Privacy Policy

1. Who we are

Foundmill is run by Collingham AB, a company registered in Sweden (organization number 559360-6907), Valhallavägen 38, 11422 Stockholm, Sweden. Collingham AB is the controller of the personal data described here, which means we decide how and why it is used.

This policy covers foundmill.com, the apps and the emails we send. It explains what we collect, why, who we share it with, how long we keep it and the choices you have. Our Terms of Service explain the rules for using Foundmill.

Questions about privacy go to privacy@foundmill.com.

2. What we collect

What you give us:

Account

Your email address, your name and how you sign in. With Google, we receive your name, email address and profile picture from Google.

Profile

What you choose to add: a headline, where you are based, what you are good at and what you want to learn. A public profile shows only what you publish.

A card before sign-up

If you try the idea box on the home page before signing up, the line you type (or the interest you pick) and the card drafted from it. It is kept for 7 days, or until you sign in and keep it.

Projects

Your ideas and everything your team makes and does: plans, messages, drafts, code, pages, files, contacts you add, and your decisions and approvals.

Voice

If you talk to your team, the recording is turned into text. We keep the text, not the recording.

Keys

Keys you enter to connect your own accounts with other services. They are encrypted and used only to do what you ask.

Payments

What you bought and when. Stripe handles your card; we never see the full card number.

Messages to us

What you write when you contact us.

What we collect as you use it:

Use

Which days you visit, when you were last active and what you do in Foundmill, so we can show "since you were last here", send the emails you asked for, and improve the product.

Device and network

Your IP address, browser and device type, kept in server logs to keep the service running and secure and to limit abuse.

How you found us

If a project's page or a person's profile on Foundmill brought you, which one, recorded once when you sign up. Whoever it belongs to may be told that someone signed up through it, never who.

Bot check

The idea box on the home page and the Follow form on a project's page use Cloudflare Turnstile to block automated abuse: it checks your browser, without a puzzle, before a card is drafted or a follow is recorded. Cloudflare's handling of that data is set out in its Turnstile Privacy Addendum.

We do not ask for sensitive data such as health, religion or sexual orientation, and you should not add it to a project unless your business needs it.

3. How we use it, and our legal bases

Under the GDPR we need a legal basis for each use. Ours are:

To run the service

Your account, your projects, your team's work, sign-in and the emails that are part of the service. Basis: our contract with you.

To keep it safe

Preventing fraud, abuse and attacks, and limiting how much one person or address can use. Basis: our legitimate interest in a secure service.

To improve it

Understanding which parts are used and what goes wrong, mostly from counts and logs. Basis: our legitimate interest in a better product.

To write to you

Product news and reminders you can turn off in Settings or from any such email. Basis: our legitimate interest, or your consent where the law requires it.

To meet the law

Bookkeeping, tax, and answering lawful requests from authorities. Basis: our legal obligations.

We do not make decisions about you that have legal or similarly significant effects by automated means alone.

4. AI and your content

Your team of agents runs on AI models from other companies. To do what you ask, we send them the parts of your project the work needs. Under the terms we use them on, Anthropic and OpenAI do not use what we send to train their models.

We do not use your content to train AI models, and we do not sell it.

If you connect your own AI provider with your own key, that work runs on your account with that provider, under your agreement with them.

5. Who we share it with

We share personal data only in these ways:

• With the people in your project: cofounders and collaborators see the project's work, as their access allows.
• With anyone, when you publish: a public page or profile is public.
• With the services you connect, when you ask your team to use them.
• With the providers below, who process it for us under contract and only on our instructions.
• With authorities, when the law requires it, and to protect people's safety or our rights.
• With a company that takes over Foundmill, under this policy, and we will tell you first.

The providers that process personal data for us:

Supabase

Sign-in and the database. Stockholm, Sweden.

Railway

The servers that run the service. Amsterdam, the Netherlands.

Vercel

The website. Frankfurt, Germany, served through a worldwide network.

Anthropic

The AI models your agents run on. United States.

Voyage AI

Search across your project's own material. United States.

OpenAI

Pictures, such as agents' portraits. United States.

ElevenLabs

Turning your voice into text. United States.

E2B

Secure sandboxes where agents run code. United States.

Twilio SendGrid

Emails from Foundmill and from your project's address. United States.

Resend

Sign-in emails. United States.

OneSignal

Notifications on your phone, if you allow them. United States.

Stripe

Payments. Ireland and the United States.

Google

Sign-in with Google, if you use it. United States.

GitHub

Your project's code, if you connect it. United States.

Cloudflare

The check that the idea box and the Follow form on a project's page are used by a person, not a bot (Turnstile). United States. See Cloudflare's Turnstile Privacy Addendum.

