consultants, or similar advisers subject to appropriate duties of confidentiality.

Organizational Transactions

If the Foundation undergoes a reorganization, restructuring, merger, transfer of operations or assets, or similar organizational transaction, personal information may be disclosed or transferred where reasonably necessary and permitted by law.

Any recipient will be required to process personal information consistently with applicable law and relevant commitments.

9. Sale and Sharing of Personal Information

WE DO NOT SELL PERSONAL INFORMATION for monetary consideration as part of our ordinary operations.

Some U.S. privacy laws define “sale” or “sharing” much more broadly than an ordinary monetary sale and may treat certain disclosures involving analytics, cookies, identifiers, or advertising technologies as a sale or sharing depending on the circumstances.

We do not knowingly sell personal information obtained through assessments, private messages, journals, AI reflections, or research participation for monetary consideration.

10. Cookies, Analytics, and Similar Technologies

Our websites and applications may use cookies, software development kits (“SDKs”), local storage, pixels, device identifiers, and similar technologies.

These may be used for purposes such as:

authentication;
security;
remembering preferences;
maintaining sessions;
preventing abuse;
measuring performance;
understanding usage;
analytics;
troubleshooting; and
providing embedded or third-party functionality.

Some technologies are necessary for the Services to function.

Other technologies, including certain analytics or tracking technologies, may require your consent depending on your location and applicable law.

Where consent is legally required, we will seek consent before using the relevant non-essential technologies and provide a means to withdraw or modify that choice.

We may use services such as Google Analytics to understand Service usage and performance. These services may process technical information, online identifiers, device information, and interaction data.

You may also be able to manage cookies through your browser, device settings, or any cookie-preference controls we make available.

Blocking certain necessary technologies may affect Service functionality.

We may provide a separate Cookie Policy or preference interface with additional information regarding particular technologies used at a given time.

11. Communications and Email Service Providers

We may use third-party platforms to deliver:

account communications;
newsletters;
event information;
educational communications;
fundraising communications;
research communications; and
other emails.

These providers may process information such as your email address, subscription status, delivery status, and other technical information necessary to send the communication.

Where permitted by law and consistent with applicable consent requirements, communications may also include technologies used to understand whether a message was delivered, opened, or interacted with.

Because communications providers may change over time, we do not necessarily identify every communications platform individually in this Privacy Policy.

You may opt out of non-essential promotional communications at any time using the unsubscribe mechanism provided.

12. Community Privacy

Community features involve information being shared with other people.

Before submitting information, consider the audience of the feature you are using.

Profiles

Information designated as part of your community profile may be visible to other signed-in members.

Posts and Comments

Content published to a community area is visible to the audience associated with that area.

Groups

Group membership, posts, comments, or participation may be visible to other members of that group or community where necessary for the feature.

Events

Event hosts, attendees, or members may be able to see information such as event details, host identity, RSVP status, or attendance information where necessary to operate the event feature.

Direct Messages

Direct messages are intended for conversation participants but are not end-to-end encrypted unless expressly stated otherwise.

They may be accessible to authorized personnel or service providers where reasonably necessary for security, abuse prevention, support, legal compliance, or enforcement.

13. Location Features

We may offer features designed to connect users based on general or precise location.

Providing precise location is optional unless expressly stated otherwise.

Where you authorize precise device location:

your device or browser may transmit location coordinates;
we may use the information to determine nearby members, groups, or events;
location information may be processed by infrastructure providers supporting the feature; and
we will seek to limit use to the functionality and related safety, security, or operational purposes disclosed to you.

You can generally withdraw location permission through your browser, device, or application settings.

Disabling location may prevent certain location-based features from working.

We encourage users not to publish precise home addresses or other sensitive location information in public community areas.

14. Research and Anonymized Information

The Foundation may use information to advance understanding of Fundamental Wellbeing and related subjects.

Research involving identifiable participants may be subject to separate research disclosures and consent requirements.

Separately, we may transform Service information into aggregated or anonymized information designed so that individual users can no longer reasonably be identified.

Where information has been rendered genuinely anonymous under applicable law:

it is no longer treated as personal information;
it may be combined with information from other users;
it may be retained for an extended or indefinite period;
it may be used for research and statistical purposes;
it may be used to improve assessments, educational frameworks, and Services;
it may be included in research findings or publications; and
it may be shared with researchers or other organizations without identifying individual users.

Removing obvious identifiers such as a name or email address does not automatically make information anonymous.

Where information remains capable of being linked back to an individual, including through a key or other reasonably available information, we continue to treat it as personal information where required by law.

15. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services, maintaining legitimate operational records, conducting permitted research, protecting security, resolving disputes, and complying with legal obligations.

Retention periods vary depending on the type of information and context.

