Your data in Foundry

Privacy policy

Last updated: October 15, 2026

This policy explains how Foundry handles information when you visit our website, use a company workspace, or connect a business account. Contact [email protected] with privacy questions or requests. Your organization controls the business information it brings into Foundry and which members can access it.

Information we collect

We process account and organization details, such as your name, email address, membership, and permissions; content you provide, including messages, uploads, and company knowledge; and records needed to operate and secure the service, including sign-in activity, requests, errors, and AI execution diagnostics.

When you connect an integration, we store its account identifiers, settings, and encrypted authorization credentials. We use these credentials to access the provider on your organization’s behalf. Credentials are not included in AI prompts or project files.

Information from Google

• Google Analytics: accessible accounts and properties, website traffic, ecommerce metrics, and reporting dimensions used in analytics and investigations.
• Search Console: accessible properties, search queries, page performance, sitemap information, and URL inspection results used in SEO reports.
• Google Ads: accessible advertising accounts and campaign, performance, and conversion reports. Google grants a broader advertising permission; Foundry uses it only for reads.
• Google Sheets: spreadsheet titles, structure, and cell contents, including hidden tabs, for spreadsheets accessible to the connected account and requested in Foundry.
• Gmail: mailbox identity, message headers and bodies, attachments, and correspondence dates used to find customer conversations, summarize relevant history, and prepare replies. The Inbox evaluates unanswered conversations against your configured questions to sort them; Foundry does not change Gmail labels. If you separately enable sending, Foundry sends only after approval of each proposed email.

Each integration requests its own permissions. Your Google password is never provided to Foundry. Connecting an account can make its data available to other members of your organization who have the relevant Foundry permissions.

How we use and share information

We use information to provide your workspace, answer your requests, run tasks you configure, build reports and company knowledge, manage access, provide support, and investigate security or service issues. Requested outputs may include Google data or information derived from it.

Relevant content is sent to OpenAI for AI processing. For configured classification, sorting and labeling, relevant content and questions are sent to Typesafe’s Jev service. LangSmith, operated by LangChain, supports agent execution, computation, and diagnostic tracing. Hosting and storage providers process information needed to operate Foundry. AI prompts, tool results, responses, and traces can contain content from your connected accounts. These services process data for the corresponding Foundry features; connecting Google is not permission to train general-purpose AI models on your Google data.

Foundry does not sell Google user data, use it for advertising or credit decisions, or use it to train or improve general-purpose AI models. Transfers of Google data are limited to providing the features you authorize, necessary security purposes, legal obligations, or a business transfer with your prior explicit consent.

Foundry’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data and developer policy.

Foundry personnel may access specific Google content with your affirmative agreement, where necessary for security investigations or to comply with law, or for permitted internal operations using aggregated and anonymized information. Ordinary use by members of your workspace remains governed by your organization’s permissions.

Storage, retention, and security

Foundry scopes workspace access by organization and member permissions and encrypts saved integration credentials. Service providers may process information in countries other than yours.

Conversations, project extracts, reports, uploads, saved knowledge, and diagnostic traces may contain connected data. They do not automatically expire when a run ends or when you disconnect an account. Diagnostic archives currently have no automatic expiry. Temporary caches have separate lifetimes; they are not a substitute for deleting durable records.

Disconnecting removes the saved authorization credentials and stops future access through that connection. It does not automatically erase previously saved content or the connection’s non-secret identity. For deletion of retained data, including traces and provider-held copies, follow the data and deletion guide. We explain any legal retention requirements or backup limitations when handling your request.

Your choices and requests

You can choose not to connect Google, disconnect individual integrations, or revoke Foundry access in your Google Account connections. Revoking access may affect several Foundry integrations connected with that account.

Contact your organization administrator or [email protected] to request access, correction, export, or deletion, or to raise a concern about processing. We verify your identity and authority before releasing or deleting organization information. Depending on your location, you may also have rights to object, restrict processing, withdraw consent, or complain to a data protection authority.

Cookies and website requests

Foundry uses session and security cookies to keep you signed in and protect requests. Browser preferences may be stored locally. Loading the signed-in interface may also request fonts from Google Fonts, which receives the network information needed to serve them.

Changes to this policy

We update this page when our practices change. For new uses of Google data beyond the authorization you gave, we provide notice and obtain additional consent before those uses begin.