Privacy Policy

1. The short version

• We collect what you tell us, what you make with Ted, and basic information about how you use Foundable.
• We use it to run Foundable for you, keep it safe, and make it better.
• We don’t sell your personal information or show ads in Foundable. We share limited data with Meta, Google and OpenAI to measure our marketing, and with Meta for campaigns you ask us to run (Sections 7 and 8).
• We don’t train AI models on your content.
• You can ask for a copy of your information, correct it, or delete it. You can delete your account yourself at any time, and deleting it is permanent.
• If you build a website with Foundable, you decide what it collects from your visitors, and we handle that information for you.

2. About this policy

Foundable gives you Ted, an AI assistant that builds and runs a website and business with you. This policy explains how Autono Labs, Inc. (“Foundable,” “we,” “us”) handles personal information when you visit foundable.com, use your account, pay for Foundable, or publish a website with it (the “Services”). This version applies to accounts created on or after October 30, 2026 from that day, and to accounts created before then from November 30, 2026.

A few words we use: a foundable is a business you run with Ted, along with everything Ted makes for it. Your content is what you put into Foundable or make with it, such as your messages and emails with Ted, files, websites and the data they hold, posts, mail, phone calls, videos, what Ted reads from apps you connect, and your settings.

3. Information we collect

What you give us

• Account details, such as your email, name, picture, time zone, notification settings, the foundables you belong to, and the phone number you link if you text Ted.
• Your content, as described in Section 2.
• Billing details, such as your name, billing address, country, tax details, the last four digits of your card, your plan, and what you buy. Our payment providers handle your full card number; we never see or store it.
• Support messages, including attachments and feedback. When you need our help, Ted sends our team a short report with your latest message and its pictures, and tells you he did.

What we collect automatically

• Usage information, such as the pages you visit, what you click, which features you use, errors, and the link that brought you to us. We also record sessions (the screens you see, where you click and scroll) to find and fix problems. These recordings can show your chats, documents, websites and what you type into message and form fields, including drafts you don’t send. Fields for passwords, sign-in codes, payment details and app secrets are masked or excluded from recordings.
• Device information, such as your IP address, browser, operating system, and the approximate location your IP address suggests.
• Records of Ted’s work: what Ted was asked, what he did and the tools he used, which we use to check the quality of his work and fix problems. They can include your name and email, for example when Ted is told your email in a chat you start, or looks you up to suggest a business.

What we get from others

• Sign-in services: your name and email from Google, Apple or another service you sign in with.
• Apps and accounts you connect, such as your social accounts, email, calendar, documents, or a Stripe account for selling. We keep the identifiers of each connection; the connection’s provider keeps the login, and we never store your passwords. If you sell through Foundable Payments, Stripe tells us about your customers’ purchases and subscriptions.
• Public information: when you set up your first foundable, Ted may search the public web using your name and email, to suggest a business that fits you. He uses what he finds only for that.
• Referrals: if someone invited you, we record that, and they can see your name, when you joined and whether your first payment earned them credits.

Please don’t put health, biometric, government ID or other highly sensitive information into Foundable. We use your sign-in details and account connections only to sign you in, keep your account secure and do what you ask, never to draw conclusions about you.

4. How we use it

• To run Foundable for you: building and publishing your websites, doing the work you ask for in apps you connect (such as posting, sending mail and taking payments), and texting with you.
• To create Ted’s work with our AI providers (Section 5), and to check its quality.
• To keep Foundable safe: signing you in, preventing fraud and abuse, and fixing problems.
• To handle payments, refunds and disputes.
• To support you and answer your questions.
• To message you: service messages about your account, security and billing, which you can’t turn off while you have an account, and product updates, which you can turn off in Settings › Notifications or with the unsubscribe link.
• To improve Foundable, using combined or de-identified information where we can.
• To meet legal obligations and enforce our Terms.

5. AI and your content

We don’t train AI models on your content. Ted runs on AI models from providers including OpenAI and Anthropic, which process your content to do the work you ask for and, under their API terms, don’t use it to train their models. Our subprocessor list names every provider, what each one receives and how it handles your data.

You stay in control. Ted can act on his own only within the permissions, budget and connected accounts you turn on, and you can pause or turn these off at any time. Something he has already done in another service, such as a sent email, can only be undone with that service’s own tools. Foundable doesn’t make automated decisions about people that have legal or similarly significant effects.

