Privacy Policy

1. Who we are

Foundworks ("we," "us," or "our") is the business name Zach Padilla and Brendan Lee use for the web design studio they run together. It is not a corporation or limited liability company. In this policy, "Foundworks" means the two of them, acting for the studio. We decide how and why the personal information described in this policy is used, which makes us responsible for it (some laws call this the "controller" or the "business").

You can reach us about anything in this policy at Padilla_Z@foundworks.app.

2. What this policy covers

This policy explains how we collect, use, share, and protect personal information when you:

• visit foundworks.app (the "Site") or contact us;
• are a client, or someone added to a client's project, and use Foundworks Showroom, our app for reviewing and approving website drafts ("Showroom");
• own, work at, or are listed as a contact for a business that we research or reach out to;
• interact with Foundworks on social media, including our LinkedIn company page; or
• work with us as a team member or contractor and use our internal tools.

"Personal information" means information that identifies, relates to, or could reasonably be linked to a particular person or household. Information about a business on its own, such as its name, public phone number, or website, is usually not personal information. But many of the businesses we work with or contact are run by one person. For them, information about the business, such as its phone number, address, licenses, reviews, revenue estimates, and public court records, is also information about the owner, and we treat it as personal information too.

This policy does not cover:

• Other companies' websites and services, including social media platforms and sites we link to. Their own privacy policies apply.
• Websites we build for clients. Each client decides what its own website collects from its visitors and is responsible for its own privacy notice. If we handle information from a client's website on the client's behalf, we act only on the client's instructions, as its service provider.

3. Information we collect

3.1 Information you give us

• Contact form and messages. Your name, your phone number or email address, your business name, your message, and the page of the Site you sent it from. We receive the same kinds of information when you email, call, text, or message us.
• Project information. Details about your business (such as its industry, location, services, and goals), content and materials you send us, your feedback, and the details of our proposals and agreements with you.
• Showroom. Your name, email address, and business name. When you use Showroom, we also store what you do in it: comments and change requests, where on the draft you placed them, which preview size you were viewing the draft in (desktop, tablet, or phone), and a short snippet of the text you clicked on so we know what you meant. When you approve a draft, we record your approval, the full name you type as your signature, your email address, and the time. Showroom does not ask for your phone number and does not accept file uploads.
• Information about other people. If you ask us to add reviewers or approvers to your Showroom project, you give us their names and email addresses, and we add them. Please only name people who expect to hear from us about the project.
• Team members. If you work with us, your account details for our internal tools: username, name, work email address, a phone number if you choose text-message sign-in codes, your password (which we store only in a protected, hashed form, never as plain text), your permissions, and your acceptance of our confidentiality policy. We also store the messages you send to our internal AI assistants and send them to Anthropic so the assistant can answer (see section 6). Some assistants keep a separate history for each person, which that person can clear. Others, such as the Studio assistant and our internal team chats, keep one history that the team shares and that individual team members cannot clear. Messages team members send each other in our internal staff chat are stored on our cloud server (see section 8), are visible only to the people in each conversation, and are not sent to AI tools or other companies.

You don't have to give us personal information. The contact form needs your name, a phone number or email address, and a message so we can reply. Showroom needs your email address, because that is how you sign in. Team members need an account to use our internal tools. If you don't give us this information, we may not be able to reply to you or work with you.