We generally apply considerations such as:

Information	General retention considerations
Account and profile information	generally retained while the account remains active and for a reasonable period afterward where needed for deletion processing, security, legal obligations, or dispute resolution
Community content	generally retained while published or associated with an active account, subject to deletion, moderation, safety, legal, and backup requirements
Direct messages	may be retained while necessary to provide messaging and for reasonable security, abuse-prevention, legal, and backup purposes
Assessment and wellbeing information	may be retained while needed to provide your history, progress, results, or educational functionality, subject to account deletion and applicable legal requirements
AI interactions	may be retained as necessary to provide conversation history, operate the feature, troubleshoot, maintain safety, and meet legal or security requirements; third-party AI providers may apply their own authorized retention periods
Location data	retained according to the functionality involved and generally no longer than reasonably necessary for that feature, security, or applicable legal requirements
Analytics and technical logs	retained for periods reasonably necessary for analytics, security, troubleshooting, and system operation
Donation and financial records	retained as necessary to comply with accounting, tax, nonprofit, fraud-prevention, and legal requirements
Research information	retained according to applicable study documentation, research requirements, consent terms, legal obligations, and research integrity requirements
Moderation and safety records	may be retained as necessary to investigate abuse, enforce restrictions, protect users, prevent repeated violations, and establish or defend legal claims
Anonymized information	may be retained indefinitely where it can no longer reasonably identify an individual

Deletion from active systems may not result in immediate removal from backup systems. Backup copies may remain until overwritten or deleted according to normal backup-retention processes.

We may also retain limited information after account deletion where required or permitted for legal, security, fraud-prevention, research-integrity, dispute, or enforcement purposes.

16. Data Security

We use technical and organizational measures designed to protect personal information against unauthorized access, alteration, loss, misuse, disclosure, or destruction.

Depending on the systems and risks involved, measures may include:

access controls;
authentication protections;
encryption in transit or at rest where appropriate;
infrastructure and network security;
backups;
logging and monitoring;
role-based access;
vendor security review;
contractual confidentiality and data-protection obligations;
incident-response procedures; and
administrative safeguards.

We seek to apply measures appropriate to the sensitivity and risk associated with the information being processed.

However, no method of electronic transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.

Users are also responsible for maintaining the confidentiality of their account credentials and taking reasonable steps to protect their devices and accounts.

If we become aware of a personal-data breach requiring notification under applicable law, we will provide notices to affected individuals and/or regulators as legally required.

17. International Data Transfers

The Foundation is based in the United States, and our service providers, technology partners, researchers, and other authorized recipients may operate in the United States and other countries.

As a result, personal information may be transferred to, stored in, or processed in countries outside your country of residence.

Privacy and data-protection laws in those countries may differ from the laws where you live.

Where the GDPR or another law restricts international transfers, we use or require an applicable legal mechanism where necessary, which may include:

an adequacy decision;
Standard Contractual Clauses approved by the European Commission;
applicable UK or Swiss transfer mechanisms;
participation by an eligible recipient in an approved privacy framework;
another approved contractual or certification mechanism; or
a legally permitted derogation in appropriate circumstances.

Where appropriate, additional contractual, technical, or organizational safeguards may be applied.

Service providers may themselves use authorized subprocessors located in different jurisdictions.

18. Your Privacy Rights

Depending on where you live and applicable law, you may have some or all of the following rights.

Access

You may have the right to request confirmation of whether we process your personal information and obtain access to that information.

Correction

You may have the right to request correction of inaccurate or incomplete personal information.

Deletion

You may have the right to request deletion of personal information, subject to exceptions such as legal obligations, security requirements, research requirements where applicable, exercise or defense of legal claims, or other permitted retention.

Restriction

You may have the right to request restriction of certain processing.

Data Portability

Where applicable, you may have the right to receive certain personal information in a structured, commonly used, machine-readable format and, where technically feasible and legally required, transmit it to another controller.

Objection

You may have the right to object to processing based on legitimate interests or to object to certain other uses of your personal information.

You have the right to object to direct marketing where applicable.

Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

Automated Decision-Making

Where applicable law provides such rights, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Complaint to a Supervisory Authority

If you are located in the EEA, United Kingdom, or another jurisdiction providing such a right, you may lodge a complaint with the data-protection authority responsible for your location or otherwise competent for the processing.

We encourage you to contact us first if you have a privacy concern so that we have an opportunity to address it.

19. How to Exercise Your Rights

You may submit a privacy request by contacting:

privacy@thefinders.org

Please describe the right you wish to exercise and provide enough information for us to identify the relevant account or records.

For privacy and security reasons, we may need to verify your identity before completing certain requests.

We will use information supplied for verification only as reasonably necessary to verify and process the request.

Where permitted by law, we may decline or limit a request that:

cannot reasonably be verified;
is manifestly unfounded or excessive;
would adversely affect another person’s rights;
conflicts with legal or research-related retention obligations; or
falls within another applicable legal exception.

We will respond within the time required by applicable law.

20. California Privacy Information

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), generally does not apply to nonprofit organizations in the same manner that it applies to covered businesses.

Nevertheless, to the extent the CCPA or similar California requirements apply to a particular activity, or where we voluntarily provide similar rights as a privacy practice, California residents may have the rights described below.

