Found Opportunity

Security & Trust

Last Updated: December 30, 2025

Protecting your data — and your clients' privacy — is the foundation of our platform.

This page explains, clearly and transparently, what we access, what we never access, how we secure it, and what protections exist even in a worst-case scenario.

We operate two services:

FO and OWL are referred to collectively as the "Services." Where a term applies to only one Service, we label it FO only or OWL only.

For IT & Security Teams

Security questionnaire PDFs:

Need a completed vendor form, DPA, or additional documentation? Email support@foundopportunity.com.

1. What We Access (and Why)

Both Services use OAuth to connect to Gmail or Outlook/Microsoft 365. We use read-only permissions and do not store your email password.

FO only Found Opportunity — spam/junk opportunity detection

FO accesses spam/junk folders only so it can detect misfiled business opportunities.

We access:

We do NOT access:

OWL only OWL — VIP rules and alerts (Inbox-only, newly received only)

OWL checks newly received Inbox messages against the VIP rules you configure (e.g., sender, domain, keywords, threads) and generates alerts for matches.

We access:

We do NOT access:

2. Why You Can Trust Folder Scope Is Enforced

Email providers do not offer a "spam-only" or "inbox-only" permission scope. OAuth read-only scopes can technically allow reading mail. So we enforce folder scope by design and controls:

FO only Spam/Junk-only enforcement

OWL only Inbox-only + newly received-only enforcement

External accountability

Our OAuth integration is subject to provider verification and ongoing compliance requirements. Deviations from declared behavior can risk OAuth access revocation.

3. Read-Only Permissions = We Cannot Send or Modify Email

We request read-only OAuth scopes (e.g., gmail.readonly / Mail.Read). This means we cannot:

4. What Happens If You Disconnect

You can disconnect anytime:

Once disconnected:

5. Data Handling & Auto-Deletion

FO only FO retention (7 days)

FO stores opportunity records for up to 7 days, then automatically deletes them. FO also stores limited technical identifiers (e.g., hashed message IDs) while your account is active to prevent duplicates and support security; these are deleted when you delete your account.

OWL only OWL retention (7 days)

OWL stores alert records (and Alert Details content for matching messages, up to 10,000 characters) for up to 7 days, then automatically deletes them. OWL also stores limited technical identifiers (e.g., hashed message IDs) while your account is active to prevent duplicates and support security; these are deleted when you delete your account.

Both What we never store

6. Encryption & Infrastructure

Both We maintain safeguards designed to protect data, including:

7. Security Monitoring & Controls

Both We use operational controls to protect the Services, such as:

8. Worst-Case Scenario: What If We Were Hacked?

Even in the unlikely event of a server breach:

Both What an attacker still could NOT do

What they could potentially access

9. Third-Party Providers

We only share data with vendors essential to providing the Services. Service usage is labeled below.

We do not sell user or email data.

10. You Stay in Control

Both

Need to Talk Security?

We're always available to answer technical questions — including from IT teams, CTOs, and security officers.

📧 privacy@foundopportunity.com