Founder Growth Collective logo

/ Privacy Policy

Privacy Policy

Last updated: September 2026

1. Who we are

Founder Growth Collective is a UK-based sales function design and advisory firm working with funded, founder-led startups. This privacy policy explains how we collect, use, store and protect personal information provided to us through our website, contact form and discovery-call booking system.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is Founder Growth Collective (referred to in this policy as "we", "us" or "our").

2. What personal information we collect

We only collect personal information that is necessary to respond to your enquiry, arrange and conduct a discovery call, and provide our services. In particular we may collect:

  • Contact form information: first name, last name, work email address, company name and any details you choose to include in the enquiry field.
  • Discovery-call booking information: first name, last name, work email address, company name, the date and time you select, and anything you tell us in the optional "Anything you'd like Hannah to know before the call?" field.
  • Correspondence: the content of emails or other messages you send to us.
  • Technical information: limited technical information about your visit that is automatically logged by our hosting infrastructure (such as IP address and browser type) for security, diagnostic and abuse-prevention purposes.

We do not intentionally collect special category (sensitive) personal data. Please do not include such information in the free-text fields of our forms.

3. How and why we use your information

We use personal information for the following purposes:

  • To respond to enquiries received through the contact form.
  • To arrange, confirm and conduct discovery calls, including creating the calendar invitation and Google Meet link and adding you as an attendee.
  • To follow up after a discovery call and, where appropriate, to discuss engaging our services.
  • To maintain records of enquiries and bookings for legitimate business and administrative purposes.
  • To keep our website secure and operating correctly.
  • To comply with our legal, regulatory and tax obligations.

We do not sell your personal information. We do not use your personal information for automated decision-making that produces legal or similarly significant effects, and we do not use it for advertising.

4. Lawful bases for processing

We rely on the following lawful bases under UK GDPR:

  • Consent (Article 6(1)(a)) — when you voluntarily submit an enquiry or booking request.
  • Contract or steps prior to entering a contract (Article 6(1)(b)) — where processing is necessary to arrange a discovery call or deliver services you have requested.
  • Legitimate interests (Article 6(1)(f)) — for administering and improving our business, keeping our website secure, and following up with prospective clients where this is not overridden by your rights.
  • Legal obligation (Article 6(1)(c)) — where we are required to retain records for tax, accounting or other regulatory reasons.

5. Google Calendar and Google User Data

The Founder Growth Collective website includes a discovery-call booking system that integrates with Google Calendar via Google OAuth 2.0 and the Google Calendar API. This section describes, in detail, what Google user data the application accesses, how it is used, whether it is shared, how it is stored and secured, how long it is retained and how you can request its deletion. It is written to accompany our Google OAuth verification submission and to make our practices clear to users, to Google and to any reviewer.

5.1 Application identity and responsibility

Founder Growth Collective is the organisation responsible for this application and for the processing of any Google user data described below.

5.2 Whose Google account is connected

The application connects to a single Google account: the calendar owner at Founder Growth Collective (hannah@foundergrowthcollective.co.uk). Hannah Hulley is the only person who authorises the application through the Google consent screen. Website visitors booking a discovery call do not need a Google account and are not required to sign in with Google in order to make a booking.

5.3 Google OAuth scopes requested

When Hannah authorises the application, the following Google OAuth scopes are requested. These are the minimum scopes required to operate the booking functionality:

  • https://www.googleapis.com/auth/calendar — read and write access to the connected calendar, required to query availability and to create and manage discovery-call events.
  • https://www.googleapis.com/auth/calendar.events — access to calendar events, required to create the discovery-call event, generate the Google Meet link and add the prospect as an attendee.
  • openid, email, profile — used only once, during the initial OAuth consent flow, to confirm that the Google account authorising the application belongs to the intended calendar owner (Hannah) and to reject any other account.

