Privacy Policy

1. Introduction and scope

Foundable gives you Ted, an AI employee who builds your idea into a real business, runs it in the background and helps it earn. This Privacy Policy explains how we collect, use, share and protect personal information when you use our website, apps and services (the “Services”).

It covers visiting foundable.com, using your account and your foundables, paying for Foundable, and the websites you publish with it. It doesn’t cover what people give to a website built with Foundable: whoever built that website decides what it collects and is responsible for it, and we process that information on their behalf (Section 6).

2. Words we use

• A foundable is a business you run with Ted, along with everything Ted makes and keeps for it.
• Customer Content is what you put into Foundable or make with it: messages to Ted, files and images, websites and the data their backends hold, your foundable’s mail and posts, texts with Ted, videos, what Ted reads from apps you connect, and your settings.
• Visitors’ data is personal information about the people who visit or use the websites you publish.

3. Information we collect

Information you give us

• Account — the email you sign in with and, if you add them, your name, picture, time zone and notification settings; the foundables you belong to and your role in each; when your account was created and updated; and the phone number you link to text Ted.
• Customer Content — everything listed in Section 2.
• Billing — your name, email, billing address, country and any tax details; your card’s brand and last four digits; your invoices; and the plan, offer and billing cycle you chose. Stripe handles full card numbers; we never store them.
• Support — emails, support messages, attachments and feedback. In the support chat inside Foundable we also keep a signed record of your account so the conversation stays yours, and a short summary of your issue that Ted prepares, sent only after you approve it.

Information collected automatically

• Usage — which screens and actions you use and how long they take, page-speed measurements, error reports and anonymous session identifiers. Inside the product this uses no cookies, builds no profile of you, and doesn’t record your IP address with an event. On our public pages, when analytics is on, a first-party device identifier and the campaign tags of the link you arrived from record page views. We never record or replay your screen.
• Device and connection — IP address, browser, operating system, the page you came from, and approximate location from your IP address. Amazon Web Services records this when you use Foundable, WorkOS when you sign in, and Cloudflare when someone visits a website you published.
• Records of Ted’s work — the inputs and outputs of Ted’s AI calls, the tools Build used with short previews of their results, usage counts and chat identifiers. Your account and foundable appear in them only as scrambled codes; your name and email are not included.
• Purchase records — the identifiers of each purchase, including the one that stops a retried purchase from charging you twice. We keep them to confirm a recurring charge was authorized and to settle disputes. If one looks wrong, email support@foundable.com from your account’s email address.

Information from services you connect

• Connected accounts — when you connect a social account, a Stripe account for Foundable Payments, or an app in Settings › Integrations (Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Google Analytics, Google Search Console, Outlook, OneDrive, Excel, Teams, Slack, Notion, Airtable, HubSpot, Linear, Calendly, Mailchimp, Canva or QuickBooks), and for the mailbox we create for your foundable, we keep that account’s identifiers. The provider that holds the connection (Zernio for social accounts, AgentMail for mail, Stripe, and Composio for Integrations) keeps the login; we never store your passwords. What Ted reads from Google and Microsoft apps is covered in Section 15.
• Websites you connect — an owner or admin can choose to sign in to a website through a live remote browser run by Cloudflare. Cloudflare processes the sign-in page, what you enter, and the pages Ted uses. The saved connection contains encrypted sign-in cookies for that foundable and the person who connected it, not passwords or other browser storage. The login browser you can see closes before Ted continues in a separate browser. Temporary page state can remain in that browser until it closes or expires; finishing a reply does not clear it. Raw page snapshots are not saved in our database, service logs, workflow history or records of Ted’s work. His replies and inputs to tools can include website content and are kept as part of his work. Section 15 explains the handling of Google and Microsoft website content read this way.
• Selling with Foundable Payments — your Stripe account’s identifiers and status, the offers you create, and your customers’ purchases and subscriptions as Stripe reports them, including payment, renewal and cancellation status.

Information from others

• Sign-in — your email and name from the service you sign in with.
• Referrals — if you join the waitlist through a referral link, its referral code and campaign tags stay in your browser until you join, and the person who referred you gets the credit.

Sensitive information

Your sign-in identity and connected-account identifiers can count as sensitive information under some laws. We use them only to run and secure the Services, never to infer things about you. Please don’t put health, biometric, precise location, government ID or other special-category information into Foundable.

