Privacy Policy

Version 1.2 · Last updated May 2026

1. Introduction

Sol Foundry, Inc. (“Sol Foundry,” “we,” “us,” or “our”) operates the Sol platform, accessible at hellosol.app and solfoundry.app (the “Service”). This Privacy Policy describes how we collect, use, store, protect, and share your personal information when you use our Service.

By using Sol, you agree to the collection and use of information as described in this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Information Created Through Your Use of the Service

2.4 Integration Data

If you connect third-party services (Gmail, Slack) through the platform:

OAuth tokens for connected services are managed by our integration partner, Composio, and are not stored directly by Sol Foundry.

3. How We Use Your Information

We use the information we collect to:

• Provide the Service: Deliver core Sol functionality including task management, topic identification, and integrations
• Improve the Service: Analyze usage patterns and error data to fix bugs and improve features
• Communicate with you: Send service-related notifications and respond to support requests
• Ensure security: Detect and prevent unauthorized access, fraud, and abuse
• Comply with legal obligations: Meet applicable legal and regulatory requirements

We do not use your personal information for advertising, sell it to third parties, or share it for purposes unrelated to providing and improving the Service.

3.1 Data Controller and Processor Roles

For individual accounts, Sol Foundry acts as the data controller with respect to personal information collected and processed through the Service.

For organizational or workspace accounts, the customer organization acts as the data controller/business, and Sol Foundry acts as a service provider/data processor with respect to end-user content processed on behalf of the customer. In such cases, the customer organization determines the purposes and means of processing, and Sol Foundry processes data only in accordance with the customer’s instructions and applicable agreements.

3.2 Law Enforcement and Legal Disclosure

We may disclose personal information where required to comply with applicable law, regulation, legal process, or enforceable governmental request. Where permitted by law, we will make reasonable efforts to notify you before such disclosure.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time by contacting us.

5. How We Store and Protect Your Information

5.1 Data Storage

Our primary infrastructure is hosted in the United States (AWS us-east-1 region). Some third-party service providers listed in Section 6 may process limited data in other regions as part of their service delivery. We require all providers to maintain appropriate security safeguards regardless of processing location.

5.2 Encryption

• At rest: All databases and storage systems use AWS KMS or AES-256 encryption
• In transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. Database connections require SSL.

5.3 Access Controls

• Access controls are designed to ensure users can only access data associated with their authorized account context
• Three-layer authorization is designed to protect every API request: API Gateway verification, application-level authorization, and database-level user scoping
• Administrative access to infrastructure requires VPN and multi-factor authentication
• Access to production systems is reviewed quarterly

5.4 Security Monitoring

• AWS WAF protects against common web attacks and rate-limits abusive traffic
• AWS GuardDuty provides continuous threat detection
• AWS CloudTrail logs all infrastructure API activity
• Application errors are tracked via Sentry with PII collection disabled

6. Third-Party Services

We share data with the following third-party service providers, solely for the purpose of delivering and operating the Service:

We do not sell, rent, or trade your personal information to any third party.

We may update or replace subprocessors from time to time based on operational needs. We maintain appropriate contractual and security safeguards with all subprocessors. A current list of subprocessors may be requested by contacting us at the email below.

6.1 Authentication Data

Sol Foundry does not store Google account passwords. Authentication is handled entirely through Google OAuth, and only the information described in Section 2.1 is retained by Sol Foundry.

6.2 AI Data Minimization

Before sending data to LLM providers (e.g., OpenAI), we apply the following minimization measures:

• Only conversation context relevant to the specific AI feature is transmitted (not your entire account data)
• We make commercially reasonable efforts to minimize or redact direct identifiers (such as email addresses and phone numbers) before transmitting prompts to LLM providers where technically feasible
• We do not send file attachments to LLM providers
• We use API configurations that disable training on customer data (e.g., OpenAI’s data usage opt-out)
• LLM responses are cached locally to minimize repeated data transmission

7. International Data Transfers

Our Service is hosted in the United States. If you access the Service from outside the United States, your personal data will be transferred to and processed in the United States.

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on:

• EU-U.S. Data Privacy Framework: where applicable, for providers certified under the framework
• Standard Contractual Clauses (SCCs): as approved by the European Commission, incorporated into our agreements with sub-processors that process EEA personal data
• Supplementary measures: including encryption in transit and at rest, access controls, and contractual obligations on sub-processors

You may request a copy of the applicable transfer safeguards by contacting us at the email below.

8. Cookies and Tracking

Sol uses only essential cookies required for authentication (Firebase Authentication session). We do not use:

• Advertising or marketing cookies
• Third-party tracking cookies
• Analytics cookies
• Social media tracking pixels

Do Not Track

We do not respond to “Do Not Track” (DNT) browser signals, as there is no industry-standard protocol for compliance. However, since we do not use tracking cookies or third-party analytics, our data collection practices are the same regardless of DNT settings.

9. Data Retention

Account Deletion

When you delete your account, we initiate deletion of all your personal data from our active systems within 7 days. This includes:

• User profile information
• All callouts, loops, topics, and contacts
• All file attachments
• All integration connections (OAuth tokens disconnected from Composio)
• All cached data

Residual copies in encrypted backups are subsequently removed in accordance with backup retention schedules (within 30 days). Data already transmitted to third-party services (e.g., error logs in Sentry) will be deleted according to the retention schedules listed above.

Account deletion is permanent and is not intended to be reversible.

10. Your Rights

You have the following rights regarding your personal data:

We may verify your identity before processing certain privacy requests to protect against unauthorized access to your data.

We will respond to all data rights requests within 30 days. If we need additional time (up to 60 additional days for complex requests), we will notify you within the initial 30-day period.

Account Deletion (Self-Service)

You can delete your account and all associated data through:

• Self-service: Use the delete account feature within the Sol application
• Request: Email us at the address below

11. Your Rights Under Applicable Law

California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights:

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information
• Right to opt out of sale — we do not sell personal information
• Right to non-discrimination for exercising your privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond providing the Service

In the preceding 12 months, we have not sold personal information and do not share personal information for cross-context behavioral advertising.

EU/EEA/UK Residents (GDPR/UK GDPR)

If you are located in the EEA or UK, you have the additional rights described in Section 4 (Legal Basis) and Section 10 (Your Rights), including:

• Right to lodge a complaint with your local supervisory authority
• Right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)

12. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and applicable regulatory authorities as required by law. We aim to provide notification within 72 hours of becoming aware of a qualifying breach, including:

• A description of the nature of the breach
• The categories and approximate number of individuals affected
• The types of personal data affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach

13. Children’s Privacy

Sol is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information within 7 days.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Notify users via email or in-app notification at least 30 days before material changes take effect

Your continued use of the Service after changes are posted constitutes acceptance of the updated policy. If you do not agree with the updated policy, you may delete your account.

15. Business Transfers

Personal information may be transferred as part of a merger, acquisition, financing, or sale of company assets, subject to applicable confidentiality obligations. In such an event, we will notify affected users before personal information is transferred and becomes subject to a different privacy policy.

16. Governing Law

This Policy shall be governed in accordance with applicable U.S. privacy and consumer protection laws, including the California Consumer Privacy Act (CCPA/CPRA) and, where applicable, the General Data Protection Regulation (GDPR).

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about our data practices, contact us at:

Address: United States (Delaware-incorporated)

For EU/EEA residents: Sol Foundry does not currently have a physical establishment in the EU. If EU data protection regulations require appointment of an EU representative in the future, we will update this section accordingly.

Revision History