3.2 Information collected automatically

• Site hosting. Like any website, the Site is delivered by a hosting provider (Vercel), which receives standard technical information with each request: your IP address, browser and device type (the "user agent"), the page requested, the referring page, and the time. Vercel keeps this in short-lived logs used for security and to keep the Site running.
• Optional website analytics. If you allow Analytics in Cookie preferences, Vercel Web Analytics counts visits to public Site pages. Its anonymous, aggregate reports show page views, estimated visitors, referring sites, approximate country, region or city, device type, operating system, browser, and time. Vercel uses a temporary identifier made from the request and discards it after 24 hours; it does not use analytics cookies or show us visitors' names, email addresses, or IP addresses. We remove query strings and URL fragments from the page address before sending it and exclude account, sign-in, and other sensitive pages. We send no form contents or custom events. Analytics stays off until you opt in and whenever your browser sends Global Privacy Control or Do Not Track. See Vercel's Web Analytics privacy documentation.
• Files from other providers. Some fonts, icons, and scripts on the Site load from Google Fonts, jsDelivr, and cdnjs (Cloudflare). When your browser requests those files, those providers receive your IP address and browser information.
• Your cookie choice. Your browser stores your cookie banner choice so we don't ask again (see section 9).
• Showroom. Sign-in cookies (see section 9) and when you last used Showroom. The Showroom service does not log your IP address or browser details itself, though our hosting provider receives them in the ordinary course of delivering the service, as described above. The Showroom app, and the website drafts you review in it, can load fonts from Google Fonts. When the Showroom app checks for updates, it requests a small file from showroom.foundworks.app. That request shows our hosting provider your IP address and standard technical details, such as the app's version, your computer's operating system version, and your language setting. It sends no account information, cookies, or device identifier.
• Team members. Records of sign-ins and account activity for our internal tools, including the time, the IP address, and a general label for the device or browser used (such as "Chrome" or "iPhone app").
• Email. When you reply to an email we sent, we receive your reply and its standard email details. Our outreach emails are plain text, with no tracking pixels and no tracked links.

3.3 Information from public sources and others

• Business research. To find local businesses that may benefit from our services, we review publicly available information: business websites, search engine results, map and business listings, online directories and review sites (such as Google, Yelp, and the Better Business Bureau), chambers of commerce, news stories, and public government records (such as business registrations, professional licenses, and court records involving the business). From these, we may record a business's name, type, address and map location, website, public business phone number and email address, hours, services, reviews, ratings, and short quotes from reviews, links to its social media pages as listed on its own website, advertising it runs, competitors, and our estimates of its size and yearly revenue. We may also record its business registration, license status and any license discipline, Better Business Bureau complaints, and lawsuits, liens, or judgments involving the business. When one person runs a business, some of these records may also be about that person. We take screenshots of the business's website and may save up to 24 photos that the business has published on its website or listings, such as its storefront, its work, or its team, so some photos show people. We also score how likely a business is to become a client.
• People in business roles. For owners, managers, and other key contacts, we may record their name, their role and how long they have held it, and professional information that is publicly available, such as from their business's website, news stories, interviews, and podcasts. This can include career history, education, certifications, awards, professional associations, community involvement, and interests they have shared publicly. From this, we may note things they have in common with our founders, such as a local connection, a school, or a shared interest, and how best to approach them, such as the tone and channel to use. We use this to decide whether to contact them and to make our outreach relevant to them and their business. Our emails may mention something we have in common.
• Social media platforms. Our automated research tools do not search or read LinkedIn, Facebook, Instagram, or X (see section 7). A member of our team may look at a business's public page on those platforms, as any visitor could. When you interact with our own pages or posts, for example by following, commenting, reacting, or messaging, the platform shows us what it makes available to page owners under its own terms, typically your public profile name, photo, and headline, and what you wrote.
• Referrals. Someone may give us your business contact details when recommending us to you or you to us.

What we don't look for. When we research the people behind a business, we instruct our research tools not to collect, and we do not seek: home addresses, personal phone numbers or personal email addresses, information about family members, health information, religious or political views, sexual orientation, citizenship or immigration status, racial or ethnic origin, union membership, disability (including "owned by" labels on business listings, such as "Latino-owned" or "disabled-owned"), personal finances or debts, the criminal history of individuals, private social media accounts, or information from data brokers and people-search sites. We use contact details published for business use. Our tools are told not to guess email addresses and to record where they found each one, and we spot-check them. If we find we have captured information we don't look for, we delete it.

3.4 What we don't collect

• We do not collect payment card or bank account details through the Site, Showroom, or our other tools. We do not process payments through them.
• We do not collect precise location, biometric information, or health information.
• We do not knowingly collect information from children (see section 16).

