Privacy policy

This privacy policy explains how Foundworks ("we," "us," "our") collects, uses, and protects your personal data when you use our platform. We are committed to GDPR compliance and transparent data practices. Foundworks, established in the Netherlands, is the data controller for the processing described in this policy (contact details in section 10).

We process personal data on these legal bases: performance of a contract (providing the Service — account, businesses, agents, billing), legitimate interest (security, abuse prevention, audit logging, service improvement), consent (newsletter, optional integrations you connect), and legal obligation (tax and bookkeeping records).

We collect the following categories of data:

• Account data: Name, email address, and a login identifier from our identity service. Passwords and sign-in are handled by our own self-hosted identity service (Zitadel) — the application never stores your password.
• Business and department data: The business name, mission, brand voice, target customer (ICP), and any instructions or files you or your AI agents produce. Stored as Markdown files in our virtual filesystem.
• Agent execution data: Task records, event logs, approval queue items, cost-tracking rows per LLM call.
• Technical data: IP address, browser type, access timestamps, request audit logs.
• Connected integrations (only if you choose to connect them): Encrypted OAuth tokens or API keys for any integration you connect (e.g. Outlook and Gmail for connected mail accounts, Slack, Linear, HubSpot, GitHub), used so your agents can act through your own accounts under your grant. We never store the passwords for those accounts.
• Newsletter (only if you sign up): Email address and the source you signed up from. Confirmed via a double-opt-in link.
• Billing data (paid tiers only): Mollie customer + subscription identifiers and invoice records. Card details are handled directly by Mollie and never touch our servers.
• Optional data: Third-party LLM API keys (stored Fernet-encrypted with an app-level key).

Your application data (businesses, agent memory, files, billing records) is stored on our own infrastructure in the European Union. Authentication data is held by our own identity service (Zitadel), which we host ourselves in the European Union; no third-party authentication processor is involved. AI model calls and transactional email may be processed outside the EU under Standard Contractual Clauses (see sub-processors). We use industry-standard security measures including:

• Encryption in transit (TLS) and at rest
• Authentication, credential storage, and MFA handled by our self-hosted identity service in the EU
• Fernet encryption for stored API keys
• Isolated sandbox environments for agent execution, on our own infrastructure

We do not sell your personal data. Application hosting, the database, file storage and the agent sandboxes run on our own infrastructure in the European Union. We process data through these third-party services, each contractually bound to protect it:

• AI model providers (Microsoft Azure AI Foundry; Anthropic, PBC for overflow capacity) — process your instructions (prompts) and the resulting outputs to generate responses and drive the agent loops. Requests normally run on Claude models hosted by Microsoft Azure; when that capacity is full, a request may be served by the same Claude model hosted by Anthropic, PBC (United States), reached through Microsoft Foundry. Inputs and outputs are not used to train shared models. May be processed outside the EU, including in the United States, under Standard Contractual Clauses.
• Transactional email provider — sends transactional email from us to you (welcome, digest, newsletter confirmations, broadcasts, AI usage warnings). May be processed outside the EU under Standard Contractual Clauses.
• Connected integration providers — only for integrations you connect: Outlook and Gmail (for connected mail accounts), Slack, Linear, HubSpot, GitHub. Your agents act through your own accounts under your OAuth grant; content you ask them to send goes to the respective provider. Processed wherever that provider handles your account's data, which may be outside the EU.
• Web search providers (Tavily / Brave) — when an agent runs a web search, the search query (which can contain business context) is sent to the search provider.
• Mollie — payment processing for paid tiers. Card data goes directly to Mollie; we only see customer/subscription/invoice identifiers.
• Cloudflare — DNS, CDN, and the secure tunnel through which traffic reaches our infrastructure.

A current list of our sub-processors is available on request at [email protected].

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Port your data to another service
• Object to processing of your data
• Withdraw consent at any time

You also have the right to lodge a complaint with your national supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

To exercise any of these rights, email us at [email protected].