Privacy Policy

1. Who we are

Foundry Apps Ltd ("we", "us", "our") is a company registered in Guernsey, Channel Islands. We are registered with the Office of the Data Protection Authority (ODPA) under registration number DPA11561.

For any privacy-related enquiries, contact us at david@foundryapps.co.uk.

2. What data we collect

We collect the following categories of personal data:

• Account information: your name and email address when you create an account.
• Usage data: pages visited, features used, session duration, and interaction events.
• Technical data: IP address, browser type, device type, and operating system.
• Payment data: billing details are collected and processed by Paddle (our payment processor) — we do not store card numbers or full payment details.
• Communications: the content of any messages you send us by email.

3. How we use your data

We use your data to:

• Provide, operate, and improve our products and services.
• Process payments and manage your subscription.
• Send transactional emails (account confirmations, billing receipts).
• Respond to support requests and enquiries.
• Analyse usage patterns to improve product quality and performance.
• Meet our legal and regulatory obligations.

Our lawful bases for processing are: performance of a contract (providing the service), legitimate interests (product improvement, security), compliance with legal obligations, and consent where required.

4. Cookies

We use cookies and similar technologies for:

• Essential cookies: required for authentication and session management. These cannot be disabled.
• Analytics cookies: used by Google Analytics and/or PostHog to understand how visitors use our products. You can opt out via your browser settings or a cookie consent prompt where presented.

5. Third-party services

We work with the following third-party processors, each bound by appropriate data processing agreements:

• Supabase — database and authentication infrastructure (EU region).
• Vercel — website and application hosting.
• Paddle — payment processing and subscription management. Paddle acts as a Merchant of Record. Their privacy policy applies to payment data.
• Google Analytics — usage analytics. Data may be transferred to the United States under Standard Contractual Clauses.
• PostHog — product analytics and event tracking.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide services. If you close your account, we will delete or anonymise your data within 90 days, except where retention is required by law (e.g. financial records, which we keep for 7 years).

7. Your rights

Under the Data Protection (Bailiwick of Guernsey) Law 2017, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at david@foundryapps.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ODPA.

8. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. All data in transit is encrypted via TLS. Access to personal data is restricted to personnel who need it to perform their role.

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by a prominent notice on our website. Continued use of our services after changes take effect constitutes acceptance of the revised policy.

10. Contact

Foundry Apps Ltd
Guernsey, Channel Islands
david@foundryapps.co.uk
ODPA Registration: DPA11561