4. How we use information

We use personal information for the purposes below. If the data protection laws of the European Economic Area, the United Kingdom, or Switzerland apply to our use of your information, the right-hand column shows the legal basis we rely on.

We do not use personal information for targeted advertising. We do not make decisions about people that produce legal or similarly significant effects based solely on automated processing. If we want to use personal information for a purpose that is materially different from those described here, we will update this policy and, where the law requires it, ask for your consent first.

5. How we contact businesses

Part of how we find clients is by contacting local businesses that look like they could use a new website, branding, or help with local search. Here is how that works.

• Who we contact. Businesses in the United States, mainly in Southern California, at contact details they publish for business purposes. We do not knowingly send marketing email to businesses outside the United States, and we do not contact consumers at home.
• How we contact you. Mostly by email, from a Foundworks team member's mailbox and under their real name. We may also call a business at its published business phone number. Every email identifies Foundworks, includes our postal address and a link to this policy, and tells you how to stop hearing from us. We keep it short: our system is set up to send a business one first email and no more than two follow-ups if no one replies, and none after you ask us to stop. If you write back, we will reply.
• How we prepare. We use AI tools to help find businesses, review their public online presence (such as their website and reviews), and draft emails (see section 6).
• Our own posts and articles. We may share general patterns from our research, such as how many of the local websites we checked had no click-to-call button. We do not name a business we researched, or show its website, logo, photos, or people, in our posts, videos, or articles unless the business agrees in writing.
• How to stop. Reply "no thanks," "unsubscribe," or anything similar, or email Padilla_Z@foundworks.app. Our system picks up most of these replies automatically, and we read our replies ourselves to catch any it misses. We honor every request within 10 business days, as the U.S. CAN-SPAM Act requires, and usually much sooner. We add your email address, or your whole business domain if you ask, to a do-not-contact list, and our system checks that list before it drafts an email and again before it sends one. We will not send you marketing email again. If you would also like us not to call you, tell us and we will note that too. Stopping is free and takes nothing more than a reply or an email. We will still reply if you contact us first.
• Deleting our research about you. Email us and we will delete the research and outreach records we hold about you or your business from our tools, keeping only the do-not-contact entry and a record of your request. Copies in our own backups and our hosting provider's backups are gone within about two weeks. We also delete it from the older copies of our files described in section 8 and section 10. Copies held by our email and AI providers are deleted on those providers' own schedules.
• Reading replies. To find replies, our system checks the sender of each recent message in the mailbox we send from. It keeps only messages from addresses we have emailed, from other addresses at the same email domain (unless it is a common free email service such as Gmail or Yahoo), and bounce notices about our emails. For each one, it stores the sender, subject, and new text. It does not store other mail.

6. AI and automated tools

• What we use. Our software uses Anthropic's Claude models through Anthropic's commercial API. They help us research businesses (including through web searches that Anthropic runs for us), draft emails, social posts, and proposals, design website drafts, summarize client feedback, sort replies to our emails, and answer questions for our team.
• What we send. The information a task works with. Depending on the task, that may include a business's public information and our research notes, including the names, roles, and public professional information of owners and staff (see section 3.3), business contact details, screenshots of a business's website, client project briefs, Showroom comments and approvals with the names of the people who made them, replies to our emails, and team members' messages to our internal assistants. We never send member information we receive through a social platform's API.
• How it is protected. For our software's use of the API, Anthropic processes this information as our service provider under its commercial terms. Under those terms, Anthropic does not use the content we send through its API to train its models, and it keeps that content only for the limited periods its terms describe.
• Claude app and Claude Code. We also use Anthropic's Claude app and Claude Code, on an individual Claude plan, to help build and maintain our software and with day-to-day work. While doing that, they can read records in our tools, our email and text messages, and our calendar and shared files, including inquiries, replies to our emails, and privacy requests. That plan is covered by Anthropic's consumer terms and privacy policy, not its commercial terms. Under those terms, and depending on the account's privacy settings, Anthropic may use these chats and coding sessions to improve its models and keep them for up to five years; with that setting turned off, it generally deletes them within 30 days, except material its safety systems flag.
• Who is responsible. AI drafts and suggests, and Foundworks is responsible for everything we send and publish. A person at Foundworks approves every social media post before it is published. A team member normally reviews each email before it goes out; if we switch on automatic approval, emails that pass our automated checks can go out without a person reading them first. We do not use AI to make decisions about people that produce legal or similarly significant effects. AI output can be wrong. If something we said about you or your business is inaccurate, tell us and we will correct our records.

