Legal

Privacy Policy

Effective date: 2026-10-03
Last updated: 2026-10-03
Document version: 2026-10-03.1
Product: Precision Foundry

1. Introduction

This Privacy Policy explains how Tools by Design Development Group, LLC ("we," "us," or "our") handles information in connection with Precision Foundry (the "Service"). It reflects practices implemented in the current application and related providers identified below.

Effective date: 2026-10-03.

Related documents: Terms of Service (/terms), AI Data Disclosure (/ai-data), Cancellation Policy (/cancellation), and Cookie Policy (/cookies).

2. Information users provide

We collect information you and your organization's users submit to the Service, including:

Account information such as name, email address, and password (stored as a one-way hash).
Organization workspace information such as company name, slug, mission statement, strategic priorities, and related company settings.
Membership details such as role, team type, permission level, job title, and invitation status.
Project and delivery content such as problem/solution narratives, stories, values, estimates, requirements, stakeholders, discovery answers, delivery plans, issues, data-flow diagrams, and similar work product.
Uploaded attachments for delivery user stories (file name, content type, size, and file bytes stored in private object storage).
Contact-form submissions (name, email, phone, and message), which are emailed to our support inbox and retained in the application database for operational review by application owners.
Waitlist signups (email, optional name, and optional attribution such as source or campaign), which are retained so we can notify you about private alpha access and are emailed as a transactional confirmation and an internal notification.
Support and administrative communications you send to us.

3. Billing information

Subscription and payment processing are handled by Stripe. We store Stripe customer and subscription identifiers, plan and seat information, subscription status, trial and period dates, cancellation-at-period-end status synced from Stripe, and AI usage/overage billing records needed to operate the Service.

Payment card details are collected and processed by Stripe. Precision Foundry does not store full payment card numbers in its application database.

4. AI prompts, context, and generated output

When you use an AI-assisted feature, relevant project information, instructions, and existing work content may be sent to OpenAI to generate a response. Generated drafts may be saved back into Precision Foundry as ordinary workspace content (for example, stories, discovery questions, analyses, or delivery artifacts).

Separately, Precision Foundry stores an AI execution ledger with operation labels, model names, token counts, and cost metadata used for budgeting and billing. That ledger is designed not to store full prompts or model outputs.

See the AI Data Disclosure for a fuller description of provider settings and human-review expectations.

5. Device, browser, IP, cookie, and log information

Like most web applications, the Service and its hosting providers may process technical information such as IP address, browser type, device characteristics, timestamps, and request metadata in server or platform logs. On public marketing pages, after you accept optional analytics cookies, Google Analytics may also process page URLs, approximate location, and device or browser metadata.

Separately from optional analytics, Precision Foundry maintains first-party server and application logs for security and operational purposes. These logs help us troubleshoot errors, maintain service availability, prevent fraud and abuse, identify automated scanning or attempted attacks, investigate security incidents, and protect our users, systems, and legal rights.

For visits to public marketing pages, these records may include the visitor's IP address, user agent, timestamp, page path, and approximate geographic information supplied by our hosting provider. Approximate geographic information may include city, region, country, latitude, and longitude. This information is inferred from the visitor's IP address or network connection. It is not collected from GPS, device-location services, or browser location permissions, and we do not attempt to increase its precision or use it to determine a person's exact physical location.

For sign-in attempts, these records may additionally include the submitted email identifier and whether the attempt succeeded or failed. We use this information to detect and investigate activities such as credential attacks, repeated unauthorized access attempts, automated abuse, and other threats to the Service.

This logging occurs on our servers and does not use tracking cookies, localStorage, or sessionStorage. It operates independently of optional analytics consent and is not used on signed-in application pages. We do not use these records for advertising, cross-site tracking, behavioral profiling, or determining advertising eligibility, and we do not sell them or share them for targeted advertising.

Access is limited to authorized personnel and service providers that require access to operate, secure, or support the Service. IP addresses are encrypted at rest in the application database and are decrypted only when reasonably necessary for authorized operational or security review. We apply reasonable administrative, technical, and organizational safeguards to these records.

