Privacy

Who this is

Foundry365 Ltd is the data controller for the personal data described here. Contact us at privacy@foundry365.org.

Foundry365 Ltd (company number 17367562), registered in England and Wales. Registered office: 124 City Road, London, United Kingdom, EC1V 2NX.

What we hold

Account identity: your email address, your name, and the venture you belong to.

Profile details you choose to add: a headline, a short biography, your location, and links to your LinkedIn or website. All of it is optional, all of it is editable, and you choose who can see it.

A recovery email address, if you add one in your settings. It is used only to help you back into your account and for nothing else.

Your company's registered details, if you give them to us: company number, jurisdiction and incorporation date. We use them to identify your company and to check it against the public register.

Venture records you or your team put into Foundry365: documents, contacts, cap tables, board records and investor material. This is the most sensitive category and it is treated as such.

Operational records needed to run the service: sign-in events, and errors and diagnostics from the application.

Sign-in codes expire after 10 minutes. A signed-in session lasts 30 days unless you sign out. Diagnostic and security logs are deleted automatically after 30 days. Our delivery ledger stores a one-way fingerprint of an email recipient for 90 days rather than another copy of the address. A mail provider must still process the address to deliver a message, and a failed SES feedback event may remain in an encrypted dead-letter queue for up to 14 days.

How we sign you in

Foundry365 uses a one-time code sent to your email address, or a passkey held on your device.

We do not store passwords, because there are none. A passkey never leaves your device; we hold only the public half of it.

A phone number is not an account recovery route. Anyone who asks us to move an account using a phone number will be refused.

Where it is stored

In London. Our servers, our database and our file storage all run in Amazon's London region, and backups stay there too. Mail you send us arrives in mailboxes hosted by IONOS, in Europe.

Two honest qualifications. Static files — images and stylesheets — are cached on servers around the world so pages load quickly; that is a copy of the public page, never your documents or your data. And we are a small team: when we investigate a problem we may access systems from wherever we happen to be, which will usually be the UK.

Amazon Web Services and IONOS, and nobody else. AWS provides the servers, the database and the file storage, in its London region. IONOS hosts the mailboxes we receive mail at, in Europe. We use no analytics service, no error-reporting service, no session recording and no advertising network.

When you add your company we look it up in the public Companies House register. We send the company number and nothing about you.

The waiting list

If you join the list we keep your email address for one reason: to tell you when we can offer you a place. We do not add you to anything else. Collection is active; automated notification and follow-up sending are not active today.

When notification is activated, we will contact you when a place is available. If we do not hear back from you, we will follow up at most twice and then delete your address 30 days after the first notification. You can ask us to remove it sooner at any time by emailing privacy@foundry365.org.

What we do not do

No analytics, no tracking pixels, no advertising identifiers, no third-party embeds on this site.

This page and the rest of the public site load no external images, fonts or scripts beyond what the application itself needs.

We do not sell or rent personal information.

For signed-in use we set one host-only session cookie. If a public page's CDN asset fails, it may also set a five-minute first-party functional fallback cookie so the same asset is loaded locally. Neither cookie is used for analytics, advertising or profiling, and there are no third-party tracking scripts.

Why we are allowed to hold it

Your account and workspace — because we need it to provide the service you asked for (contract).

Sign-in codes, security and diagnostic records — because we have a legitimate interest in keeping accounts secure and the service working.

The waiting list — because you asked to be told when a place is available (consent). You can withdraw at any time by emailing us.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, and object to how we use it.

Where a venture holds records about you, we will tell you who to ask and pass the request on.

We will respond to any request about your data within one month, as required by UK GDPR. If a request is complex we may extend that, and we will tell you why before the month is out.

If you believe we have handled your personal data improperly, you can complain to the Information Commissioner's Office, the UK's supervisory authority for data protection. ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk. We would rather you told us first, but you are not required to.

How long we keep it

Email privacy@foundry365.org and we will close it. Before we delete anything we will send you an export of your workspace — documents, records and the data behind them — and we will give you 30 days to tell us the export is complete and correct. After that we delete your data from our systems within a further 30 days, and it disappears from our backups within 7 days of that.

Contact

Questions about this page, or a request about your information, go to privacy@foundry365.org.

Changes

If this page changes materially, we will say so here and date the change. Old versions stay available.