This section is not intended as an admission that the Foundation is a “business” subject to every provision of the CCPA.

Categories of Personal Information

Depending on how you use the Services, we may collect categories of personal information corresponding to California classifications such as:

Identifiers, including name, email address, IP address, account identifiers, and online identifiers;
Customer or account information, including account, contact, and donation-related information;
Characteristics or demographic information, where voluntarily provided;
Commercial or transaction information, including donation or payment history;
Internet or electronic network activity, including browsing, usage, device, and interaction information;
Geolocation information, including approximate location and precise location where voluntarily enabled;
Audio, visual, or similar information, such as profile images or media you choose to submit;
Professional or employment-related information, where voluntarily included in a profile or activity;
Inferences, such as assessment results, preferences, recommendations, or other information generated from your interactions; and
Sensitive personal information, potentially including precise geolocation, private communications, account-security information, and information concerning health or other sensitive characteristics where you choose to provide it.

The categories collected depend on the Services you use.

Sources

These categories may be collected from:

you;
your device or browser;
your interaction with the Services;
other users;
service providers;
event or research partners; and
other sources described in this Privacy Policy.

Purposes

We use these categories for the purposes described in How We Use Personal Information, including:

providing Services;
account administration;
educational personalization;
AI functionality;
community features;
research;
analytics;
communications;
security;
moderation;
fraud prevention;
donations;
legal compliance; and
organizational operations.

Categories of Recipients

We may disclose relevant categories of personal information to:

technology and hosting providers;
analytics providers;
AI providers;
CRM providers;
communications providers;
payment processors;
security and moderation providers;
researchers or research collaborators where applicable;
professional advisers;
other users where you direct or intentionally publish information; and
government authorities or others where legally permitted or required.

California Rights

Where applicable, California residents may have rights to:

know the categories and specific pieces of personal information collected;
know the sources, purposes, and categories of recipients;
request deletion;
request correction;
opt out of qualifying sales or sharing;
limit certain uses or disclosures of sensitive personal information;
receive information about applicable disclosures; and
exercise privacy rights without unlawful discrimination.

Where applicable law permits use of an authorized agent, we may require appropriate proof of authorization and identity verification.

Global Privacy Control and Opt-Out Signals

Where applicable law requires us to recognize an opt-out preference signal such as Global Privacy Control, we will process recognized signals in accordance with applicable requirements.

Sale and Sharing

We do not sell personal information for monetary consideration in the ordinary meaning of “sell.”

If our use of analytics, identifiers, advertising, or other technology constitutes a “sale” or “sharing” under applicable California law, we will provide the legally required means to opt out.

Sensitive Personal Information

We use sensitive personal information for the purposes disclosed in this Privacy Policy and, where applicable law provides a right to limit additional uses, we will provide the required mechanism.

21. Users Outside California

Residents of other U.S. states or countries may have additional privacy rights under applicable local laws.

Where those laws apply, we will honor rights and provide disclosures as required.

Nothing in this Privacy Policy is intended to limit privacy rights that cannot lawfully be waived.

22. Children and Age Requirements

Account-based Services are generally intended for individuals who have reached the age of majority and have the legal capacity to agree to our Terms in the jurisdiction where they reside, unless we expressly state otherwise for a particular Service and applicable law permits such use.

We do not knowingly permit individuals who do not meet the applicable eligibility requirements to maintain accounts where those requirements apply.

If we learn that personal information has been collected from an individual who was not legally eligible to provide it or use the relevant Service, we may delete, restrict, or otherwise process the information as required by applicable law.

Parents, guardians, or others who believe that an ineligible minor has provided personal information may contact us at privacy@thefinders.org.

23. Third-Party Websites and Services

The Services may contain links to or integrations with websites, applications, embedded content, social platforms, payment systems, event services, or other third-party services.

This Privacy Policy does not necessarily govern independent third parties.

Third parties may collect and process information under their own privacy notices and legal responsibilities.

We encourage you to review the privacy practices of third-party services before providing information to them.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes to the Services;
new technologies or providers;
changes to research activities;
legal or regulatory developments;
changes to our data practices; or
security and operational requirements.

The “Last updated” date at the top identifies the most recent revision.

If we make material changes, we will provide notice where required or appropriate, which may include:

a notice through the Services;
an account notification;
email; or
another appropriate method.

Where applicable law requires consent before a materially different processing activity begins, we will request that consent rather than relying solely on an updated Privacy Policy.

25. Contact Us

Questions, privacy requests, or concerns relating to this Privacy Policy or our processing of personal information may be sent to:

Fundamental Wellbeing Foundation
PO Box 8906, Jackson, WY 83002
Email: privacy@thefinders.org
Subject: Privacy Inquiry

If you are exercising a statutory privacy right, please state the nature of your request so that we can route it appropriately.

Where applicable law requires the Foundation to designate a Data Protection Officer, EEA representative, UK representative, or similar privacy contact, the relevant contact information will be provided here or through an applicable supplemental privacy notice.