Privacy Policy

What we collect, why we collect it, and what we will never do with it. Plain summary first, full policy below.

Last updated 1 August 2026

The plain-English version

You are trusting us with sensitive material — identity documents, tax numbers, bank activity. Here is exactly how that is handled.

We never sell your data — not to advertisers, not to data brokers, not to lead generators. There is no version of Foundli where your information is the product.
Bank access is read-only — we can see transactions in order to categorize them. We cannot move money, and we never store your banking password.
ID documents are encrypted and access-logged — we collect them only because federal filings require them, and every access is recorded.
We only share to do the job — government agencies when you direct a filing, and vetted processors that run payments, email, and infrastructure. That’s the list.
You can see and delete what we hold — export everything in one click, and request deletion of anything we are not legally required to retain.
You control the emails — marketing is off unless you opt in. Filing deadlines and security alerts we will keep sending, because they protect your business.

This summary is here to be understood, not to replace what follows. Where the two differ, the full terms below are what govern.

1. What we collect

We collect only what is needed to provide the service. That falls into five categories:

Account information — your name, email address, phone number, and password (stored only as a cryptographic hash).
Business information — entity names, addresses, formation details, ownership structure, and tax identification numbers.
Identity documents — government-issued ID images and dates of birth, collected only where a filing such as the Ownership Report legally requires them.
Financial information — transaction data from bank accounts you choose to connect, and receipts or mileage you record.
Usage information — how you use the product, device and browser details, and IP address, used to keep the service working and secure.

In plain terms

We do not collect your banking password. Connections run through a regulated aggregator, and Foundli only ever receives read-access to transaction data.

2. Why we collect it

Each category has a specific purpose, and we do not repurpose data beyond it:

To provide the service you signed up for — preparing filings, tracking deadlines, categorizing transactions.
To meet legal obligations — including identity information required by federal beneficial-ownership rules.
To secure your account — detecting unauthorized access and enabling two-step sign-in.
To support you — so a person can answer your question accurately when you ask.
To improve the product — using aggregated, de-identified usage patterns.

3. What we never do

We do not sell, rent, or trade your personal information. We do not share it with advertisers or data brokers. We do not use your financial data to market third-party products to you, and we do not build profiles for advertising purposes.

If Foundli is ever acquired, we will notify you before your information transfers, and the acquirer will be bound by commitments no weaker than these.

4. Who we share with

We share your information in four situations only:

Government agencies — when you direct us to submit a filing, we transmit exactly what you approved.
Service providers — payment processing, email delivery, cloud hosting, and bank-connection infrastructure. Each is contractually bound to protect your data and may use it only to perform its service.
People you authorize — an accountant or team member you explicitly invite, with the access level you choose.
Legal requirements — where we are compelled by valid legal process. Where lawfully permitted, we will notify you first.

5. How we protect it

Data is encrypted in transit and at rest. Identity documents are held in restricted storage with additional encryption and full access logging.

Internal access follows least privilege: staff can reach only what their role requires, access is logged, and sensitive-record access is reviewed. We maintain SOC 2 controls and undergo independent audit.

Two-step sign-in is required on accounts with filing or financial access.

6. How long we keep it

We keep your information while your account is active. After you close it, we delete personal data within 90 days, except where retention is legally required.

Filing records and related documentation are retained for the period required by the relevant agency — commonly five to seven years — because you may need to evidence a filing long after leaving.

In plain terms

If you want a copy before you go, export everything first. Once deletion runs, we cannot recover it.

7. Your rights and choices

Wherever you live, you can:

Access and export everything we hold about you, in a portable format.
Correct information that is wrong.
Delete data we are not legally required to keep.
Withdraw a bank connection at any time, which stops all further transaction access.
Choose which emails you receive, other than deadline and security notices.

[FOR ATTORNEY COMPLETION] State- and jurisdiction-specific rights — including California (CCPA/CPRA), other applicable US state privacy laws, and GDPR/UK GDPR if the service is offered in those regions — must be enumerated here with the required disclosures and response timelines.

8. Cookies and tracking

We use cookies that are necessary to keep you signed in and the service secure, and privacy-respecting analytics to understand how the product is used.

We do not use third-party advertising trackers, and we do not permit third parties to track you across other sites through Foundli.

9. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read their privacy policies.

10. Children

Foundli is not directed to anyone under 18, and we do not knowingly collect information from children. If we learn we have, we will delete it.

11. International Data Transfers

Your information may be transferred to and processed in the United States. By using our Service, you consent to this transfer. We implement appropriate safeguards for international data transfers.

12. Changes to this policy

We will notify you by email at least 30 days before any material change takes effect, and keep a dated record of what changed. We will not quietly broaden how your data is used.

13. Contact

Privacy questions or requests: [email protected], or Foundli, Inc., 128 Market Street, Austin TX 78701. We respond within 30 days, usually far sooner.

Questions about any of this?

Ask us in plain words and we’ll answer in plain words. No lawyer required to get a straight response.

Message a person