Privacy Policy

Effective Date: 7 June 2025
Last updated: 28 September 2026

This Privacy Policy explains how Foundations (“we”, “our”, “us”) collects, uses, and protects your personal data. Foundations is operated by Michael Dominic van Almsick, a sole trader based in the United Kingdom.

1. Data We Collect

a) User Data

Name and email address (via Clerk);
Authentication tokens and login metadata;
Stripe payment and payout information;
IP address, device, and usage metadata (via PostHog).

b) Client Data

You may store client information — such as names, email addresses, and session notes — within the Service. You are the data controller for this content.

c) Cookies & Similar Tech

We use cookies for authentication (Clerk) and, with your consent, analytics (PostHog). See our Cookie Policy.

2. How We Use Your Data

Provide, maintain, and improve the Service;
Process payments and payouts via Stripe;
Deliver transactional emails via Resend;
Analyse usage to build better features (PostHog);
Ensure security, prevent fraud, and comply with law.

We do not sell your personal data.

3. Legal Basis for Processing

Contractual necessity (to deliver the Service);
Legitimate interests (product improvement, fraud prevention, and telling businesses about Foundations);
Consent (for optional analytics or marketing emails).

4. Data Sharing & Processors

We share data with trusted providers who process it on our behalf:

Stripe – payments & payouts
Clerk – authentication
Resend – email delivery
Neon – Postgres database
PostHog – analytics (consent-based)
Google Maps API – location autocomplete
Vercel – hosting

All processors are GDPR-compliant and bound by DPA agreements.

5. Data Retention

We retain personal data while you have an active account. Upon request or account deletion, data is erased or anonymised within 30 days, unless retention is required by law.

6. Your Rights (UK GDPR)

You may:

Access, correct, or delete your data;
Object to or restrict certain processing;
Export your data (“data portability”);
Withdraw consent at any time (for analytics/marketing).

To exercise these rights, email support@usefoundations.app.

7. Security

We use encryption in transit and at rest, principle-of-least-privilege access controls, and serverless hosting on Vercel. However, no online service is 100 % secure.

8. International Transfers

Data may be processed outside the UK (e.g. EEA or US) by our sub-processors, but always under appropriate safeguards such as Standard Contractual Clauses.

9. People We Contact About Foundations

We sometimes email fitness businesses, such as personal training studios, to tell them about Foundations. We only use contact details a business publishes itself, for example on its website.

What we hold: the business name, its published email address or phone number, and notes of any conversation we have;
Where it comes from: the business’s own website and Companies House;
Why: to tell you about a service relevant to your business. Our legal basis is legitimate interests;
How long we keep it: if we don’t hear back, we delete your details 12 months after our last email;
Your choice: you can ask us to stop at any time by replying to our email or writing to support@usefoundations.app. We stop straight away and keep only your email address on a do-not-contact list, so we never contact you again.

We never sell these details or use them for anything else. You also have the rights in section 6.

10. People Who Contact a Trainer Through Their Page

Trainers who use Foundations can publish their own page on usefoundations.app, with a form for enquiries. A published page is public and can show up in search engines such as Google.

What we hold: the name, email address, phone number (if you give one) and message you send, whether you asked to join the trainer’s waitlist, and when you sent it. Please don’t include health details;
Who it’s for: the trainer you wrote to. They decide what happens with your enquiry and are its data controller. We store it and email it to them on their behalf, and when they reply, the email comes from them;
Who else handles it: Neon stores it, Resend delivers the email to the trainer, and Vercel hosts the page. Visits to the page are measured with PostHog, as on the rest of our website;
How long we keep it: until the trainer deletes their Foundations account, or sooner if you or the trainer ask us to delete it;
Your choice: to see, correct or delete your enquiry, ask the trainer, or write to support@usefoundations.app and we will delete it within 30 days.

You also have the rights in section 6.

11. Complaints

If you’re unhappy with how we’ve handled your personal data, email support@usefoundations.app. We will acknowledge your complaint within 30 days and tell you what we’ve done about it. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.

12. Policy Updates

We may update this Privacy Policy periodically. Material changes will be announced via the Service or email.

Questions? Email support@usefoundations.app