Privacy notice
Last updated 26 October 2026
What we collect when you use Product Foundry, why, how long we keep it, who else handles it, and your rights.
Who is responsible
DefoAI UG (haftungsbeschränkt) in Berlin runs Product Foundry and is responsible for your personal data. Our address and register details are in the Imprint.
For anything about your data, write to privacy@product-foundry.app
In short
- We collect only what we need to run the beta: your details when you ask to join or write to us, your account, and what you put in your workspace.
- Your data is stored in the EU.
- No analytics, no advertising, no tracking cookies.
- You can download your data or delete your account yourself, at any time, from the account menu in the app.
What we collect, why, and on what legal basis
When you ask to join
Your name and email address and, if you give them, your company and a note. We use them to decide on your request and to email you an invitation. Legal basis: steps you ask for before a contract (Art. 6(1)(b) GDPR).
When you email us
Your email address, your name and what you write. We use them only to answer you. Legal basis: steps you ask for before a contract, when you ask for a consultation (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR).
Your account
Your name, email address and password (stored only as a hash, never readable), when you joined, and your language. We need them to give you an account and keep it yours. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
Signing in and keeping accounts safe
Cookies that keep you signed in and recognise a browser you’ve used before, so we can email you when someone signs in from a new one. Your IP address for a day, to stop repeated attempts. And Cloudflare Turnstile, a security check on the request form and the join, sign-in and password pages, which sends technical details about your browser to Cloudflare. Legal basis: our legitimate interest in keeping accounts and the service safe (Art. 6(1)(f) GDPR).
Your workspace
Everything you add: teams, goals, interviews and their notes, insights, the roadmap, data sets and uploaded files. It belongs to your organisation in Product Foundry: everyone in it can read it, and their role decides who can change it. Work you keep private only you can see. We look at it only if you ask us to or the law requires it. If you leave your organisation or delete your account, the organisation keeps its work and your private work is deleted; if you're the only one in it, all of it is deleted. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
Invitations to your organisation
When an Admin of an organisation invites someone, we store the email address they enter, with the role and teams they choose, and send that person one email with the invitation. We need it to let them join. An invitation that isn't used is deleted once it's cancelled or has run out. Legal basis: our legitimate interest, and the organisation's, in letting a team work together (Art. 6(1)(f) GDPR).
Data about other people
Interview notes and files can hold personal data about the people you interviewed. For that data you decide what is collected and why, and we handle it only on your behalf, as set out in the processing terms of our beta terms (Art. 28 GDPR). Please don’t add health, religious, political or other special categories of data during the beta.
The discovery agent
When you ask the agent a question, your question and the parts of your workspace it reads go to Eden AI and on to the company whose AI model writes the answer; the Ask the agent page names it. They use them only to write the answer. We keep your questions and the answers with your workspace. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
The assistant
When you write to the assistant in Discovery, your message, the name of the page you're on and the parts of your workspace it reads go to Eden AI and on to the same AI model as the agent's. They use them only to write the reply. The assistant changes your workspace only when you approve a change. We keep your chats with your workspace until you delete them. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
When the agent or the assistant turns a request down
When the agent or the assistant turns down a request because it's outside your discovery work, harmful, or tries to get it to repeat its instructions, we note that it happened, where and when, never your words. After five in an hour, asking pauses for up to an hour, and we see how many each account had in the last seven days. Legal basis: our legitimate interest in keeping the AI features for what they're for and their costs in check (Art. 6(1)(f) GDPR).
Feedback
What you write, the page you were on, and your browser and operating system, so we can understand and fix things. Legal basis: our legitimate interest in improving Product Foundry (Art. 6(1)(f) GDPR).
Emails
We email you only about your account and your invitation: confirming your email address, resetting or changing your password, a sign-in from a new browser, and your invitation. No newsletters. Legal basis: our contract with you, and for security emails our legitimate interest in keeping your account safe (Art. 6(1)(b) and (f) GDPR).
Server logs
Our servers log attempts to sign in, join and reset a password, and every error, with your account’s ID but never your email address, password or what you wrote. Legal basis: our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).
How long we keep it
We delete data automatically when its time is up. These are the periods our systems enforce:
| Data | Kept for |
|---|---|
| A request to join that we haven’t answered | 90 days after you last asked |
| A request to join, once we’ve invited you or said no | 30 days |
| An account whose email address isn’t confirmed yet | 24 hours |
| Your account and your private work, with your files, questions to the agent, chats with the assistant and feedback | Until you delete your account, or the beta ends: we’ll tell you at least 30 days before it does |
| Your organisation's work: teams, goals, interviews, insights, the roadmap, data sets and their files | Until its last member deletes their account, or the beta ends |
| An invitation to an organisation that wasn't used: the email address, role and teams | 7 days |
| A sign-in session | 7 days, renewed while you use it, and at most 30 days |
| A browser you’ve signed in from | 180 days after it was last used |
| A link to reset your password | 30 minutes, or until it’s used |
| Your IP address, to stop repeated attempts | One day |
| A note that the agent or the assistant turned down a request | 30 days |
| Feedback we’ve dealt with | 365 days after we dealt with it |
| An email you send us | One year after our last reply |
| The security and activity log (account IDs, never email addresses) | 400 days |
| Server logs | Seven days |
| Database backups | 30 days |
When you delete your account, everything in it goes at once, and it’s gone from our backups within 30 days.
Who else handles your data
We never sell your data or use it for advertising, and we don’t use your workspace to train AI models. Three companies process it for us, under data processing agreements:
- Cloudflare, Inc. hosts the website, the app and the database, stores files and backups, sends our emails and runs the Turnstile check. Your data is stored in its EU region. Cloudflare is based in the US; transfers there are covered by the EU–US Data Privacy Framework and the EU’s standard contractual clauses.
- Eden AI (France) passes the agent’s questions and your messages to the assistant, and the parts of your workspace they read, to the provider of the AI model, which can be outside the EU, for example in the US. This happens only when you use the agent or the assistant. Transfers outside the EU are covered by the EU’s standard contractual clauses or the EU–US Data Privacy Framework.
- Proton AG (Switzerland) hosts the inbox that emails to hello@product-foundry.app and privacy@product-foundry.app reach. Switzerland has an EU adequacy decision (Art. 45 GDPR).
Cookies
We use three cookies. All of them are needed for the site to work, so we don’t ask for consent (§ 25(2) TDDDG):
- __Host-pf_session keeps you signed in, for at most 30 days.
- __Host-pf_device recognises a browser you’ve signed in from, for up to 400 days.
- pf_lang remembers the language you chose, for a year.
Your rights
You can ask us for a copy of your data, to correct or delete it, to restrict how we use it or to object to it, and to get it in a portable format (Articles 15 to 21 GDPR).
You can do the most common ones yourself in the app’s account menu: Export my data gives you a copy of everything as a file, and Delete my account deletes it all.
For anything else, write to us and we’ll answer within a month: privacy@product-foundry.app
You can also complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
Changes to this notice
When we change this notice, we change the date at the top. If a change affects data you’ve already given us, we’ll email you first.