5.4 Google user data accessed

Through the scopes above the application accesses the following Google user data:

  • Free/busy availability from Hannah's primary calendar. When a website visitor selects a date, the server queries Google's free/busy service for that day. Google returns only the time ranges that are marked busy — not event titles, descriptions, attendees, locations or any other event details.
  • Calendar events created by the application. When a discovery call is booked, the application creates one new event in Hannah's primary calendar containing the meeting title, the booking details submitted by the prospect (name, work email, company and any optional notes), the start and end time in Europe/London, the automatically generated Google Meet conferencing data, and the prospect added as an attendee. Where necessary for cancellation or corrections, the application may read or delete an event it previously created, using the event ID it stored at the time of booking.
  • Basic profile information (Google account email address and name) obtained once during the initial OAuth consent flow, used solely to verify the identity of the authorising account.

The application does not read the content of any pre-existing events in Hannah's calendars. It does not access other Google services or scopes such as Gmail, Drive, Contacts, Photos or People API.

5.5 How Google user data is used

Google user data is used exclusively to provide and improve the user-facing booking functionality of the Founder Growth Collective website. Specifically, it is used to:

  • Check calendar availability so that only genuinely free 30-minute slots are offered to visitors.
  • Prevent conflicting appointments by re-checking availability at the moment a booking is confirmed.
  • Create the discovery-call event in Hannah's calendar and generate a Google Meet link.
  • Add the prospect as an attendee and deliver the calendar invitation.
  • Enforce business rules such as 9:00 AM to 6:00 PM UK time booking hours and the 24-hour minimum notice period.

Google user data is not used for any other purpose. In particular, it is not used for advertising, marketing lists, profiling, targeting, credit assessment, data brokerage, resale, analytics for third parties, or for training or improving generalised or non-personalised artificial-intelligence or machine-learning models. Google Workspace API data is not used to develop, improve or train generalised or non-personalised AI or ML models.

5.6 Sharing, transfer and disclosure

Google user data accessed by the application is not sold. It is not shared, transferred or disclosed to any third party for advertising, marketing, resale, data brokerage, credit assessment or any other unrelated purpose. It is not transferred to human beings other than:

  • Hannah Hulley, in her capacity as calendar owner and operator of the booking system.
  • The small number of engineers responsible for maintaining the application, acting on Founder Growth Collective's instructions on a strictly need-to-know basis to operate, secure and support the service.
  • Sub-processors that provide infrastructure necessary to run the service (see section 7), such as the cloud hosting provider on which the application and database run, in which case the data is processed under contractual data-processing terms.
  • Any party where disclosure is required by law, court order or lawful regulatory request.

5.7 Storage and security

To operate the booking system the application stores the following Google-related data on our server-side database. We disclose this openly rather than claim that no data is stored:

  • OAuth tokens for the authorising Google account: an access token, a long-lived refresh token, the token type, the granted scopes and the expiry information. Tokens are used server-side only and are never exposed to the browser or to any third party.
  • Booking records including the Google Calendar event ID and Google Meet URL of the event that was created, together with the prospect's booking form details (name, work email, company, optional notes, start and end time in UTC, timezone, booking status, creation timestamp and an idempotency key).

We apply reasonable and appropriate technical and organisational measures to protect this data, including HTTPS encryption in transit, access controls on the database and administrative accounts, secure server-side storage of OAuth tokens (they are not accessible from the browser or exposed to any client-side code), the principle of least privilege, and infrastructure hosted with reputable providers offering encryption at rest and network security.

5.8 Retention and deletion

We retain Google-related information only for as long as it is needed to operate the booking functionality:

  • OAuth tokens are retained for as long as the booking system needs continuing access to the calendar. They are deleted or invalidated when Hannah revokes access via her Google Account, when the connection is removed from the application, or when the application is decommissioned.
  • Booking records and the associated Google event IDs are retained while the meeting is live and for a reasonable period afterwards to support follow-up. Records that have no ongoing commercial or legal relevance are deleted or anonymised. Where a longer retention period applies for legal or tax reasons, only the fields necessary for that purpose are kept.

You can request deletion of your booking information — including the associated Google Calendar event ID stored by the application — at any time by emailing hannah@foundergrowthcollective.co.uk. On receipt of such a request we will delete the corresponding record from our systems and, where the calendar event still exists, delete it from Google Calendar. We will confirm completion to you and comply within the timescales required by UK GDPR.

Hannah can revoke the application's access to her Google Calendar at any time from her Google Account under Security → Third-party apps with account access. Revocation invalidates the stored refresh token and stops the booking system from being able to read or write to her calendar.