When you accept legal terms at signup or before checkout, we may record your IP address with the consent record for security, audit, and dispute-resolution purposes. Those consent records are stored in the application database, not as browser cookies.

For a full inventory of cookies and browser storage, see section 6 (Cookies and Similar Technologies) and the Cookie Policy (/cookies).

6. Cookies and Similar Technologies

Precision Foundry uses strictly necessary cookies and limited functional browser storage to operate and secure the Service. Essential uses include Auth.js authentication and session security cookies, the active-organization cookie (pf_active_company_id), and Stripe-hosted billing cookies when you open Checkout or the customer portal.

We also use localStorage for theme preference (key: theme; values light, dark, or system) and may use short-lived sessionStorage for authenticated UI workflow state (for example, remembering whether issue-discovery generation used OpenAI or a local heuristic across a page reload). These are not advertising identifiers.

Precision Foundry does not currently use advertising cookies or cookies for cross-site behavioral tracking. On public marketing pages, the Google tag may be present with analytics storage denied until you accept optional analytics cookies. That tag is not loaded on signed-in application pages. Strictly necessary cookies are not blocked behind a consent banner.

Most browsers allow you to view, delete, or block cookies and stored website data. Blocking strictly necessary cookies may prevent sign-in, organization selection, secure sessions, or billing features. Browser privacy controls and Do Not Track (DNT) signals vary by browser; Precision Foundry does not currently change application behavior solely in response to DNT signals beyond the practices described in this Policy and the Cookie Policy. This Policy does not claim support for Global Privacy Control unless separately implemented and tested.

Details, durations, and the full inventory table are in the Cookie Policy (/cookies). Acceptance of this Privacy Policy at signup acknowledges the disclosed necessary-cookie practices. Optional Google Analytics cookies on public pages are accepted or rejected separately through the cookie banner. A separate Cookie Policy checkbox is not required at signup.

7. How information is collected

Directly from you when you register, invite users, enter project content, upload files, submit the contact form, join the waitlist, or manage billing.
Automatically through cookies, authentication, hosting/application logs, first-party public-page visit and sign-in attempt logging, and—on public pages after optional-cookie consent—Google Analytics.
From service providers that process payments, email, AI requests, hosting, and file storage on our behalf.
From organization administrators who invite you or assign roles.

8. Purposes for processing

We process information to:

Provide, operate, secure, and improve the Service.
Authenticate users and manage organization workspaces.
Send transactional email such as invitations, password-recovery codes, contact-form delivery, and waitlist confirmations through Resend (not marketing email).
Process subscriptions, trials, invoices, and AI overage charges.
Generate AI-assisted drafts when requested and track AI cost usage for plan allowances.
Provide customer support and respond to inquiries.
Maintain business, security, and audit records (including project audit events that may store actor name and email).
Prevent abuse of public forms and account-security flows using rate limits (including hashed IP addresses where necessary).
Track transactional email delivery events (accepted, delivered, delayed, bounced, complained, failed).
Enforce our agreements and comply with law.
Record versioned legal consent associated with signup or checkout.
Measure public marketing-page usage with Google Analytics after optional-cookie consent.
Record first-party public marketing-page visits and sign-in attempts (including IP address encrypted at rest, approximate location from hosting geo headers, user agent, timestamp, and page path) to troubleshoot errors, maintain service availability, prevent fraud and abuse, detect attempted attacks, and investigate security incidents without using tracking cookies.

9. Service providers and subprocessors

We use service providers to help operate the Service. Based on the current implementation, these include:

OpenAI — AI-assisted functionality via the OpenAI API.
Stripe — payments, checkout, customer portal, and subscription management.
Resend — transactional email delivery. We send recipient email addresses, message content needed to deliver the message, and receive delivery metadata (including delivery, delay, bounce, complaint, and failure events).
Vercel — application hosting.
Vercel Blob — private storage for delivery user-story attachments.
Neon — PostgreSQL database hosting for application data.
Google Analytics (Google LLC) — optional measurement of public website traffic after you accept analytics cookies. Not loaded on signed-in application pages.