7. Social media and connected accounts, including LinkedIn

Our own accounts. We may connect Foundworks's own accounts on LinkedIn (including our company page), Facebook, Instagram, and X to our internal software, using each platform's official programming interface (API). This lets us publish posts that a Foundworks team member has reviewed and approved and, where the platform allows it, manage our own page. Our software may draft posts with AI help and publish approved posts at a scheduled time, but nothing is posted to these platforms without a person's approval. We also post by hand to our Google Business Profile and may post short videos to TikTok, Instagram Reels, and YouTube Shorts.

What we receive from LinkedIn. When an authorized Foundworks administrator connects our LinkedIn page, LinkedIn gives us an access key tied to that administrator's account and limited to the permissions they approve. We use it only to:

• publish our approved posts to our company page or our founders' own profiles;
• check that the connection works, which may show us the connected administrator's name;
• record the identifiers and links of the posts we publish; and
• if we turn on features that show comments, mentions, or statistics for our own page and posts, reply to people and understand which of our posts are useful to our audience.

What we receive from Facebook, Instagram, and X. When an authorized Foundworks administrator connects our Facebook Page, our Instagram professional account, or our X account, the platform gives us an access key limited to the permissions they approve. We use it only to publish our approved posts (on Instagram, with an image we choose), to check that the connection works, which shows us our Page name, our Instagram username, or our X handle, and to record the ID and, where the platform gives one, the link of each post we publish. We do not read followers, comments, messages, or statistics through these connections today. If we start, we will update this policy first, and the limits below will apply.

Limits we follow.

• If we turn on features that show comments, mentions, or statistics for our own page and posts, we will see the name, headline, and profile photo of members who comment on or mention us, and what they wrote. We do not save members' profile details; our tools hold them for no more than 24 hours. We delete comments and mentions from our tools within 48 hours, and we never write them to our database or its backups. We keep page statistics, which are combined numbers such as follower counts and reactions per post, for up to one year. We do not use platform APIs to collect anything else about other members, such as lists of our followers or of people who view our posts.
• Our research tools are automated, and we have set them so they cannot search or read LinkedIn, Facebook, Instagram, or X, or save images from those sites. When a person on our team researches a business, they may look at its public page on a platform, as anyone could.
• We do not sell, rent, or license information about people that we receive through a platform's API, and we do not use it for advertising, sales, or recruiting. It never goes into the business research and outreach described in section 3.3 and section 5: we do not use it to find prospects, add anyone to our research or contact lists, or email anyone, and we do not combine it with other information about a person.
• We show member information we receive from LinkedIn, such as comments on our posts and the names of the people who wrote them, only to our own team, inside our own tools. We do not send it to AI tools or to any other company, unless the law requires it. We share member information we receive from Facebook, Instagram, or X only with service providers that have agreed in writing to use it only for us, or where the law requires it, and we do not send it to AI tools. Our access keys and the records of our own posts are kept on our cloud server, as described below.
• Access keys are kept in a protected file on our cloud server, which Hetzner hosts for us in the United States, and in the backups of that server. We delete an account's access key when we disconnect the account, and our software deletes it automatically when a platform tells us the key has been revoked or has expired. We delete any platform information we hold about you within 24 hours of your request.

Your choices, and how to delete platform data. The administrator who connected an account can cut off our access at any time:

• LinkedIn: click Me, then Settings & Privacy > Data privacy > Other applications > Permitted services, and click Remove next to our app. You can also go straight to linkedin.com/psettings/permitted-services.
• Facebook and Instagram: click your profile picture, then Settings & privacy > Settings, scroll to Your activity, click Business integrations, and click Remove next to our app.
• X: go to Settings and privacy > Security and account access > Apps and sessions > Connected apps, choose our app, and revoke its access.

