Privacy Policy

This Privacy Policy explains how FindBack AI LLC (“FindBack”, “we”, “us”) collects, uses, shares and protects personal data when you use the FindBack AI mobile app, the FindBack institution portal, and this website (together, the “Service”).

1. Who we are

FindBack AI LLC is a Virginia limited liability company. Our mailing address is P.O. Box 2801, Woodbridge, VA 22195, United States, and our privacy contact is privacy@findbackai.com.

For the people who use the FindBack app to report, find and claim items, we decide how personal data is used and are responsible for it. When an institution, such as an airport, transit agency, campus, hotel or venue, uses FindBack to run its lost & found desk, the institution is responsible for its staff accounts and for the records it keeps about items in its custody, and we process that data on the institution’s behalf under our agreement with it. Questions about an institution’s own records are best sent to that institution; we will pass requests on where needed.

2. What we collect

Information you give us

• Account details: email address, display name, password (stored only as a one-way hash), preferred language and notification settings. If you sign in with Apple or Google, we receive an account identifier and the email address they share with us.
• Reports: whether you lost or found something, the category, title, description and photos, the place you mark on the map and the area name, the date and time, and anything else you add, such as a reward you offer.
• Private ownership details: serial numbers, ID numbers, notes and answers to ownership questions that you mark as private. These are encrypted and never shown publicly.
• “Where I’ve been” places: venues and lost & found desks you add to a lost report. Only you can see this list.
• Claims and handovers: the evidence you send to prove ownership, the decision on the claim, and handover confirmations.
• Messages you exchange with the other person after a claim is approved.
• Reports of abuse and other messages you send to us, including support and privacy requests.
• Institution staff: name, work email, role, organization, two-step sign-in settings and, if the institution uses single sign-on, the identifier its identity provider sends. Institutions also give us details of their desks, policies, pickup hours and billing contact. Payment card details are collected and held by Stripe, not by us.

Information collected automatically

• Device and app information: a push notification token, the app version and operating system, used to deliver notifications and keep the app working.
• Technical logs: IP address, request times, the pages or features used and error information, which our hosting provider records for security and reliability.
• Location: if you allow it, the app uses your device’s location for a single search of reports near you. We don’t store your live location. The location stored with a report is the place you choose to mark.

We remove EXIF and GPS metadata from every photo you upload before it is stored for display.

Information from others

• Institutions and finders who log a found item give us information about that item, which may describe your property.
• Apple and Google, if you use them to sign in.

3. How we use it

• To provide the Service: create and secure your account, publish your reports, suggest matches, run claims, deliver messages and notifications, and confirm handovers.
• To keep people safe: verify email addresses, detect and prevent fraud, scams and abuse, review reported content, and enforce our Terms of Use.
• To support institutions: run their custody registers, public found-items pages, reports and billing.
• To communicate with you: answer support requests and send service messages, such as a security alert or a change to these terms.
• To meet legal obligations and to establish or defend legal claims.
• To improve the Service using aggregated or de-identified information, such as how many items are returned.

We do not sell personal data, share it for targeted advertising, or use it to build advertising profiles. We do not use your reports, photos or messages to train artificial intelligence models offered by other companies.

Where the law requires a legal basis for processing, we rely on performing our contract with you, our legitimate interests in running a safe lost-and-found service, your consent (which you can withdraw at any time), and compliance with legal obligations.

4. Automated matching and safety checks

FindBack uses machine-learning models that we run ourselves to compare photos and descriptions and to rank likely matches by category, place and date. Matching only suggests possibilities: whether an item is handed over is always decided by a person, the finder or institution staff, never by an algorithm. We also scan messages for known scam patterns, such as a request to read back a verification code, and show a warning; we don’t block or alter the message.

5. Who we share it with

• Other users and the public: the public part of a report is visible to anyone using the Service: category, title, description, public photos, an approximate area (at least 250 metres) and date. Lost reports for hearing aids, medication, medical devices and mobility aids show only the category, approximate area and date. Your name, email address, phone number, exact location and private details are not shown.
• The other side of a claim: when you claim an item, the finder or the institution holding it sees your claim, your evidence and your display name, and then your messages. When you hold an item, the claimant sees your display name and messages.
• Institutions: when you claim an item an institution holds, or when an item it logged matches your report, the institution receives the information needed to decide your claim and return the item, and records the return in its custody register. The institution handles that record under its own policies and the law that applies to it, for example rules on how long found property must be held or when it goes to the police.
• Service providers: companies that host and run the Service for us, listed on our Trust & security page. They may use personal data only to provide their services to us and are bound by contract to protect it.
• Legal and safety: law enforcement or others when the law requires it, or when we believe in good faith that disclosure is needed to protect someone’s safety, prevent fraud, or protect our rights. Where the law allows, we tell the person concerned.
• Business transfers: if FindBack is involved in a merger, acquisition or sale of assets, personal data may be transferred under this policy, and we’ll tell you before it becomes subject to a different one.

6. How long we keep it

We may keep information longer when the law requires it or while we deal with a dispute, an abuse report or a legal claim.

7. Your choices and rights

Wherever you live, you can ask us to:

• access your personal data and get a copy in a portable format,
• correct information that is wrong (you can edit most of it in the app),
• delete your account and personal data (see Delete your account),
• withdraw consent you have given, for example for location access or notifications, in your device settings or in the app, and
• object to or restrict certain processing.

Email privacy@findbackai.com from the address on your account. We’ll confirm your identity, then respond within 45 days, or tell you if we need more time as the law allows. You can use an authorized agent; we’ll ask for proof of their authority. We will not treat you differently for exercising your rights.

Residents of some US states, including Virginia, Colorado, Connecticut and California, have specific rights under state privacy laws, and people in the European Economic Area and the United Kingdom have rights under data protection law. If we decline your request, you can appeal by replying to our decision with the subject “Appeal”. We’ll answer within 60 days and explain the outcome. If you are not satisfied, you can contact your state Attorney General or your local data protection authority.

8. Security

We use encryption in transit and at rest, field-level encryption for private details, hashed passwords, two-step sign-in for staff, access controls and audit logging. No system is perfectly secure, and you help by using a strong, unique password. Details are on our Trust & security page. If we learn of a breach affecting your personal data, we will notify you and the authorities as the law requires.

9. Children

You must be 18 or older to create a FindBack account. The Service is not directed to children, and we do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, email privacy@findbackai.com and we will delete it. A parent or guardian can report an item a child has lost.

10. Where data is processed

We store and process data in the United States. Our providers’ networks may handle data in other countries to deliver it quickly and securely. If you use the Service from outside the United States, your data will be transferred to the United States, where data protection law may differ from that in your country. Where the law requires it, we use appropriate safeguards for those transfers, such as standard contractual clauses.

11. Consumer health data

A lost report for a medical item, such as a hearing aid, medication, a medical device or a mobility aid, can reveal something about your health. We hide these reports from public view by default and use them only to return your item. Our Consumer Health Data Privacy Policy explains this in detail, including rights under Washington’s My Health My Data Act.

12. Cookies and similar technologies

This website does not use cookies for advertising or analytics. Our hosting provider, Cloudflare, may set strictly necessary cookies to protect the site from bots and attacks. The institution portal keeps staff sign-in tokens in the browser’s session storage, which is cleared when the tab closes, and remembers the chosen language and data region in local storage. The app keeps your sign-in tokens in your device’s secure storage.

13. Changes to this policy

We’ll post any change here with a new “Last updated” date. If a change is significant, we’ll tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.

14. Contact us

FindBack AI LLC
P.O. Box 2801, Woodbridge, VA 22195, United States
privacy@findbackai.com