Providers may process information in accordance with their agreements with us and their own privacy practices. Exact hosting regions and contractual addenda are not fully specified in the application repository and should be confirmed for your production environment.

11. Data retention

First-party public marketing-page visit and sign-in attempt logs described in section 5 are automatically deleted after 90 days by a cleanup process that runs once each day. This cleanup is limited to those event logs and does not delete legal-consent records, account or workspace information, contact-form messages, waitlist signups, billing records, transactional email records, or other information described in this Policy.

We retain account, organization, and project information while the workspace is active and for a reasonable period afterward when needed to provide the Service, maintain business and security records, resolve disputes, comply with legal obligations, and enforce our agreements. Retention periods vary according to the type of information and why it is maintained. You may contact privacy@precisionfoundry.io to request deletion, subject to legal, security, billing, and backup-retention requirements.

Password-recovery codes are short-lived and expire after a limited period. Invitation tokens expire after a limited invitation window. Contact-form messages and waitlist signups are retained in the application database for operational review by application owners, linked to delivery metadata, and subject to deletion/retention controls. Hashed IP addresses may be stored temporarily for abuse prevention on password-recovery, contact-form, and waitlist submissions.

Transactional email delivery metadata (such as provider message identifiers, delivery status, bounce/complaint timestamps, and masked recipient addresses) is retained to operate and secure the Service. These records do not store recovery codes, invitation tokens, API keys, or full email bodies.

12. Security practices

We use reasonable technical and organizational measures appropriate to the nature of the Service, including password hashing, authenticated access controls, role-based permissions inside workspaces, private access settings for delivery attachments, and forcing OpenAI Chat Completions requests to set store: false in application code.

No method of transmission or storage is completely secure. We do not claim end-to-end encryption of all customer content, SOC 2 certification, HIPAA compliance, GDPR certification, CCPA certification, or specific data-residency guarantees in this Policy unless separately confirmed in writing for your deployment.

13. Organization administrators' access

Organization and other authorized administrators can view and manage workspace users, invitations, company settings, project content, and—when permitted—billing information for that workspace. Your organization controls who receives those roles.

14. User privacy choices

Update profile information in Settings.
Ask an organization administrator to change or remove workspace access.
Choose whether to use AI-assisted features; some workflows may still offer non-AI heuristic helpers.
Manage billing and cancellation through the Stripe customer portal if you are an authorized billing administrator.
Contact privacy@precisionfoundry.io for access, correction, export, or deletion requests.
Accept or reject optional analytics cookies on public pages, or change that choice later using Cookie Settings. See the Cookie Policy (/cookies).
Control browser cookie and site-data settings, understanding that authentication and organization cookies are needed for core features. See the Cookie Policy (/cookies).

15. Access, correction, export, and deletion requests

You may request access to, correction of, export of, or deletion of personal information by contacting privacy@precisionfoundry.io. We may need to verify your identity and your relationship to an organization workspace. Organization-owned content may require administrator involvement.

We may retain certain information when required by law, for security and fraud prevention, for billing records, or in backups that are rotated on a delayed schedule.

16. State or regional privacy rights

Depending on where you live, you may have rights under state or regional privacy laws, such as rights to know, delete, correct, or appeal. This Policy does not claim that Precision Foundry is certified under any specific privacy regime. Contact privacy@precisionfoundry.io to exercise applicable rights. We will respond as required by applicable law.

17. Children's privacy

The Service is intended for business and organizational use by adults. It is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children for the Service.

18. International processing

Information may be processed in the United States and in other countries where we or our service providers operate. Those locations may have privacy laws that differ from the laws where you live. Production hosting regions for the database, application, and providers should be confirmed for your deployment; they are not fully specified in the application repository.

19. Policy changes

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and may provide additional notice through the Service or by email when appropriate.

20. Privacy contact information

Privacy questions and requests: privacy@precisionfoundry.io

General support: support@precisionfoundry.io

Tools by Design Development Group, LLC · Precision Foundry