Privacy policy

What Foundry reads

• Your reviews:the star rating, the review text, the reviewer's display name, when it was posted and last changed, and any reply.
• Your overall standing:your profile's average rating and total number of reviews.
• Your locations: the names of the business locations on your account, so the right one is connected.

What Foundry posts

Replies to your reviews, published on your profile in your business's name. No reply is published until a person has approved it. Nothing else is posted.

What Foundry does not touch

Google grants one broad permission for a Business Profile. It would also allow your listing to be edited. Foundry does not use it for that. It does not change your business details, hours, photos or posts. It does not read your email, calendar, contacts, files or anything else in your Google account.

What we use it for

Two things. To tell you about your reviews: new reviews, changed reviews and your overall rating go into the regular summary we send you. And to reply to your reviews on your behalf. Those are the only purposes. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

Where it is kept

In Foundry's database, which is hosted in the United States. Review text and reviewer names are encrypted with a key that belongs to your business alone, so one business's reviews cannot be read with another's key. The permission Google gives us is stored encrypted in the same way.

Who can see it

Brendan, who runs the service, can see your reviews in order to prepare your summary and to help if something goes wrong. By connecting your profile you agree to that. Two suppliers handle the data on our behalf, and neither uses it for their own purposes:

• Railway hosts Foundry and its database.
• Resend delivers your summary email.

We do not pass it to anyone else.

Disconnecting and deleting

We keep it for as long as you are a client and the connection is in place. You can end the connection either way:

• Email brendan@waypointautomation.com.au and ask.
• Remove Foundry's access yourself in your Google account's third-party connections.

Either way Foundry stops reading your reviews. Removing access in Google does not delete what we already hold, so ask us if you want that gone too. When you do, we delete the stored permission and destroy the key that decrypts your review data. It becomes unreadable immediately and we cannot get it back. Copies in our database backups are deleted within 7 days, and after that it is gone from everywhere.

Google's rules

Foundry's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

What Foundry reads

Foundry asks Xero for read-only access to your quotes, invoices and contacts. Of everything Xero sends back, it keeps only this:

• Quotes: the quote number, its status (for example sent or accepted), and the date it was sent.
• Invoices: the due date, the date the first payment arrived, and the date it was paid in full.
• Your customers: the name and mobile number on the Xero contact.

It also keeps Xero's own reference for each of these, so the same quote or invoice is never counted twice.

What Foundry never keeps

Amounts, prices, line items, descriptions, payment terms, addresses, email addresses, bank and tax details, and anything about the bills your business pays. These are thrown away the moment Xero's answer arrives. They never reach our database, our logs or our error reports.

What Foundry does not touch

Foundry cannot change anything in Xero. It asks only for permission to read, so it cannot create, edit or delete a quote, invoice, contact or payment, and it never sends anything from Xero.

What we use it for

To send the right text at the right time: to you, when a quote needs chasing or a job needs a start date, and to your customer, when a quote has gone quiet, a job is booked, or a finished job is paid and it is time to ask for a review. Those are the only purposes. We do not use it for advertising, we do not sell it, we never send it to an AI service, and we do not use it to train AI models.

Where it is kept

In Foundry's database, which is hosted in the United States. Your customers' names and mobile numbers are encrypted with a key that belongs to your business alone, so one business's customers cannot be read with another's key. The permission Xero gives us is stored encrypted in the same way.

Who can see it

Brendan, who runs the service, can see it in order to help if something goes wrong. By connecting Xero you agree to that. Two suppliers handle it on our behalf, and neither uses it for their own purposes:

• Railway hosts Foundry and its database.
• ClickSend delivers the text messages, so it receives the mobile number and the message.

We do not pass it to anyone else. Your customers' details are also covered by our written agreement with you (see below).

Disconnecting and deleting

We keep it for as long as you are a client and the connection is in place. You can end the connection either way:

• Email brendan@waypointautomation.com.au and ask.
• Remove Foundry from the connected apps in your Xero settings.

Either way Foundry stops reading your Xero account. Removing access in Xero does not delete what we already hold, so ask us if you want that gone too. When you do, we delete the stored permission and destroy the key that decrypts your customers' details. They become unreadable immediately and we cannot get them back. Copies in our database backups are deleted within 7 days, and after that they are gone from everywhere.