Privacy & Cookies

FoundingOS (“we”, “us”) provides a business operating system — Core.Operations, Core.Workforce and Core.Intelligence — through our website, web app and mobile app. This page explains what personal data we handle, why, who helps us process it, and the choices you have. We handle personal data in line with UK and EU data protection law (UK GDPR, EU GDPR and PECR).

Who is responsible

For your account and our website, FoundingOS is the data controller. For business records your company puts into FoundingOS (for example its customers, candidates or staff), your company is the controller and we process that data on its behalf and on its instructions.

What we collect

Account details: name, email address, role and a securely hashed password.
Business records you enter or import: orders, products and product photos, invoices, inventory, campaigns, deals, candidates, employee records, deliveries and related notes.
Billing details: plan, subscription status and invoices. Card payments are handled by Stripe; we never see or store full card numbers.
Messages sent or received through channels you connect, such as WhatsApp, when you turn them on.
Security and audit logs: sign-ins and changes made in your workspace, so actions can be traced.
Optional private ratings and comments you send through “Rate FoundingOS”. These go only to the FoundingOS team and are never published.

Why we use it (lawful basis)

To provide the service you signed up for — contract.
To keep FoundingOS secure, prevent abuse and improve it using your feedback — legitimate interests.
To keep financial and tax records — legal obligation.

We do not sell your data, and we do not use it for advertising.

Who helps us (processors)

Vercel — website and app hosting, and product photo storage.
Our managed PostgreSQL database provider — storage of workspace data.
Stripe — subscription billing and payments.
Anthropic — powers FoundAI answers when you ask it a question.
Resend — sends account and notification emails.
Meta (WhatsApp Business) — only if you connect WhatsApp.

Some providers may process data outside the UK or EEA. Where they do, we rely on recognised safeguards such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses.

Cookies and browser storage

FoundingOS uses only cookies and browser storage that are strictly necessary to run the service or that remember choices you make. We do not use advertising, cross-site tracking or third-party analytics cookies, so there is nothing optional to switch off. If we add optional analytics in future, we will ask for your consent first.

Name	Type	Purpose	How long
foundingos_site_access	Cookie (HTTP-only)	Keeps you signed in to protected FoundingOS pages.	Until you log out or it expires
foundingos-theme	Cookie	Remembers day or night mode when you choose it.	1 year
foundingos-lite	Cookie	Remembers the lighter display mode when you choose it.	1 year
fo_ai_assistance, fo_onboarded_brands	Cookie	Remembers whether you turned FoundAI guidance on or off and which intros you have seen.	1 year
Workspace session	Browser storage	Holds your signed-in workspace session on this device.	Until you sign out
Preferences (language, currency, layout, saved views, card order, demo data)	Browser storage	Remembers settings you choose so the app looks the way you left it.	Until you clear them
Test workspace data	Browser storage	Stores data you enter in the interactive test workspaces on this device only.	Until you reset or clear it

You can clear cookies and site data in your browser settings at any time. Doing so signs you out and resets your saved preferences. The mobile app stores your sign-in securely on your device in the same way.

How long we keep data

We keep account and workspace data while your account is active. When a company asks us to close its account, we delete its workspace data, except records we must keep by law (such as billing records).

About FoundAI

FoundAI answers are written by artificial intelligence. They can be wrong, out of date or incomplete, including market prices, trends and competitor information. They are not financial, legal or tax advice. Check anything important before you rely on it.

How we protect it

Data is encrypted in transit (HTTPS/TLS). Each company’s data is kept separate, access is based on roles, integration credentials are encrypted, and changes are recorded in an audit log.

Your data rights

You can ask to see, correct, export or delete your personal data, object to or restrict how we use it, and ask for a copy in a portable format. Company owners can export their workspace data from settings. Email us to make a request — we reply within one month. See how to delete your data. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Contact

For privacy questions or data requests, contact privacy@foundingos.com.