Legal
Privacy
Last updated 22 September 2026
This document is a working draft published for transparency about how the product is built. It has not completed legal review and is not a contract. The executed agreement for your account is the one you sign.
What this covers
This notice describes how Foundariq handles data in the course of running an autonomous software portfolio. It covers the marketing website you are reading and the product at https://app.foundariq.com.
The marketing website sets no analytics or advertising cookies, runs no third-party tags, holds no account data and has no connection to any repository. It is static content served from a CDN, and it keeps serving when every other host is down.
What the product processes
Repository content from the GitHub organisations you connect, under the scopes the installation granted: source, structure, history and pull request state. This is what makes an existing portfolio legible before anything is proposed.
The Blueprints, capability definitions, policies and approval records your team authors. These are the instructions the system runs under, so they are kept for the life of the account.
Account and workspace data for the people who use the product: name, work email, role, and the audit record of what each person proposed, approved, refused or released.
Prompts, plans and model responses generated while work is executed, retained so that any shipped change can be traced back to the decision that authorised it.
What it does not do
It does not train shared or public models on your code. Your repositories are not used to improve a model that another customer benefits from.
It does not read repositories you have not connected, and it cannot open a pull request against one.
It does not share data between customer accounts. A capability defined in one account is visible only in that account.
Credentials
GitHub installation credentials and model provider keys are encrypted at rest and held only by the services that need them. They are never exposed to a browser, never written to logs, and are not present in this marketing application at all.
Retention and deletion
Retention is a plan property and is set per account. Audit records of autonomous actions are kept for the life of the account because they are the record of what changed, who allowed it and why.
Disconnecting an organisation stops all reading and all proposals immediately. Deleting an account removes the data held for it within the period stated in your agreement, excluding records we are required to keep.
Contact
Write to [email protected] with any question about this notice or a request relating to your data.
Stop managing prompts. Start managing software strategy.
Connect your repositories. Let Foundariq understand what you have already built. Then tell it what your portfolio should build next.
Read-only to start · Your code stays in your GitHub · [email protected]