4. How we use it

• Run the Services — build, publish and run your websites, including a backend and visitor sign-in when a site needs them, and do the work you ask for in the services you connect, such as posting to your social accounts, sending and receiving your foundable’s mail, texting with you and taking payments from your customers.
• Create Ted’s and Build’s work — with our AI providers (Section 5).
• Check the quality of Ted’s work — by sending records of Ted’s work to Judgment Labs.
• Protect and secure — sign you in, keep the Services secure, prevent abuse and fraud, and fix problems.
• Payments — process purchases and subscriptions, calculate and pay transaction taxes, send receipts, and handle refunds and disputes.
• Support — help you and tell you when we reply. Support is answered by people, not bots.
• Messages you need — security alerts, receipts, waitlist admission notices and important product changes. You can’t turn these off while you have an account.
• Product updates — on by default; turn them off in Settings › Notifications or with the unsubscribe link.
• Improve Foundable — using aggregated or de-identified data where practical.
• Legal — meet legal obligations and enforce our Terms.

5. AI and your content

No training on your content. We don’t train AI models on your Customer Content. Our AI providers process it under their business and API terms, which don’t use it to train their models by default; our AI Disclosure has the details.

Who does the work. OpenAI powers Ted’s conversations and his recall of earlier chats, Anthropic powers Build, mail drafts and videos, fal.ai makes images, Perplexity answers Ted’s web searches, and Monid handles his public data lookups. Section 8 lists everyone else who receives information.

Decisions. Much of Foundable’s work is created by AI, but the Services don’t make solely automated decisions about people that have legal or similarly significant effects. Ted can act on his own within the scope, autonomy, budget, schedule and connected accounts you turn on, such as in Run and scheduled runs. You can pause or turn these off; an action already taken can be undone only through the connected service’s own edit, recall, refund or reversal controls.

6. Websites you publish

Information about your websites’ visitors is your visitors’ data. We process it for you, and you’re responsible for your website’s own privacy notice and any consent it needs. If you visited a website built with Foundable, contact the person who runs it about your data.

Analytics. Unless you turn it off for a site in its Publish panel, we add an analytics script to the websites you publish. For each page viewed, it records the page, the site that linked to it, the kind of device, the country of the visitor’s time zone, and a random visit identifier kept in a cookie for 30 minutes. It doesn’t record IP addresses, full web addresses, query strings or other identifiers. We use it only to show you your site’s visits.

Server logs. If your website runs its own server code, we keep its log so you and Ted can see what it did and what went wrong: each request’s method, path (without the query string), status and timing, the processing time it used, what the code printed or threw, and the host name and status of each service it called. We don’t record query strings, headers, request or response bodies, or visitors’ IP addresses, and any secret you saved that is 8 or more characters long is replaced by its name before a log leaves Cloudflare. Anything else your code prints is kept as printed, so your website shouldn’t print its visitors’ personal data. If a site uses a very large amount of processing time in one day, we’re alerted, and past a higher limit it’s slowed until the day ends. When Ted reads a log to help you, what he reads becomes part of your chat.

7. Cookies and tracking

We use cookies and browser storage to keep you signed in, keep your browser connected to the same server, remember your preferences, run the support chat, and, on our public pages when analytics is on, count visits with a first-party identifier. Our product analytics set no cookies, and websites you publish set the 30-minute visit cookie described in Section 6 while their analytics is on. If you choose to connect a website, we also save its sign-in cookies as described in Section 3. Our Cookie Notice lists everything.

We use no advertising cookies, pixels or trackers, and send nothing to advertising platforms, so Global Privacy Control and Do Not Track signals have nothing to switch off. The analytics on websites you publish don’t read these signals.

8. Who receives your information

• Service providers — companies that run parts of the Services for us under contract: hosting and storage (Amazon Web Services in the United States, and Cloudflare for the websites you publish and the remote browsers for websites you connect), the AI providers in Section 5, Turbopuffer so Ted can recall earlier chats, Mobbin for design references, Temporal, Modal and Supabase to run the work, WorkOS for sign-in, AgentMail, Linq, Zernio, Composio and Resend for messages and connections, Intercom for support, and Judgment Labs, PostHog and Sentry for monitoring (Sentry receives error reports with headers, bodies, credentials and personal fields removed). Our subprocessor list says what each one receives and where it works.
• Stripe — which also uses payment information for its own payment-network, fraud, compliance and tax purposes, as an independent controller, for your purchases and, if you sell with Foundable Payments, your customers’ payments.
• Services you connect — when you ask us to, we send the apps and services you connect what they need. They handle it under their own terms and privacy policies, as do other websites we link to. When your website offers Google sign-in, Google signs in its visitors under its own terms.
• Advisers and buyers — professional advisers, such as lawyers and accountants, under confidentiality; and a buyer or successor in a merger, acquisition, financing or sale of assets.
• Authorities — when the law requires it, after we check the request is valid.