Removing our access stops future access, but it does not delete what we already have. To have that deleted, email Padilla_Z@foundworks.app with "Delete platform data" in the subject line and tell us the platform and account. Anyone can ask, whether or not they connected an account, and we will delete what we hold within 24 hours and confirm by email.

The platforms' own practices. When you visit our pages on LinkedIn, Facebook, Instagram, or X, the platform collects information under its own privacy policy, which we do not control. For some features, such as page statistics, a platform and the page owner may share responsibility under data protection law; in those cases the platform's terms apply alongside this policy.

8. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as described here, except that member information we receive through a social platform's API is disclosed only as section 7 describes.

Service providers. Companies that process information on our behalf under written terms that limit what they can do with it:

• Vercel: hosting for the Site and the Showroom service, and file storage, including Showroom project data. Vercel also provides the optional Site analytics described in section 3.2.
• Anthropic: AI processing and AI-run web searches through its commercial API (see section 6).
• Google Workspace: our business email on foundworks.app, used to send and receive email, including Showroom sign-in codes and notices, outreach emails, and replies to them. Google stores these emails for us.
• Supabase: a database we may use to store messages sent through the Site's contact form.
• Twilio: sends text-message sign-in codes to our team members who choose that option.

Other companies that receive information. These companies receive some information when we, or your browser, use their services. They handle it under their own terms and privacy policies, not as our service providers:

• Google Fonts: provides typefaces for the Site, our apps, and website drafts, and receives your IP address and browser information when they load.
• Hetzner (Hetzner Online GmbH): hosts the cloud server, located in Hillsboro, Oregon, that runs our internal tools and stores their data, including our business research, client project files, team accounts, staff chat, and service access keys, and keeps daily backups of that server, under its own terms.
• Apple: iCloud Drive stores an older copy of our internal tools' files, made before we moved them to our cloud server, including business research, client project files, team account records, and backups. That copy is no longer updated.
• Anthropic: the Claude app and Claude Code on an individual plan, which can read records in our tools, our email and text messages, and our calendar and shared files while we work (see section 6).
• Cloudflare (cdnjs) and jsDelivr: deliver code and icons used by the Site, and receive your IP address and browser information when they load.
• OpenStreetMap Foundation (Nominatim): receives business street addresses so we can place them on a map in our research notes.

Social media platforms and the public. When we publish a post on LinkedIn, Facebook, Instagram, X, TikTok, YouTube, or our Google Business Profile, the platform receives it and handles it under its own terms, and anyone can see it. A post includes a client's name, logo, testimonial, or project only with that client's permission (see section 17).

People on your project. In a Showroom project, the people on that project (the client who owns it and the approvers and reviewers we add) and our team can see the drafts, comments with the names of the people who wrote them, and approvals, including the approver's name, email address, typed signature, and the time.

Professional advisers. Lawyers, accountants, and insurers, under duties of confidentiality, when we need their advice.

Legal and safety reasons. When we believe in good faith that disclosure is required by law, subpoena, or court order, or is needed to protect the rights, property, or safety of Foundworks, our clients, or others, or to investigate fraud or security problems.

Business changes. If Foundworks is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. The recipient must honor this policy or give you notice and any choices the law requires.

With your consent, or at your direction.

