Legal

Privacy policy

Last updated: 22/09/2026

This policy explains what personal data Foundation collects, why, and what you can do about it. It's written in plain language rather than dense legal text. See the note at the bottom about getting it formally reviewed before relying on it.

Who we are

Foundation ("Foundation", "we", "us") is the company behind foundationagent.co.uk and the Foundation platform, provided to UK estate and letting agencies. Foundation is a trading name of Software Builders Ltd, registered in England & Wales, under company number 17431696, with its registered office at 66 Chertsey Road, Windlesham, England, GU20 6HP. You can reach us at hello@foundationagent.co.uk. For everything below, "you" means the agency that holds a Foundation account, unless we say otherwise.

Two kinds of data we handle

It matters who "owns" the data, so we're explicit about it. First, there's your account data. The information about you and your agency as our customer (name, email, agency details, billing information, support conversations). For this data, Foundation is the data controller under UK GDPR: we decide why and how it's processed, and this policy covers it in full.

Second, there's data your own customers give you through Foundation's tools. A buyer completing a valuation form, a tenant registering for property alerts, a vendor's details you add to the CRM. That's your data, not ours. You are the data controller for it; Foundation is a data processor acting only on your instructions, under our terms of service and (for larger agencies) a data-processing agreement available on request. If someone contacts us asking about data your agency holds on them, we'll direct them to you.

What we collect

Directly from you: name, email, phone, agency name and branding assets, payment details (handled by Stripe. We never see or store your card number), and any content you upload (listings, contacts, documents, templates).

Automatically: standard technical data such as IP address, browser type, and the pages you visit, used for security, debugging and keeping the service running. See our Cookie Policy for the specifics of what's stored in your browser.

Through your customers: whatever your own buyers, tenants and vendors submit via valuation forms, the buyer/tenant register, or other embedded tools. Processed on your behalf, as above.

Why we process it, and on what legal basis

To provide the service and fulfil our contract with you (running your account, hosting your data, sending transactional emails such as lead notifications and receipts). Necessary to perform our contract with you. To keep the platform secure and prevent abuse. Our legitimate interest. To send non-essential marketing, where we do so, or to set optional analytics cookies, only with your consent, which you can withdraw at any time. To meet our own legal and accounting obligations, such as retaining invoices, legal obligation.

Automated valuations and calculators

Foundation Valuation produces an automated estimate generated from HM Land Registry Price Paid Data, comparable-property weighting and a confidence score. It is not a RICS survey, a mortgage valuation, or professional advice, and produces no legal or contractual effect on its own. Foundation Studio's calculators (stamp duty, mortgage, yield, moving costs) are similarly indicative and for guidance only. Nobody's mortgage application, contract, or legal position is decided by these tools.

Who we share data with

We don't sell personal data, ever. We share it only with the specific sub-processors needed to run the service: Stripe (payment processing), Resend (transactional email delivery), and our infrastructure providers. We'll keep this list current as our stack changes.

Where it's stored

Our primary systems are hosted in the UK (London). Encrypted backups are additionally replicated to EU infrastructure (Amsterdam) for resilience. Our payment and email sub-processors (Stripe, Resend) may process limited data outside the UK/EU under their own compliance safeguards, as is standard for these services.

How long we keep it

For as long as your account is active. If you close your account, we retain your data for a limited period afterwards in case you wish to reactivate, and to meet our own legal/accounting obligations, then delete or anonymise it. You can ask us to delete it sooner, see "Your rights" below.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, correct it, ask us to delete it, restrict or object to our processing, and receive a portable copy. To exercise any of these, email privacy@foundationagent.co.uk, we'll respond within a month. If you're unhappy with our response, you can complain to the Information Commissioner's Office (ico.org.uk).

How we protect it

Passwords are hashed (never stored in plain text) and traffic to and from Foundation is encrypted in transit. Backups are encrypted at rest. Access to production systems is restricted. No system is perfectly secure, but we take reasonable technical and organisational steps to protect your data and will tell you promptly if that ever fails to hold.

Changes to this policy

We may update this policy as the product or our sub-processors change. Material changes will be flagged by email or an in-app notice.

This is a plain-language placeholder. Please review with your legal counsel before commercial use.