5.9 Google API Services User Data Policy — Limited Use

Founder Growth Collective's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In summary, and in line with those requirements, Founder Growth Collective:

  • Uses Google user data only to provide or improve user-facing features of the booking application that are prominent in the application's user interface.
  • Does not transfer Google user data to third parties except as necessary to provide or improve those user-facing features, to comply with applicable law or as part of a merger, acquisition or sale of assets with a user's prior consent.
  • Does not use Google user data for serving advertisements, including retargeted, personalised or interest-based advertising.
  • Does not allow humans to read Google user data unless the user has given affirmative consent to do so, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymised for internal operations, and in all cases subject to the safeguards described in this policy.
  • Does not use Google Workspace API data to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models.

6. Cookies and website analytics

Our website uses a minimal number of cookies and similar technologies. These include:

  • Strictly necessary technologies that are required for the website to function, such as brief browser storage used during the OAuth flow and for the booking-form idempotency key that prevents accidental duplicate bookings.
  • Analytics may be used to understand how visitors interact with the website in aggregate. Where analytics are used, they are configured to minimise personal data collection, do not identify individuals to us and are not used for advertising.

You can control cookies through your browser settings, including refusing or deleting them. Some parts of the website may not work correctly if strictly necessary technologies are blocked.

7. Third-party service providers

We rely on a small number of trusted service providers to run the website and booking system. These providers only process personal information on our behalf and in accordance with our instructions:

  • Google (Google LLC / Google Ireland Limited): Google Calendar, Google Meet and Google OAuth, used to check availability, create bookings, generate meeting links and issue calendar invitations.
  • Hosting and database providers: our website and its database are hosted on managed cloud infrastructure, which processes traffic and stores enquiry and booking records on our behalf.
  • Email provider: when Hannah replies to enquiries, correspondence is processed through her business email account.

We do not sell your personal information to any third party.

8. How long we keep information

We keep personal information only for as long as we need it for the purposes set out in this policy:

  • Enquiries that do not lead to a booking or engagement: retained for up to 24 months so we can respond to follow-up questions, and then deleted or anonymised.
  • Discovery-call bookings and event records: retained while the meeting is live and for a reasonable period afterwards to support follow-up. Records that have no ongoing commercial or legal relevance are deleted or anonymised.
  • Records required for legal or tax purposes: retained for the period required by applicable law (typically up to 6 years).
  • Google OAuth tokens: retained while the booking system needs access to Hannah's calendar; deleted or invalidated when access is revoked or is no longer required.

9. Data security

We use appropriate technical and organisational measures to protect personal information, including transport-layer encryption (HTTPS) for the website, access controls on the database and administrative accounts, secure storage of OAuth tokens on the server side (not exposed to the browser), and the principle of least privilege for anyone with administrative access.

No system connected to the internet can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where required, affected individuals.

10. International data transfers

Some of our service providers, including Google, are based outside the United Kingdom and may process personal information in other countries. Where personal information is transferred outside the UK, we rely on appropriate safeguards recognised under UK GDPR — such as adequacy regulations or standard contractual clauses — so that your information continues to receive an essentially equivalent level of protection.

11. Your rights

Under UK GDPR you have a number of rights regarding your personal information, including the right to:

  • Request access to the personal information we hold about you.
  • Ask us to correct information that is inaccurate or incomplete.
  • Ask us to delete personal information (in certain circumstances).
  • Ask us to restrict or object to processing (in certain circumstances).
  • Request that we transfer personal information to another provider (data portability), where applicable.
  • Withdraw consent at any time, where we rely on consent as the lawful basis for processing.

To exercise any of these rights, please contact us at hannah@foundergrowthcollective.co.uk. We will respond within the timescales required by law (usually within one month) and may need to verify your identity before acting on a request.

12. Complaints

If you are not satisfied with how we have handled your personal information you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

We would appreciate the opportunity to address any concerns before you contact the ICO, so please consider getting in touch with us first.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our services, technology or the law. The "Last updated" date at the top of this page will always show when the policy was most recently revised. Where changes are material, we will take reasonable steps to bring them to your attention.

14. Contact

If you have questions about this policy or how we handle personal information, please contact:

← Back to home