We don’t sell personal information or share it with advertisers or data brokers, and we never use your ideas, prompts or other Customer Content for cross-context behavioral advertising.

9. Legal bases (EEA, UK and Switzerland)

If you are in the EEA, UK or Switzerland, we rely on these legal bases under Article 6 of the GDPR:

• Contract — to provide what you signed up for, including your account, your chats, building and publishing your websites, support you ask for, acting in the services you connect, and your purchases.
• Legitimate interests — to keep the Services secure, prevent abuse, fix errors, check the quality of Ted’s work, understand how the Services are used and improve them, where your rights don’t outweigh these interests.
• Consent — for texting with Ted, which starts when you text the code we show you and stops when you text STOP, and for product updates, which you can turn off at any time.
• Legal obligation — to meet tax, accounting and other legal requirements, including lawful requests from authorities.

10. International transfers

We’re based in the United States, and our providers may process information in the US and the other countries named on our subprocessor list, where privacy laws may differ from yours. Where required, our provider agreements and a signed Data Processing Addendum provide Standard Contractual Clauses, the UK Addendum or another recognized safeguard. Contact us to put the right one in place for your account.

11. How long we keep it

• Your account — while it’s open. Deleting your account is immediate and final; we can’t restore it. Right away we erase your profile and settings and every foundable you own with its content; within minutes, your sign-in record at WorkOS; and your paid plan ends and your Stripe customer record, with its saved payment details, is deleted. We keep only a record that the account existed, with no personal details, your policy acceptances, and the payment and credit records the law requires.
• Customer Content — while its foundable exists, then deleted as above. Our database backups are kept for 14 days and aren’t edited record by record, so deleted content can remain in a backup until it expires. Providers may keep copies under their own schedules or legal duties; for example, Anthropic keeps API data for up to 30 days, with documented trust-and-safety and legal exceptions.
• Logs — our service logs for 30 days, the diagnostic record of Ted’s and Build’s activity for 14 days, and your websites’ server logs for 7 days. Other operational, cost, billing and analytics records follow schedules set by their purpose, and providers’ monitoring data follows the settings listed on our subprocessor list.
• Your websites’ analytics — 90 days, or until you delete the foundable.
• Connections — while connected; once you disconnect, the provider that held the connection follows its own schedule. We don’t keep what Ted reads from your Google or Microsoft apps after the reply he reads it for (Section 15). For connected websites, temporary page state can remain in the remote browser until it closes or expires. Disconnecting a website revokes its saved sign-in cookies and queues its live browsers for closure. The same happens when the connecting person leaves the foundable or loses their owner or admin role.
• Purchases and billing — as long as reasonably needed for accounting, tax, fraud, disputes and legal obligations. Some pseudonymous transaction records can remain after an account is deleted, and Stripe follows its own retention rules.
• Support — conversations and attachments stay in Intercom as long as needed to help you and meet our obligations; closing the chat doesn’t delete them. To access, export, correct or delete them, email privacy@foundable.com and we’ll handle it with Intercom.

12. Security

We encrypt your information in transit and at rest, use short-lived sign-in tokens, keep every foundable’s records separate and recheck your access on every request, and never write our secrets to disk or send them to the browser. Our Security page has the details. No system is perfectly secure; if an incident affects your personal information, we’ll notify you and the regulators as the law requires.

13. Your rights and choices

Depending on where you live, you can ask for a copy of your personal information, including in a portable, machine-readable format; correct it; delete it; restrict or object to how we use it; withdraw consent you gave; and complain to your data-protection authority.

Much of this you can do yourself: edit your name, picture and time zone in Settings › Account and your emails in Settings › Notifications; delete your account in Settings › Account, or from your waitlist profile while you’re on the waitlist (our Data Deletion Instructions explain what it covers); disconnect a social account in Run, your Stripe account in Build › Tools › Payments, or an app in Settings › Integrations; and stop texting with Ted by texting STOP.

For anything else, email privacy@foundable.com. We may need to confirm it’s you, and we reply within the time the law allows, generally one month under the GDPR and 45 days under California law, with permitted extensions.

14. US state privacy rights

Under the California Consumer Privacy Act, as amended by the CPRA, and similar state laws, you also have the right to know the specific pieces of personal information we hold about you; to opt out of its “sale” or “sharing”; to limit our use of sensitive personal information to the purposes the law permits; and not to be treated differently for using these rights.

