[ LEGAL ]
Privacy Policy
Foundy Stack collects personal information through the forms and the chat on this site. This page explains exactly what we take, why, who else sees it, and how to make us delete it.
Last updated 3 September 2026
Foundy Stack is operated by Samik Das and Ali Karrar, based in Canada. For anything on this page, or to exercise any right described below, email foundystack@gmail.com.
01What we collect
Information you give us. The qualifier form on our home page and our chat assistant ask for, and store, the following:
- Your name and the name of your company
- Your email address, and your phone number if you give one
- Your website or profile URL
- Answers about your business: what stage you are at, what you have built so far, who your ideal customer is, your biggest pain point, your goal, your budget range, your preferred next step, and how you heard about us
- Anything else you type into the free-text fields or into the chat
Conversations with our chat assistant. Messages you send are processed by a third-party AI provider in order to generate a reply, and a summary may be stored with your lead record.
Technical information. Our host records standard server logs, including IP address, browser type and the pages you requested. This site also stores small amounts of data in your browser (for example, the bundle you build on the Build A Business page) so your selections survive a refresh. That stays on your device.
We do not ask for, and do not want, payment card numbers, government identifiers, or any special category data such as health or biometric information.
02Why we collect it
We use what you give us to:
- Reply to you, and prepare for a call if you book one
- Work out whether we are a sensible fit before we take your money
- Scope and price a proposal for the work you are asking about
- Deliver and support the work if you become a client
- Keep our own records of who we have spoken to and what was said
Our lawful basis is your consent when you submit a form or start a chat, and our legitimate interest in responding to a business enquiry you initiated. If you become a client, we also process what is necessary to perform our contract with you.
03Who else processes it
We are a two-person team and we use third-party services to run the business. Each one receives only what it needs. We do not sell your personal information, and we do not share it for advertising.
| Service | What it handles |
|---|---|
| Vercel | Hosting and server logs for this website |
| Resend | Sends us the notification email containing your enquiry |
| HubSpot | Our CRM record of you as a contact and deal |
| Anthropic, Google, OpenRouter | Generate the chat assistant’s replies from your messages |
| Cal.com | Booking, if you schedule a call |
| Stripe | Payments, if you become a paying client |
| Railway | Database hosting for our internal pipeline |
These providers operate in various countries, including the United States, so your information may be transferred and stored outside Canada.
04How long we keep it
If you enquire and we do not end up working together, we keep your enquiry for up to 24 months and then delete it. If you become a client, we keep records for as long as we work together and for 7 years afterwards, which is what Canadian business and tax record-keeping expects.
You can ask us to delete it sooner. See the next section.
05Your rights
You can ask us at any time to:
- Tell you what we hold about you, and give you a copy
- Correct anything that is wrong
- Delete what we hold, unless we are legally required to keep it
- Stop emailing you
- Withdraw consent you previously gave
Email foundystack@gmail.com and we will action it within 30 days. You do not need to give a reason, and we will not make it difficult.
If you are unhappy with how we handled your information, you can complain to the Office of the Privacy Commissioner of Canada. If you are in the UK or EU, you can complain to your local supervisory authority.
06Security, and what we cannot promise
We keep access to your information limited to the two of us and the services listed above. We use reputable providers and we do not copy your data anywhere it does not need to be. No method of transmission or storage is completely secure, and we will not claim otherwise.
If a breach affects your personal information in a way that creates a real risk of significant harm, we will tell you and the relevant regulator as required.
07Children
This is a business-to-business service. It is not directed at children, and we do not knowingly collect information from anyone under 16.
08Changes
If we change this policy we will update the date at the top of this page. If the change materially affects how we handle information you already gave us, we will email you.