NO BORDERS FOUNDER / PRIVACY
Privacy notice
This notice explains how No Borders Founder processes data when you use this website or contact us.
Controller and contact
No Borders Founder LLC, 447 Broadway, New York, NY 10013, United States. Use the protected form below for privacy questions and to exercise your rights. State your request and a reachable email address; we may request further information through an appropriate channel to verify identity.
Website and security
Technical connection data such as IP address, time, requested URL and browser details are processed to deliver the site, diagnose faults and prevent abuse. Our legitimate interest in a secure, functional website is the basis under GDPR Article 6(1)(f), where applicable. Cloudflare provides hosting, security and database services on our behalf. Actual processing locations and subprocessors depend on the service; we do not promise storage solely in a specified country.
Enquiries and applications
When you submit a mandate, professional or referrer enquiry, we process your details, contact information and reference to respond, assess potential collaboration, check conflicts and keep a record. For applications we record the accepted terms version and time, and your choice about a possible public profile. A profile requires separate agreement on text and image. Precontractual steps at your request rely on Article 6(1)(b); necessary security and records rely on Article 6(1)(f) and, where relevant, (c).
Referrals and attribution
A referral code is random and contains no name. If you enquire yourself, you may enter a code or a name. We review attribution manually, especially existing relationships and competing claims. Only if you choose the option do we store a random identifier in a protected browser cookie for up to 90 days; the server holds only its hash, association and expiry. You can remove it on the referral page. Optional browser storage/access relies on your consent under Section 25(1) TDDDG and Article 6(1)(a). Review of the enquiry relies on Article 6(1)(b) or (f).
Contacts introduced by others
With attested permission, a referrer may submit only a person's name and email, plus when and how permission was given. The named referrer is the source. This is provisional: we check permission and give the person information under GDPR Article 14 within the legal period, no later than first contact. There is no confirmed attribution or automatic outreach without confirmation. Our legitimate interest in handling an expressly permitted introduction is the basis under Article 6(1)(f). You may object.
Spam protection and email
Our forms use Cloudflare Turnstile. Technical signals and connection data are sent to Cloudflare for abuse checks; successful verification is required to submit. This relies on Article 6(1)(f). Resend sends internal alerts to the relevant NBF mailbox. For requests submitted by the person concerned, the alert includes the form details and reference; the protected record also retains the submission. An introduction concerning another person is initially alerted by reference only. An email response to your request may create further correspondence data.
Analytics and cookies
Analytics tools (Google Tag Manager/Analytics and Ahrefs) activate only after your choice. The choice is stored locally in your browser and can be changed through cookie settings. We do not load these scripts on sensitive application, referral and privacy pages. Optional analytics relies on Article 6(1)(a) and Section 25(1) TDDDG. Strictly necessary storage supports secure operation.
Recipients and transfers
Only responsible NBF staff and service providers have task-based access. Cloudflare provides hosting, database and security services; Resend processes alerts; optional analytics involves the named providers. The controller is in the US. Processing and access may occur in the US, Singapore and other locations used by a particular service. Transfers from the EEA rely, as applicable for each recipient, on an applicable adequacy decision or appropriate contractual safeguards. Request details or copies of the relevant safeguards through the form.
Retention
We keep enquiries and applications for review and for any resulting business relationship. If no contract follows, we ordinarily delete or anonymise the record after twelve months unless statutory retention or specific legal claims require longer. Contract and accounting records follow applicable legal periods. Unconfirmed third-party contacts are deleted within 30 days unless a legal obligation or documented dispute requires retention. Browser attribution ends within 90 days; security and rate-limit data are removed after their short protective purpose expires.
Your rights
Where GDPR applies, you may request access, correction, erasure, restriction, portability and object to processing. You may withdraw consent for the future at any time. You may complain to a competent supervisory authority. We do not make solely automated decisions with legal or similarly significant effects; attribution and commission decisions are reviewed by people.
Updated: 7 October 2026
Privacy request
Please do not send identity documents or confidential client files through this form.