9. Cookies and similar technologies

• Site. The Site sets no cookies of its own. It remembers your cookie banner choice in your browser's local storage. Optional Vercel Web Analytics, described in section 3.2, uses no analytics cookies and runs only after you allow Analytics. We run no advertising or session-recording tools. You can withdraw or change your choice at any time using "Cookie preferences" at the bottom of every page; withdrawing stops further analytics collection in that browser.
• Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, the Site treats it as a request to opt out. It switches off every non-essential category for that browser, even if you chose otherwise before, and says that the signal is being honored in the cookie banner and in Cookie preferences. The signal applies to the browser that sends it. We treat a GPC signal as a valid request to opt out of the sale and sharing of your personal information. Because we do not sell or share personal information, online or offline, there is nothing more for it to switch off.
• Files from other providers. As explained in section 3.2, Google Fonts, jsDelivr, and cdnjs receive your IP address and browser information when your browser loads files from them. These providers serve the same files to many other websites, so they may be able to see the same browser visiting different sites over time. They handle that information under their own privacy policies. Apart from these providers and Vercel, which also provides the optional Site analytics described above, no other company collects information about your activity on the Site.
• Showroom. Showroom uses two strictly necessary cookies: fwshow, which keeps you signed in for up to 30 days, and fwshow_code, which holds your sign-in step while you enter your code. Both are protected so that scripts on the page cannot read them. The Showroom app also remembers small display preferences on your device, such as whether to play its intro.
• Team tools. Our internal tools use one strictly necessary cookie, fwsuite, which keeps team members signed in for up to 30 days.

Strictly necessary cookies and storage cannot be switched off without breaking sign-in or your saved choices.

10. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete it or de-identify it. The periods below are the longest we keep each kind of record, except in the cases described below the table. At least every six months, we review our records and delete anything that has passed its period or will pass it before our next review, including the files, photos, and screenshots linked to it. Shorter limits, such as those for platform information in section 7, do not wait for this review.

We may keep information longer when the law requires it, to resolve disputes, or to establish, exercise, or defend legal claims.

11. How we protect information

We use administrative, technical, and physical safeguards suited to a small studio and the information we hold, including:

• encrypted (HTTPS) connections for the Site and the Showroom service, with browsers instructed to use encryption every time;
• internal tools that run on our own cloud server, hosted by Hetzner in the United States, reachable only over encrypted (HTTPS) connections, behind a firewall, administered only with key-based access, and used only by authorized team members with individual accounts;
• passwords stored only in a strongly hashed form, limits on repeated sign-in attempts, and audit records of sign-ins and account and permission changes;
• Showroom sign-in without passwords, using one-time codes that expire after 10 minutes, with limits on attempts, and signed sign-in cookies that scripts cannot read;
• service passwords and access keys kept in protected files on our cloud server or in our hosting providers' protected settings, and never placed in website code; and
• access limited to the people who need it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the authorities as the law requires.

12. Your rights and choices

For everyone. Wherever you live, you can ask us to:

• tell you whether we have personal information about you, and give you a copy of it;
• correct information that is inaccurate;
• delete it;
• stop contacting you; and
• withdraw any consent you have given.

We will not treat you differently for using these rights. Some laws give you additional rights, described in the sections that follow.

How to make a request. Email Padilla_Z@foundworks.app with "Privacy request" in the subject line. Tell us what you are asking for and the email address or business your request is about.

• Verification. To protect you, we confirm your identity by matching the details you give us with the information we hold. If your request is about an email address, we will usually email that address and ask you to confirm. For a copy of the specific information we hold, we may ask you to match at least three details and sign a statement, under penalty of perjury, that you are the person the request is about. We use this information only to verify your request. If we cannot verify a request, we will tell you why.
• Authorized agents. Someone else may make a request for you if you give them signed permission. We may ask you to confirm your identity with us directly, or to confirm that you gave them permission, but we will not ask you to make the request again yourself. If your agent holds a power of attorney under California Probate Code sections 4121 to 4130, we will accept that instead.
• Timing. We will confirm that we received your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you why, and we may take up to 45 more days where the law allows. If a shorter deadline applies to us under a law that covers your request, we will meet it.
• Cost. Requests are free, unless a request is clearly unfounded or excessive.
• Limits. If we cannot fully honor a request, for example because the law requires us to keep certain records, we will explain why.

13. California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), gives you the right to:

• know the categories and specific pieces of personal information we collect about you, where it comes from, why we collect it, and whom we disclose it to;
• delete personal information we collected from you or about you, including information from public sources;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information (we do neither);
• limit the use of sensitive personal information (we use it only for purposes the law permits, described below); and
• not be discriminated or retaliated against for using these rights, including as a team member, contractor, or job applicant.

