Privacy policy

FoundWell (foundwell.net) is run by Datapad. FoundWell does search engine optimisation for business websites: it plans, writes and publishes content, fixes existing pages and reports on search traffic. This policy explains what information we collect, what we do with it, who we share it with and how you can have it deleted.

What we collect

• Your account: your name, email address and password. Passwords are stored as a one-way hash.
• Your website: its address, the public pages we crawl, and the business details, prices, competitors and other facts you give us or correct during onboarding.
• Your CMS connection: the WordPress application password or Umbraco API credentials you give us, so we can publish and edit pages. These are encrypted before we store them.
• Google Search Console data, if you connect it. The next section covers this in detail.
• Billing: payments are handled by Stripe. We store your Stripe customer and subscription IDs and your subscription status, but never your card details.
• Messages you send us through the contact form: your name, email address, website and message. They reach us by email.
• A session cookie that keeps you signed in, a cookie that remembers whether you read the site in English or Dutch, and a cookie that remembers your cookie choice.
• Analytics cookies: Google Analytics cookies that show us which pages visitors use and which of our ads bring them in. Visitors in the European Economic Area, the United Kingdom and Switzerland, and visitors whose country we can't tell, are asked first; until they accept, Google receives only visits without cookies or identifiers. Elsewhere these cookies are on until you turn them off. You can change your choice at any time with the “Cookies” link at the bottom of every page. The same choice controls the Meta (Facebook) pixel. When it is on, your browser loads the pixel and Meta may set its own cookies and receive the pages you view, the fact that you created an account, and, when a payment is confirmed, the amount and currency. When you create an account with it on, our server also tells Meta, with your IP address, browser, the pixel's cookies and hashed (scrambled) forms of your email address and account number. Meta uses the hashed email to match the signup to an ad you saw, and the signup is counted even if your browser blocks the pixel. When it is off, that pixel does not load and neither your browser nor our server contacts Meta. We don't send Meta your name, your email address in readable form, or card details.

Google Search Console data

When you click “Connect Search Console”, Google asks you to let FoundWell view and manage Search Console data for your verified sites (the webmasters scope). With that permission, FoundWell does only the following, and only for the website you connected:

• lists your Search Console properties, so you can choose the one that matches your site;
• reads search performance data for that property: the searches your pages appear for, the pages that appear, and their clicks, impressions, click-through rate and average position;
• inspects your page addresses to check whether Google has indexed them;
• submits your sitemap to Search Console, so Google finds new and updated pages.

We use this data only to provide FoundWell to you:

• to find the searches each page should win and plan new content around them;
• to find pages close to the first page of Google and improve them;
• to find pages Google has not indexed and fix them;
• to show you traffic and ranking numbers in your dashboard and in your weekly and monthly reports.

We store daily totals (clicks, impressions, click-through rate and position) and the latest numbers for each search we track for you. Your Google sign-in is kept as an encrypted refresh token, so the daily sync can run without you. We never change your Search Console settings, users or verifications.

To write and improve your pages, we send the relevant searches and page addresses to our AI provider, Anthropic (Claude). Anthropic processes them only to return a result to us and does not use them to train its models. To track rankings, the searches we track for you may be sent to a search data provider (SerpApi).

We do not:

• sell your Search Console data or share it with anyone else, except as described above;
• use it for advertising, or to decide anything about you that isn't part of the service;
• use it to train or improve AI or machine learning models;
• let people read it, except when you ask us for help, when we need to for security or to comply with the law, or when it has been combined so it no longer identifies you or your site.

FoundWell's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove FoundWell's access at any time on your Google Account permissions page. After that, FoundWell can no longer read your data, and the work that depends on it stops. To also delete the Search Console data we have already stored, email us (see “Deleting your data” below).

How we use your information

• to run FoundWell for your website and publish to it in the way you choose (autopilot or approval);
• to send you reports, alerts about things that need your approval, and service messages;
• to bill you and handle your subscription;
• to answer your questions and keep the service secure.

We don't send marketing email without your permission.

Who we share it with

We use these providers, each only for the purpose listed:

• Anthropic: AI that researches your business and writes and edits content.
• Google: Search Console, PageSpeed Insights, and Google Analytics for visits to our own website.
• Stripe: payments and invoices.
• Meta, only when analytics cookies are on: measurement of page views, signups and confirmed purchases, and matching signups to ads with a hashed email address, as described above.
• Cloudflare: delivers our website and protects it from attacks, so it sees your IP address and the pages you request.
• OpenAI, Perplexity and SerpApi: to check what AI assistants and Google say in answer to questions about your market, and to track rankings. They receive those questions and searches, not your account details. OpenAI also makes the images for your articles from a short description of each image.
• Our email provider: to deliver reports and alerts.

Your account and site data are stored in a database on servers we run. We may also disclose information when the law requires it.

Outreach

FoundWell drafts outreach pitches and directory submissions about your business. It never sends or submits them: you send the ones you choose yourself, and can mark them sent in your dashboard.

How long we keep it

We keep your information while your account is open. When you cancel, we stop working on your site, and we delete your site data, including stored Search Console data and CMS credentials, within 30 days of your request. Billing records are kept as long as tax law requires.

Deleting your data

Email hello@foundwell.net from the address on your account, and we delete your account and site data within 30 days. You can also ask us for a copy of your data or to correct it. If you are in the European Union or the United Kingdom, you have these rights under the GDPR, and you can complain to your data protection authority.

Security

Connections are encrypted with HTTPS. CMS credentials and Google tokens are encrypted before we store them, and only the systems that run FoundWell can read them.

Changes

If we change this policy in a way that matters, we'll email you before the change takes effect. The date at the top shows the latest version.

Contact

Questions about privacy: hello@foundwell.net.