Emails from Foundmill and from your project's Foundmill address carry no open or click tracking.

6. Where your data is

Your account and your projects are stored in the European Union. When a provider in the United States processes them, the transfer is protected by the EU-U.S. Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

7. How long we keep it

Account

While your account is open. When you ask us to delete it, we delete it within 30 days.

A card before sign-up

7 days, unless you keep it by signing in; 90 days if you join the waitlist with it.

Projects

Until you delete them. A deleted project is removed 7 days after you ask, so you can change your mind.

Backups

Deleted data leaves our backups as they expire, within 30 days.

Server logs

Up to 30 days.

Sign-in codes and links

They expire after 15 minutes and work once.

Payment records

7 years, as Swedish bookkeeping law requires.

Voice recordings

Not kept: only the text is kept, with your project.

We may keep something longer when the law requires it or to settle a dispute, and only for that.

8. Cookies

We use no advertising or tracking cookies and no third-party analytics. The cookies and browser storage we use keep you signed in, remember a choice you made or remember which page on Foundmill brought you, which is why we do not ask for consent to them:

sb-…-auth-token

Keeps you signed in. Set when you sign in, removed when you sign out.

sb-…-code-verifier

Protects a sign-in in progress (for example with Google). Lasts a few minutes.

fm_idea

Keeps the card you made on the home page before signing up, so you can keep it when you sign in. 7 days.

fm_via

Remembers the project's page or the person's profile on Foundmill that brought you here, if one did, until you sign up. 30 days.

fm_post

Remembers the public code in the link of the last post from a project on Foundmill that brought you here, if one did, so the project can see which post led to your follow. 7 days.

fm_last_business

Opens the project you used last. Up to one year.

fm_date_format

The date format you chose. Up to one year.

fm_text_size

The text size you chose. Up to one year.

Your browser also keeps a few settings on your device that are never sent to us, such as whether you folded the sidebar or opened a section.

You can delete them in your browser's settings. Without the sign-in cookies you will not stay signed in.

9. Your rights in the European Union and the UK

Under the GDPR you have the right to:

• see the personal data we hold about you and get a copy
• correct it if it is wrong
• have it deleted
• get it in a format you can take to another service
• object to our use of it based on our legitimate interests, and to direct marketing at any time
• restrict how we use it while a question is settled
• withdraw consent where we rely on it, without affecting what came before

You can also complain to a data protection authority: in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se), or the authority where you live or work. We would like the chance to help first.

10. Your rights in the United States

If you live in California or another US state with a privacy law, you have the right to:

• know what personal information we collect, use and disclose, and get a copy
• correct it
• delete it
• opt out of the sale or sharing of your personal information for targeted advertising: we do not sell or share it, and have not in the last 12 months
• not be treated differently for using these rights

The categories we collect are the ones listed above: identifiers (such as your name, email and IP address), commercial information (what you bought), internet activity (how you use the product), audio (voice you choose to send, turned into text), professional information you add to your profile, and the content of your projects. We use them only for the purposes in this policy and do not use sensitive personal information to infer things about you.

We treat a Global Privacy Control signal from your browser as a request to opt out, though there is nothing to opt out of. You may use an authorized agent; we will ask them to show that you gave them permission.

11. How to use your rights

Write to privacy@foundmill.com from the email address on your account. We may ask you to confirm it is you. We answer within one month under the GDPR and within 45 days under US state laws; when a request is complex we may take longer, and will tell you why. It is free.

You can edit your profile and delete a project yourself in the product. Closing your account and exporting all your data is done by request for now.

12. Signing in with Google

If you sign in with Google, we receive your name, email address and profile picture, and nothing else from your Google account. We use them only to sign you in and to show your name and picture in the product. We do not use them for advertising, do not sell them and do not share them except with the providers that run sign-in for us.

Foundmill's use of information received from Google follows the Google API Services User Data Policy, including the Limited Use requirements.

13. Security

Data travels encrypted. Keys you connect are sealed in an encrypted vault and used only by the one service that calls other companies. Each project's data is separated in the database so that only its own people can reach it, and access on our side is limited to the people who need it to run the service. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the authorities as the law requires.

14. Children

Foundmill is for people 18 and older. We do not knowingly collect data from anyone younger, and we delete an account we learn belongs to someone under 18.

15. Changes to this policy

We will update this policy when what we do changes. For a change that matters to you, we will tell you by email or in the product before it takes effect. The date at the top shows when it last changed.

16. Contact

Write to privacy@foundmill.com.

Collingham AB, a company registered in Sweden (organization number 559360-6907), Valhallavägen 38, 11422 Stockholm, Sweden.