Privacy Policy

Last updated: September 9, 2026

Foundry is a commerce and content platform operated by Pencilz ("we", "us", "our"), an agency that manages the platform on behalf of the businesses that use it. This Privacy Policy explains what information the Foundry platform collects, how it is used, and the choices you have. By using the platform you agree to this policy.

Who we are

Foundry is a multi-tenant commerce and content platform. It is operated and managed by Pencilz, the agency responsible for the platform. Each business ("project") operating on Foundry is a separate data controller for the personal data of its own customers; Pencilz, as platform operator, acts as a data processor on each project's behalf and as a controller for platform-level account and operational data.

Information we collect

• Account information — name, email address, and role for staff and administrators who sign in to the platform.
• Business data — products, orders, customers, content, and settings that a project stores on the platform.
• Integration data — when a project connects a third-party service (see "Third-party integrations" below), we store the authorization tokens needed to access that service and the business data returned by it.
• Usage and device data — log data, IP address, browser type, and interaction events used to operate, secure, and improve the service.
• Cookies — session and preference cookies required to sign in and to remember settings.

How we use information

• To provide, maintain, and secure the platform and its storefronts.
• To authenticate users and enforce access controls.
• To synchronize data with connected third-party services at the direction of the project.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To comply with legal obligations.

Third-party integrations

Projects may connect third-party services to the platform. When they do, we access only the data permitted by the scopes granted during authorization, and only to provide the features the project has enabled. The services that may be connected, and the categories of data involved, are:

Commerce & catalog

• Shopify — reads orders, products, customers, inventory, collections, and refunds; writes draft orders, products, images, inventory, collections, metafields, and tax variants.
• Square — reads catalog, orders, inventory, and customers; writes inventory.
• LeagueApps — reads programs, registrations, and schedules (may include participant/member details).
• Brightpearl — reads purchase orders, goods receipts, and products; writes purchase orders, delivery dates, and goods notes.
• Bill.com — reads vendors, bills, payments, invoices, customers, and chart of accounts.
• QuickBooks Online (Intuit) — reads chart of accounts, tax codes, payments, customers, and items; writes invoices, customers, credit memos, and payments.

Payments

• Stripe — payment and payout data for connected accounts.

Email & messaging

• Klaviyo — writes email marketing profiles, events, and lists.
• Mailchimp / Brevo / ConvertKit — write email subscriber records.
• Resend — sends transactional emails (order confirmations, receipts, notifications).

Analytics & advertising

• Google Analytics 4 — collects site traffic and conversion data (page views, device, IP, interaction events).
• PostHog — collects product usage and session analytics.
• Meta Pixel — collects and sends conversion events for advertising.
• Google Ads / Meta Ads / TikTok Ads — read advertising campaign and spend data.

Support & scheduling

• Gorgias — reads support tickets and satisfaction scores (may include customer details).
• Google Calendar — reads and writes calendar events for appointments and pickups.

Shipping, fulfillment & address

• Packiyo — reads inventory, orders, shipments, and packages; writes inbound ASNs and orders.
• Flavorcloud — reads shipments, invoices, and tracking for international shipping.
• Address Autocomplete (Google Places, Canada Post, or Mapbox) — processes address input at checkout.

Storage

• Cloudflare R2 — stores uploaded files, which may include documents, photos, prescriptions, or receipts.

Authorization tokens for these services are encrypted at rest and used only to perform the synchronization and features the project has configured. We do not sell this data.

Foundry's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is used only to provide or improve the connected features you have enabled, is not transferred to third parties except as necessary to provide those features or as required by law, is not used for advertising, and is not read by humans except with your consent, for security purposes, or as required by law.

How we share information

We do not sell personal information. We share information only: (a) with the project that controls it; (b) with third-party services a project has connected, to provide the requested features; (c) with infrastructure providers who process data on our behalf under contract (for example hosting, database, and email delivery); and (d) where required by law.

Sensitive data and specialized features

Certain optional features process sensitive categories of personal data. A project only processes this data if it has enabled the relevant feature:

• Vision prescriptions (Prescriptions and Rx Operations features) — health information such as prescription values, validation status, and optician verification. This data is access-controlled, audited, and subject to health-data retention rules managed by the platform's consent system.
• Insurance receipts — customer and order details used to generate insurance receipts, with generated PDFs stored securely and retained per applicable regulatory requirements.
• Trade-in photos (Second Sight) — photographs of frames submitted by customers for grading.
• Virtual try-on — augmented-reality try-on sessions and frame-interaction data. Try-on is processed to render the experience and track session activity; see the applicable feature settings for whether any imagery is retained.

Where a feature processes health information, we apply additional safeguards including access controls, audit logging, and defined retention and deletion rules.

Data retention

We retain personal data for as long as an account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. When a project disconnects an integration or closes its account, associated authorization tokens are revoked and deleted, and business data is deleted or de-identified within a reasonable period.

Data security

We use administrative, technical, and physical safeguards designed to protect information, including encryption of credentials at rest, encrypted transport (TLS), access controls, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. If your data is controlled by a project on the platform, we will refer your request to that project or assist them in fulfilling it.

Data deletion requests

You may request deletion of your personal data at any time. To request deletion:

1. Email privacy@pencilz.com with the subject line "Data Deletion Request".
2. Include the email address or account associated with the data, and the service or connection involved (for example, a connected Facebook, Google, or QuickBooks account).
3. We will verify the request and delete the associated personal data and any stored authorization tokens within 30 days, unless we are required to retain specific records by law.

When a project disconnects a third-party integration, the authorization tokens for that integration are revoked and deleted automatically. If your data is controlled by a project on the platform, we will coordinate the deletion with that project.

International transfers

Our infrastructure is hosted in Canada. Where data is transferred across borders, we take steps to ensure it remains protected consistent with this policy and applicable law.

Children's privacy

The platform is not directed to children under 13, and we do not knowingly collect personal data from them.

Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated effective date.

Contact us

Questions or requests regarding this policy can be sent to privacy@pencilz.com.