How to Find a Startup Founder's Email Address (2026)

Look the address up in a contact database, then read its deliverability status before you send. Guessing patterns is the fallback, not the plan. This guide runs the lookup against LeadOcean with curl and spends 4 records.

Examples use placeholders (Acme, acme.com, Jane Doe). Swap in your own domain.

TL;DR

• Startup founder emails come from three places: a database lookup, a pattern guess at the company domain, or the company's own pages. Only the first gives you an email_status.
• Filter on seniority: founder plus a small headcount, enrich the person, and send only to verified or catch_all_valid addresses.
• Takes about 10 minutes and spends 4 of the 1,000 free records. Sizing the list first costs nothing.

Prerequisites

• A LeadOcean account. The free plan gives 1,000 records for life, no card: register here.
• An API key from the app, exported as $LEADOCEAN_API_KEY.
• curl and jq.

export LEADOCEAN_API_KEY="paste-your-key-here"

Every request goes to https://api.leadocean.io with the header x-api-key. A free key has both scopes, search and enrich, at 5 requests a second.

Step 1: Define "startup" and size the list for free

There is no startup flag, so define one with filters you can check. A founder at a company with 1 to 50 people founded in 2018 or later is a workable proxy.

Send count=true and limit=1 as query parameters. The call returns a total and spends no record. Filters go in a flat JSON body, and each filter is an array of strings (minFounded is a number).

curl -s -X POST "https://api.leadocean.io/v1/people/search?count=true&limit=1" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "seniority": ["founder"],
    "employeeRange": ["1-10", "11-50"],
    "minFounded": 2018,
    "salesRegion": ["EMEA"]
  }' | jq '.meta'

Founded year and headcount are only as good as the record, and a company with no figure on file is never returned. Treat the total as a floor for your target market.

Do not add a funding filter to a count. It narrows the list at search time but is not reliable for sizing. meta.total is capped at 100,000.

Step 2: Search for the founder at one company

Add the company domain. Each person returned costs one record, so keep limit small.

curl -s -X POST "https://api.leadocean.io/v1/people/search" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": ["acme.com"],
    "seniority": ["founder"],
    "limit": 3
  }' > founders.json

jq '.data | length' founders.json

Search rows are thin. They carry has_email and has_phone flags, not the address. A company with three co-founders returns three rows, so pick the person who owns your problem: usually the CEO for sales tools, the CTO for developer tools.

Step 3: Enrich the person to get the email

Each search row carries an id at meta.source_ids.person_id. Enrich takes exactly one of linkedin_url, email, phone or person_id.

PID=$(jq -r '.data[0].meta.source_ids.person_id' founders.json)

curl -s -X POST "https://api.leadocean.io/v1/people/enrich" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"person_id\": \"$PID\", \"reveal_email\": true}" > person.json

This costs one record. If we hold nothing for that person you get a 404 and no charge. There is no lookup by name plus domain: search by domain first, then enrich by person_id.

Step 4: Verify before you send

Read email_status. verified and catch_all_valid are worth sending to. catch_all means the domain accepts everything, so the mailbox may not exist.

jq -r '.data.contact_data.contact_emails[]
  | select(.status == "verified" or .status == "catch_all_valid")
  | .email' person.json

Founders often carry a personal address next to the work one. Check the type field and send business email to the work address. Bounced emails are not refunded, so treat every other status as a no-send.

Step 5: Use a pattern only when the lookup finds nothing

The third source is the company itself: a team page, a press kit or a footer contact. These show a name and sometimes a role address, rarely a personal mailbox. Use them to confirm the name and domain, not as the address.

Early-stage teams use short addresses. Try the bare first name first, then the longer forms:

first@acme.com         jane@acme.com
first.last@acme.com    jane.doe@acme.com
flast@acme.com         jdoe@acme.com
firstl@acme.com        janed@acme.com

Work out the pattern from any other address you already hold at that domain. Pick one pattern per domain and test it on a single send before you scale. Never send to a guessed address that no verifier has checked. A catch-all domain makes every guess look valid. Skip role addresses such as hello@ and team@: they are shared inboxes, not the founder.

Step 6: Pull the whole list as a CSV

For a list, start an export. limit is required and sets the rows you want. POST /v1/exports takes up to 50,000 rows a request and 500,000 a day, and each row costs one record. Bulk CSV export is not on Free, so use the app's Exports page or a paid key.

curl -s -X POST "https://api.leadocean.io/v1/exports" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "startup-founders-apac",
    "limit": 5000,
    "filters": {
      "seniority": ["founder"],
      "employeeRange": ["1-10", "11-50"],
      "minFounded": 2018,
      "salesRegion": ["APAC"],
      "emailStatus": ["verified", "catch_all_valid"]
    }
  }'

The app's Exports page shows the record price before you start and lets you pick columns. Solo is $97 a month with bulk CSV included. Agency is $497 a month for teams. See pricing.

What you get

Free count run on 2026-10-21 with the MCP tool leadocean_count_leads. Filters: seniority founder, employeeRange 1-10 and 11-50, minFounded 2018, one salesRegion each. Totals count verified, catch_all_valid and catch_all emails, the tool's default, so they are the mailable audience.

EMEA has the most founders overall but fewer with a mailable address than NORAM. Add emailType: ["work"] to count work addresses only.

Response shape from the API reference (placeholder values):

{
  "success": true,
  "data": {
    "profile_data": { "...": "name, title, company" },
    "contact_data": {
      "contact_emails": [
        { "email": "jane@acme.com", "status": "verified", "type": "work" }
      ],
      "has_email": true,
      "email_status": "verified",
      "email_type": "work"
    }
  }
}

Troubleshooting

FAQ