6. Who we share it with

• Service providers that run parts of Foundable for us under contract, such as hosting, AI, sign-in, email and messaging, payments, support, analytics and error monitoring. They may use your information only to provide their service to us. Our subprocessor list names each one.
• Payment companies. Stripe processes payments, and Link, a Stripe service, is the seller of record for our plans and credits. They also use payment information for their own fraud-prevention, legal and tax purposes, under their own privacy policies.
• Apps you connect, when you ask Ted to do something in them. They handle it under their own terms and privacy policies. When Ted searches the web or looks for photos, search services receive his search words. When you list your products on Google, Google receives them and your business’s contact details.
• Advisers and buyers: our lawyers and accountants, under confidentiality, and a buyer or successor if we’re involved in a merger, acquisition or sale of assets.
• Authorities, when the law requires it and after we check the request is valid.

We don’t sell personal information or share it with data brokers. We share the limited data Sections 7 and 8 describe with Meta, Google and OpenAI to measure our marketing, and with Meta for campaigns you ask us to run.

7. Websites you publish

You decide what your website collects from its visitors, and you’re responsible for its privacy notice and any consent it needs. We handle your visitors’ information on your behalf, under our Data Processing Addendum. If you visited a website built with Foundable and have a question about your data, contact the person who runs that website.

Unless you turn it off in the site’s Publish panel, your website has simple visitor analytics: the pages viewed, the site that linked to them, the kind of device, the visitor’s approximate city and country, and which AI assistants (such as ChatGPT) read which pages. It uses one cookie that lasts 30 minutes and doesn’t store visitors’ IP addresses. If your website runs its own code, we also keep short-lived technical logs so you and Ted can fix problems; your website shouldn’t write its visitors’ personal information into them.

When you approve a campaign managed by Foundable, we send its content to Meta. Participating websites ask visitors whether to share visits with Meta for measurement and personalized promotions. Only after a visitor chooses Allow do we send the time of a visit, the website’s address and business identifier, an event identifier, and the visitor’s IP address and browser details. We don’t send the page’s path, query, content, forms or visitor email address. This feature doesn’t install a Meta browser pixel. Visitors can choose Decline or change their choice through Privacy on the website; a Global Privacy Control signal also stops this sharing. We remember the choice in that website’s browser storage for up to 180 days.

8. Cookies and analytics

We use cookies and similar browser storage to keep you signed in, remember your preferences, run support chat, and understand how Foundable is used. To measure our own ads on Facebook and Instagram, our public pages use the Meta Pixel, and our servers tell Meta when an account is created, a plan checkout starts and a plan is first paid: the plan’s price, a hashed form of your email address and account ID, your IP address and browser, and the IDs in Meta’s cookies. Meta uses this to count which of our ads led to sign-ups and purchases. Our servers also tell Google when an account is created, a first website is built and a plan is first paid, with the plan’s price, a hashed form of your email address and the ID in the Google ad link you clicked, so Google can count which of our ads worked. To measure our own ads in ChatGPT, our public pages use OpenAI’s pixel, and our servers tell OpenAI when an account is created, a plan checkout starts, a first website is built and a plan is first paid: the plan’s price, a hashed form of your email address and account ID, your IP address and browser, and the IDs in OpenAI’s cookies. On a page where it runs, OpenAI’s pixel can also send a hashed form of contact details typed into a form. OpenAI uses this to count which of our ads led to sign-ups and purchases. These marketing events don’t include your chats, website content or business records. If your browser sends a Global Privacy Control signal, we don’t load the pixels or send these events for you. Our Cookie Notice has the details.

9. How long we keep it

• Your account and content: while your account is open. When you delete your account, we delete it and every foundable you own right away, end your plan, and delete your saved payment details. Deletion is permanent; we can’t restore an account.
• Backups: deleted information can remain in our backups until they expire, within 60 days.
• Service logs: up to 30 days.
• Usage, analytics and records of Ted’s work: for as long as we need them to run, secure and improve Foundable, then we delete or de-identify them. This can include time after an account is deleted.
• Your website’s visitor analytics: up to 90 days.
• Billing and payment records: as long as we need them for tax, accounting, disputes and other legal obligations, including after an account is deleted.
• Support conversations: as long as we need them to help you. Email privacy@foundable.com to have them deleted.

Besides the records above, we keep a record that a deleted account existed, without personal details, and your acceptance of our policies. Our providers may keep copies for a limited time under their own terms, for example for safety or legal reasons.

10. Security

We protect your information with safeguards such as encryption in transit and at rest and strict access controls, and we keep each foundable’s information separate. No system is perfectly secure. If a breach affects your personal information, we’ll tell you as the law requires. Our Security page has more.