In the last 12 months we collected the categories below for the purposes in Section 4, and disclosed them only for business purposes to the recipients in Section 8. We have not sold personal information or shared it for cross-context behavioral advertising.

We use sensitive personal information only for the operational and security purposes the law permits; you can ask us to confirm or limit this. To use these rights, or any other opt-out right the law gives you, email privacy@foundable.com. You can also send a request through an authorized agent; we may ask for proof that you authorized them.

15. Google and Microsoft user data

Foundable’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We handle information received from Microsoft APIs under the same commitments and the Microsoft APIs Terms of Use. The same limits on use, human access and training apply to Google and Microsoft website content Ted reads through a connected remote browser. The different retention of temporary website browser state is described below.

• What we access — when an owner or admin connects a Google app (Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Google Analytics or Google Search Console) or a Microsoft app (Outlook, OneDrive, Excel or Teams) in Settings › Integrations, Ted can read from it what his work needs, such as your recent email or this week’s calendar. When an owner or admin delegates business work, Ted can also send, change or delete things through that connection without asking again for each step. He respects requests to keep work as a draft, settings that require approval, and instructions to stop.
• When — Ted reads these apps when someone in your foundable asks him to in a chat or a text, when a task they scheduled runs, and in Run, the work Ted does on his own. When he reads your Gmail or Outlook mail, he can use it to carry out the work delegated to him, including sending replies. Work requested as a draft stays a draft until it is approved.
• How we use it — only to provide the features you use: Ted’s answers, the work you ask him to do with it, and the drafts he prepares when requested. We don’t use it for advertising, don’t sell it, and don’t use it to decide creditworthiness or for lending.
• Who receives it — what Ted reads goes only to Composio for reads through its app connections, Cloudflare for reads through a connected website’s remote browser, and OpenAI, whose models read it to write Ted’s reply. What Ted makes from it, such as his reply, a draft, inputs to tools or a note he saves, is handled like the rest of your conversation, by the providers that store, trace and deliver it (see our subprocessor list). Otherwise we transfer it only to comply with the law, or as part of a merger, acquisition or sale of assets with notice to you.
• No human reads it — no one at Foundable reads what Ted reads from these apps unless you ask us to for specific content (for example, in a support request), it’s needed to investigate abuse or a security incident, it’s required by law, or it’s aggregated and anonymized for internal operations. Those reads stay out of our service logs, workflow history and records of Ted’s work, which keep a reference to each read instead of its content. Ted’s replies are part of your conversation and, like any reply, are kept in our workflow history and records of Ted’s work, so a reply that repeats what he read is kept there too.
• No training — we don’t use this data to develop, improve or train generalized or non-personalized AI or machine-learning models, and our AI providers process it under API terms that don’t train their models on it.
• Retention — we don’t keep what Ted reads from these apps after the reply he reads it for. What Ted makes from it (his reply, a draft, or anything he saves at your request or as part of his work, such as a note in his memory, a file or a site) is Customer Content: it stays with your foundable and is deleted as Section 11 describes.
• Website browser state — temporary page state can remain in the remote browser until it closes or expires; finishing a reply does not clear it. Raw page snapshots are not saved in our database, service logs, workflow history or records of Ted’s work, which use references instead. Website content Ted includes in his replies or inputs to tools is kept as part of his work under Section 11.
• Your controls — an owner or admin can disconnect an app or website at any time in Settings › Integrations, which ends Foundable’s access through that connection. You can also remove Foundable’s access in your Google or Microsoft account’s security settings. Deleting a foundable removes its connections, and deleting your account deletes the foundables you own along with theirs.

16. Children

The Services aren’t meant for children under 16, and we don’t knowingly collect their personal information (or that of anyone under a higher age where the law sets one). If you think a child has given us personal information, email privacy@foundable.com and we’ll delete it.

17. Changes to this policy

We’ll update this policy as Foundable changes, and the date at the top shows the latest version. For material changes that affect existing customers, we’ll give reasonable notice in advance by email or with a clear notice in the product, plus any notice the law requires.

18. Contact us

Questions or requests: privacy@foundable.com. Autono Labs, Inc. is responsible for the personal information processed under this policy (its “controller,” where the law uses that term). Our address: Autono Labs, Inc., Attn: Privacy (Foundable), 131 Continental Drive, Suite 305, Newark, DE 19713, USA.

Businesses in the EEA, UK or Switzerland that need a data processing agreement for their visitors’ data can sign our Data Processing Addendum; the public version is a template and takes effect once both sides sign it.