Privacy Policy

Foil is operated by Henry Kirkness, a sole trader trading as “Foil”, based in England, United Kingdom. For the personal data described in this policy, contact henry@kirkness.com.

Foil plays two different roles under data-protection law, and this policy is organised around them: we are the controller for your account and site data, and the processor for the content Foil reads from your Attio workspace.

• Account data — your email address, sign-in activity and workspace membership. Lawful basis: performing our contract with you.
• Billing data — subscription status, plan and usage metering. Card details go directly to Stripe; we never see or store them. Lawful basis: contract and legal obligation.
• Usage and diagnostics — product analytics events (pages used, features clicked) and error reports, collected via PostHog's EU cloud. Lawful basis: legitimate interest in understanding and improving the product.
• Support correspondence — emails you send us. Lawful basis: legitimate interest in helping you.

When you connect an Attio workspace, Foil reads the content you authorise at connect time — call recordings and transcripts, notes, emails and deal records. That content routinely contains personal data about people your organisation deals with (names, contact details, things said on calls). For this data you (your organisation) are the controller and Foil processes it only on your instructions: to extract competitive signals, maintain battlecards, and write results back to your workspace.

• We do not use workspace content to train AI models, and our AI providers are contractually barred from doing so.
• We do not sell workspace content or share it with anyone except the subprocessors listed below.
• Access is scoped per workspace — no other Foil customer can see your data.
• A data processing agreement (DPA) is available on request.

These providers process data to run the Service:

Where a provider processes data outside the UK or EEA we rely on appropriate safeguards — UK adequacy decisions, or standard contractual clauses with the UK addendum.

• Workspace content, signals and battlecards are kept while your workspace is active.
• Deleting your account from Settings deletes your account data; when the last account linked to a workspace is deleted, that workspace's content, signals and battlecards are deleted from our systems too.
• Disconnecting the Attio integration stops all further reading of your workspace immediately.
• Residual copies may persist in encrypted backups and server logs for up to 30 days before being overwritten.
• Billing records are retained as long as tax law requires.

Foil sets essential cookies to keep you signed in, and PostHog analytics cookies (served first-party) to understand product usage. We don't run advertising cookies or trackers.

Workspace access tokens are stored encrypted, data is encrypted in transit and at rest by our hosting providers, and access to production systems is limited to the operator. No system is perfectly secure — if we become aware of a breach affecting your data we will notify you without undue delay.

Under UK GDPR you can ask us for access to, correction of, deletion of, or a copy of the personal data we hold about you as controller, and you can object to or ask us to restrict processing. Email henry@kirkness.com and we'll respond within a month. If you're unhappy with our answer you can complain to the UK Information Commissioner's Office (ico.org.uk). If your data appears in another organisation's Foil workspace, contact that organisation — they control it, and we'll help them honour your request.

We'll update this policy as the Service evolves and note the date at the top. Material changes are announced by email or in the app. See also our Terms of Service.