To use these rights, follow the steps in section 12.

Notice at collection, and the personal information we collect. The list below is also our notice at collection. It shows the categories of personal information, as the CCPA defines them, that we collected in the last 12 months or collect through the services this policy describes. For each category it shows where the information comes from, why we use it, whom we disclose it to, and how long we keep it. We do not sell or share any of it.

We may also disclose any of these categories to professional advisers, to authorities when the law requires it, and to a buyer or successor in a business change (see section 8). Member information we receive through a social platform's API, such as a commenter's profile name or photo, is the exception: we disclose it only as section 7 describes.

• No sale or sharing. In the last 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Because we do neither, we do not offer a "Do Not Sell or Share My Personal Information" link. We still honor Global Privacy Control signals.
• Sensitive personal information. We use sign-in details only to authenticate people and keep accounts secure, which the CCPA permits without offering a right to limit. We do not use sensitive personal information to infer characteristics about anyone.
• Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes (Cal. Civ. Code § 1798.83).
• Do Not Track. How we respond to browser Do Not Track signals is described in section 9.

As a small studio, we may not meet the thresholds that make the CCPA apply to a business. We follow these practices and honor these rights anyway.

14. Rights in other U.S. states

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with consumer privacy laws may have the right to:

• confirm whether we process their personal information and get access to it;
• correct inaccuracies;
• delete their personal information;
• get a copy in a portable format;
• get a list of the third parties we have disclosed their personal information to; and
• opt out of targeted advertising, the sale of personal information, and profiling that leads to decisions with legal or similarly significant effects.

We do not engage in targeted advertising, sell personal information, or carry out that kind of profiling. To make a request, follow the steps in section 12.

Appeals. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. We will respond in writing within 45 days and explain our reasons. If we deny your appeal, we will tell you how to contact your state's attorney general to file a complaint.

Nevada. We do not sell covered information as Nevada law defines it. You may still send us a request.

15. Visitors outside the United States

Foundworks is based in the United States and serves businesses here. If the data protection laws of the European Economic Area, the United Kingdom, or Switzerland apply to our processing of your information, you have the right to access, correct, and delete your personal information; to restrict how we use it; to data portability; and to withdraw consent at any time without affecting earlier processing. You also have the right to complain to your local data protection authority, though we would appreciate the chance to address your concern first.

Your right to object. If those laws apply, you can object at any time to our use of your information based on our legitimate interests, including our business research. We will stop unless we have compelling legitimate grounds that override your interests, or we need the information for legal claims. You can also object at any time to our use of your information for direct marketing, including the research and scoring we do to decide whether to contact a business. If you do, we will stop, with no exceptions. To object, reply to any email from us or write to Padilla_Z@foundworks.app.

We process and store information in the United States, whose data protection laws may differ from those where you live. When you send us information from outside the United States, it comes directly to us here. The companies listed in section 8 also process it, mostly in the United States. Where a provider's terms include standard contractual clauses, or the provider is certified under the EU-U.S. Data Privacy Framework (including its UK Extension) or the Swiss-U.S. Data Privacy Framework, we rely on those safeguards.

If you live elsewhere, you can use the rights in section 12, and we will also honor any additional rights that a privacy law applying to us gives you.

16. Children

The Site, Showroom, and our services are meant for businesses and adults. They are not directed to children under 13, or under 16 where a higher age applies, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

17. Testimonials and portfolio work

We feature a client's name, logo, testimonial, or project only with that client's permission. You can ask us to remove it at any time. We will remove it from the Site and from materials we create afterward, though we cannot recall copies already shared.

18. Changes to this policy

We may update this policy as our services or the law change. When we do, we will change the "Last updated" date at the top. If we make a material change, we will post a notice on the Site and, if you are a current client or have a Showroom account, tell you by email or in the app before the change takes effect. If you would like a previous version of this policy, ask us.

19. Contact us

Foundworks (Zach Padilla and Brendan Lee)
California, United States
Email: Padilla_Z@foundworks.app

We usually reply within two business days. This policy is available in other formats on request, and you can print or save this page at any time.