Privacy Policy

Effective date: June 16, 2026

Safe Foundry Ltd ("we", "us", "our") provides Safe Foundry, a service for Safety Data Sheet (SDS) upload, extraction, and compliance workflows. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your choices.

1. Scope

This policy applies to personal data processed when you:

• use our mobile app, internal web tools, or website,
• create or use an account,
• upload files (including SDS PDFs),
• generate or export compliance documents,
• contact support.

2. Data We Collect

A. Account and organization data

• Name, email, and account identifiers
• Organization/workspace membership and role information
• Authentication/session information

B. Uploaded and generated content

• Files you upload (for example, SDS PDFs)
• Extracted structured SDS fields
• Risk-assessment inputs and generated outputs
• PDF export artifacts and related metadata

C. Billing and subscription data

• Subscription status and billing identifiers
• Payment transaction metadata (handled by payment processor)

D. Technical and usage data

• Device/app/browser metadata
• IP address, request logs, timestamps
• Feature usage and operational events
• Error and performance telemetry
• Pseudonymous identifiers used for feature configuration and analytics

E. Support and legal workflow data

• Support/audit metadata for admin actions
• Legal acceptance records (user, org, legal version, acceptance timestamp)

3. How We Use Data

We use personal data to:

• provide, maintain, and improve the Service,
• authenticate users and authorize access,
• process uploaded files and return extracted outputs,
• run malware/security checks on uploads,
• generate PDFs and other exports,
• process subscriptions/payments,
• remotely configure features and run gradual rollouts,
• monitor reliability and prevent abuse/fraud,
• provide support and incident response,
• comply with legal obligations and enforce our terms.

4. AI and File Processing

When you upload SDS documents:

• files are processed to extract structured safety/compliance information,
• document text/content may be sent to AI processing providers,
• files may be sent to malware scanning providers before processing.

You should avoid uploading unnecessary personal data in SDS or related documents.

5. Analytics, error monitoring, and feature flags

We use PostHog to understand how the Service is used, to monitor errors, and to remotely configure features ("feature flags").

Consent-based analytics. Product analytics, session replay, and error monitoring are turned off by default and are only activated after you opt in. Session replays are captured with text, input fields, and images masked. You can change your choice at any time in the app's privacy settings; withdrawing consent stops collection of these analytics events.

Feature flags and remote configuration. To decide which features and experiences to show you and to roll changes out gradually, the app sends a limited set of non-personal, technical attributes to PostHog: a pseudonymous identifier (a randomly generated device identifier and, if you are signed in, your account identifier), your app version, platform (iOS, Android, or web), app environment, and device language/locale. We do not use personal information such as your name or email address to target feature flags. Because this remote configuration is necessary to operate and configure the app, it occurs whether or not you have consented to analytics. It does not capture your behavioral analytics events.

PostHog processes this data in the United States. Signing out clears the locally stored identifier on your device, and you can request deletion of your data as described in "Your Rights".

6. Service providers

We use trusted third-party service providers to operate, secure, support, and improve the Service. These providers may process personal data only as needed to provide their services to us and must protect it under appropriate contractual and security obligations.

• Supabase: database, storage, and backend infrastructure; processes account, organisation, support, SDS, usage, and generated-output data.
• Clerk: authentication and organisation management; processes user identity, email address, login, session, and organisation membership data.
• Stripe: payments and billing; processes billing customer, subscription, payment, invoice, refund, and transaction data.
• Resend: transactional and support email; processes email addresses, message content, support replies, and email metadata.
• OpenAI: AI-assisted SDS extraction and structuring; processes SDS/customer content submitted for the extraction feature, which may include personal data if included in uploaded documents.
• PostHog: product analytics, session replay, error monitoring, and feature-flag/remote configuration; processes usage events, device/session data, diagnostic information, and limited error details, and — for feature flags — a pseudonymous identifier, app version, platform, app environment, and device language/locale. Feature-flag processing occurs whether or not you have consented to analytics; analytics, session replay, and error monitoring occur only after you opt in.
• hCaptcha: bot and abuse prevention; processes captcha tokens, IP address, browser/device signals, and verification metadata.
• Expo: push notification delivery; processes push tokens, device/platform data, and notification delivery metadata.
• Cloudmersive: malware scanning for uploaded SDS files; processes uploaded SDS files and related file metadata.

We do not intentionally send account passwords, payment card numbers, or billing details to AI providers. For AI-assisted SDS processing, OpenAI receives the SDS/customer content needed to provide the extraction feature. Uploaded documents may contain personal data depending on what the customer includes in them.

Some providers are used only when the relevant feature is enabled, such as push notifications, bot protection, analytics, or malware scanning.

We require service providers to process data only for authorised purposes, apply appropriate security measures, and comply with applicable data protection obligations.

We may update subprocessors from time to time. Material changes will be reflected in this policy and/or related legal disclosures.

7. Sharing and Disclosure

We do not sell personal data.

We may disclose data:

• to subprocessors that help us provide the Service,
• to comply with legal process or law,
• to protect rights, security, and safety,
• in connection with a merger, acquisition, or asset sale.

8. Data Retention

We retain data for as long as needed for:

• account and service operation,
• security and abuse prevention,
• compliance, legal, tax, and accounting obligations,
• dispute resolution and contract enforcement.

Retention periods may vary by data type. We may delete or anonymize data when no longer required.

9. Security

We use reasonable technical and organizational safeguards, including access controls and service-level protections, to reduce unauthorized access, disclosure, alteration, and loss. No method of transmission or storage is 100% secure.

10. International Transfers

Your data may be processed in countries other than your own. Where required, we implement appropriate safeguards for cross-border data transfers.

11. Your Rights

Depending on your location, you may have rights to:

• access personal data,
• correct inaccurate data,
• delete data,
• restrict or object to processing,
• data portability,
• withdraw consent where processing relies on consent,
• file a complaint with a supervisory authority.

To exercise rights, contact us using the details below.

12. Children’s Privacy

The Service is not directed to children under 13 (or higher age where required by local law), and we do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will update the "Last updated" date and provide notice where required.

14. Contact

Company: Safe Foundry Ltd

Email: privacy@safefoundryapp.com

Address:
Safe Foundry Ltd
Unit A
82 James Carter Road
Mildenhall
IP28 7DE