11. Your choices and rights

Depending on where you live, you can ask to see or get a copy of your personal information (including in a portable format), correct it, delete it, limit or object to how we use it, or withdraw consent you gave. You can also complain to your local data protection authority at any time. We won’t treat you differently for using these rights.

You can do much of this yourself:

• Edit your profile, or delete your account, in Settings › Account.
• Choose which emails you get in Settings › Notifications.
• Disconnect an app or account from the place you connected it.
• Stop texts from Ted by texting STOP.

For anything else, email privacy@foundable.com. We may need to confirm it’s you, and we’ll answer within the time the law allows. You can use an authorized agent; we may ask for proof they act for you. If we turn down your request, you can appeal by replying to our answer, and if you’re still not satisfied, you can contact your state attorney general.

12. Google and Microsoft user data

Foundable’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We handle information from Microsoft APIs under the same commitments and the Microsoft APIs Terms of Use.

• What we access: when an owner or admin connects a Google app (Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Google Analytics or Google Search Console) or a Microsoft app (Outlook, OneDrive, Excel or Teams) in Settings › Integrations, Ted reads what his work needs, such as recent email or this week’s calendar. When an owner or admin lets him, he can also send, change or delete things there for the business without asking again for each step. He follows requests to keep work as a draft, settings that require approval, and instructions to stop.
• When: when someone in your foundable asks him to in a chat or a text, when a task they scheduled runs, and in Run, the work Ted does on his own.
• How we use it: only to provide the features you use, such as Ted’s answers and the work you ask him to do. We don’t use it for advertising, don’t sell it, and don’t use it to decide creditworthiness or for lending.
• Who receives it: what Ted reads goes only to Composio, which runs the app connections, and to OpenAI and Anthropic, whose models read it to write Ted’s reply. What Ted makes from it, such as a reply or a draft, is handled like the rest of your content (Section 6). Otherwise we share it only to comply with the law or as part of a merger, acquisition or sale of assets, with notice to you.
• No human reads it unless you ask us to (for example, in a support request), we need to investigate abuse or a security problem, the law requires it, or it’s combined and anonymized for internal operations. What Ted reads stays out of our logs and records of his work, though a reply that repeats it is kept with your chat.
• No AI training: we don’t use it to develop, improve or train generalized AI or machine-learning models, and our AI providers process it under API terms that don’t train their models on it.
• How long we keep it: we don’t keep what Ted reads after the reply he reads it for. What he makes from it, such as a reply, a draft or a note, is part of your content and is deleted with it (Section 9).
• Your controls: an owner or admin can disconnect an app at any time in Settings › Integrations, and you can remove Foundable’s access in your Google or Microsoft account’s security settings.

13. US state privacy rights

If you live in California or another US state with a privacy law, you have the rights in Section 11, including the right to know what personal information we hold about you. We collect the kinds of information below for the purposes in Section 4 and disclose them for business purposes to the recipients in Section 6. We don’t sell personal information. For the purposes in Sections 7 and 8, we share the kinds marked below with Meta, Google and OpenAI, which these laws call “sharing”. A Global Privacy Control signal opts your browser out, or email privacy@foundable.com. We use sensitive information only for the purposes the law permits.

To use your rights, email privacy@foundable.com.

14. Europe, the UK and Switzerland

If you’re in the EEA, the UK or Switzerland, we rely on these legal bases:

• Contract: to provide the Services you signed up for, including your purchases.
• Legitimate interests: to keep Foundable secure, check and improve it, and send product updates you can turn off, where your rights don’t outweigh these interests.
• Consent: for texting with Ted, which starts when you text the code we show you and stops when you text STOP, and for the optional sharing of website visits described in Section 7, which visitors can stop through Privacy on that website.
• Legal obligation: to meet tax, accounting and other legal requirements.

We’re based in the United States, and we and our providers may process information there and in the other countries on our subprocessor list. Where required, we protect these transfers with the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents, through our provider agreements and our Data Processing Addendum.

15. Children

Foundable isn’t meant for anyone under 16, or a higher age where the law sets one, and we don’t knowingly collect their personal information. If you think a child has given us information, email privacy@foundable.com and we’ll delete it.

16. Changes to this policy

We’ll update this policy as Foundable changes, and the date at the top shows the latest version. If we make a material change, we’ll tell you in advance by email or in Foundable.

17. Contact us

Questions or requests: privacy@foundable.com. Autono Labs, Inc. is responsible for your personal information under this policy (its “controller,” where the law uses that term). Our address: Autono Labs, Inc., Attn: Privacy (Foundable), 131 Continental Drive, Suite 305, Newark, DE 19713, USA.