Privacy

Today

• No account and no login. No email is needed to score. Reminders ask for an email; plan requests offer an optional reply email.
• No analytics, no tracking pixel, no advertising identifier and no cookie.
• When you run the scan or the assessment, we keep: the web address you entered, what our checks found on your public site, and any optional answers you add afterwards to sharpen your score.
• That result is saved under a random link for 30 days by default and then deleted. Anyone with the link can see it. There is no index of results and no way to search them. Please do not type anything confidential.
• If you ask for an improvement plan, we keep the website, note and optional reply email you send in a request log on our server, and email them to our team when mail is set up. We do not keep your network address with it. Anything you put in the note, such as an email address for a reply, is kept with the request. Contact details are used only to answer your request.
• Rate limits keep a hashed client key and timestamps in memory only, never on disk. The assessment window defaults to 15 minutes; other routes have their own windows, such as 20 live-URL checks per hour.
• The live assessment sends the public company domain/name and excerpts from its public site in evidence prompts, and generated buyer questions to answer-engine providers whose keys are set. Perplexity Sonar is live in production; Gemini is paused. An OpenAI adapter is built but has not run live. With no key, the result says so and shows site checks only.
• The scan and assessment read public pages of the named site as FoundronicsAssessmentBot, with private network addresses blocked. “Check live URL” fetches one URL on the stored company’s host or its www alias, only on click. Peer “Refresh now” and “Save to the store” re-read one company’s public pages, respecting robots.txt, with per-client and per-company limits.
• After a result is saved, background Opinions and Nods lookups can update and re-score it, at most once per domain per hour, using the same budget and caches. The first score stays unchanged as its initial snapshot; enrichment is recorded separately.
• Paid calls use a daily rupee budget and a cost log. Evidence is cached for 7 days and live runs reused for 24 hours. “Polish copy” sends the template draft with its sources and company name/address to Perplexity only on click, never Gemini; polished drafts are cached for 7 days per domain, fix and kind.
• Server files hold saved results, cached evidence and drafts, request logs and visitor-saved companies under FOUND_DATA_DIR. Results expire after 30 days by default, configurable through FOUND_RESULT_TTL_DAYS. The installation-only baseline-signing-key contains no customer data and signing a baseline does not extend a result’s expiry.
• Reminder requests append email, domain, due date and page, with no IP address. Only an optional confirmation is sent when mail is configured; no email is sent on the due day. Visitor-saved companies hold the public address, typed name and public facts, and are not shown publicly until a person reviews them.
• Browser storage, not cookies: foundronics.plan-request.v2 keeps the plan-form draft (use the form’s clear control); found-draft-v1 keys keep edited draft text, check URL and time per result/draft (use “Reset to template”); found-chosen-baseline keeps a pinned or imported signed baseline in localStorage/sessionStorage (clear the selected baseline on the assessment page); found-completed-action:<domain> keeps your completed-work note. Clear site data in your browser to remove these records. They stay in the browser except when you submit a form, import a baseline for validation, check a URL or request a comparison.

What is still to come

A full policy on lawful basis, processors and deletion on request is still to be written. The improvement-plan form offers an optional work email for a reply; it is never needed to score or request a plan. To have a saved result deleted sooner than 30 days, use corrections.

What will never happen

• Your email sold, rented or passed to a data broker.
• Reading private pages or bypassing a bot wall to run a scan.
• A visitor-saved company listed publicly before a person reviews it. See corrections.