Privacy policy

Who we are

foundos is a web design and development studio run by Josh Potesta in Atlanta, GA. When this policy says “we,” “us,” or “our,” it means foundos.

What we collect

We keep data collection minimal. What we get depends on which part of the site you use.

• The audit box asks for nothing — type a business name, get a report. No email, no account, no sign-up. Under the report there's a separate box where you can leave a phone number if you want us to follow up. That one is optional, and it's the only thing on this site that asks you for anything.
• Contact information — your name, email, and phone number when you book a call, fill out a form, or reach out directly. Booking a call runs on Calendly, and Calendly's form is the one that asks for a name and an email. That happens on their page, not this one.
• Server logs — Vercel hosts this site, and like any web host it records the basics of each request: the page, the time, the browser, and the IP address it came from. There is no analytics script on the site. No cookies. No personal tracking.
• A short-lived request count — the audit box and the phone box each cap how many times one visitor can use them in an hour, so neither can be flooded. That count sits in the server's memory against your IP address for one hour and then it's gone. It isn't written to a database and it isn't attached to your report.
• Project files — content, images, and copy you provide for your website project. We use these solely to build and maintain your site.

What happens when you use the audit box

You type a business name. Here is every place it goes.

• Google — we send what you typed to Google's Places API to find the listing. If more than one business matches, you pick which one. Google sends back what's already public on the listing: address, category, rating, review count, phone number, website, and hours.
• The website on that listing — if there is one, our server opens it once and reads the page, the same way a browser would. It's a public page, and the request identifies itself as coming from foundos. We don't fill anything in and we don't sign in to anything.
• A language model — the wording of the report is written by Claude, a model built by Anthropic, reached through Vercel's AI Gateway. It gets the business name, the public listing details above, and what we measured on the site. It does not get your phone number — the report is written before you're ever asked for one.
• A message to Josh — every report that runs sends a Telegram alert to Josh's phone with the business name and what the report found. That's the point of the box: it tells him someone is looking. It happens whether or not you leave a number.

The finished report stays in the server's memory for up to 30 days, filed under the Google listing's id, so running the same business again comes back instantly instead of re-doing the lookups. The listing details and the site measurements are kept the same way for the same 30 days. That's memory on a running server, not a database — it clears itself whenever the server recycles. None of it is tied to you. It's filed under the business, with no visitor attached.

If you leave your phone number

The box under the report is optional. The report is yours either way. Here is exactly what your number does today:

• It goes to Josh's phone — as a Telegram message carrying your number, the business name, and what the report found. That's the whole mechanism. You left a number so he can text you back, and it lands on the phone he'll be texting you from.
• It is not saved to a database — there's one planned, Supabase, and the code for it is written, but no database is connected yet. So today nothing is stored there. If that changes, this page changes first.
• Nothing automatic fires on it — there's a wire out to an automation tool, n8n, for the same reason, and nothing is connected on the other end of it yet. No sequence, no autoresponder, no robot call.

Josh texts you himself. Your number doesn't go on a list and it doesn't go to anyone else. If you'd rather we didn't have it, email hello@foundos.ai and it's gone.

What we don't collect

• We don't use tracking cookies or third-party ad scripts.
• We don't sell, rent, or share your data with anyone.
• We don't store payment card details — payments are processed securely through Stripe.
• We don't ask for an email to run the audit box, and nothing on this site makes you create an account.

How we use your information

• To communicate with you about your project.
• To build and maintain your website.
• To send you updates if you opt in (you can opt out anytime).
• To text you back, if you left a number under a report.

Your website and your data

When we build a website for you, here's how ownership works:

• Domain name — registered in your name. You own it. We help you set it up and manage DNS, but the domain is yours.
• Website content — your photos, copy, menus, and branding are yours. We never reuse client content without permission.
• Hosting — your site runs on Vercel, a secure, enterprise-grade platform. If we part ways, we transfer everything to you.

Security

All foundos sites are served over HTTPS. We use secure, industry-standard infrastructure (Vercel, GitHub, Stripe). We don't store passwords or sensitive credentials in plain text.

When the audit box opens a website, it only ever fetches ordinary public web addresses. It's blocked from reaching anything on a private network, and it stops reading a page after a fixed size and a fixed number of seconds.

Third-party services

These are the outside services the site uses, all of them, by name. Nothing else touches your data.

• Vercel — hosting, and the AI Gateway the report's model call is routed through
• Google Places — looking up the business you typed into the audit box
• Anthropic — the model that writes the report's wording
• Telegram — how a lead alert reaches Josh's phone, so his messages pass through Telegram's servers
• Supabase — the planned database for leads. Not connected yet, so nothing is stored there today
• n8n — the planned follow-up automation. Not connected yet, so nothing fires today
• Stripe — payment processing
• Calendly — appointment scheduling
• Google Workspace — email (hello@foundos.ai)

Each of these has their own privacy policy. We only use services we trust. They are how the site runs — not people we hand your data to, and nobody buys anything from us.

Your rights

You can:

• Ask what data we have about you.
• Request we delete your data.
• Opt out of any communications.
• Have the number you left under a report deleted. Right now that means deleting a message on Josh's phone, so say the word and it's done.

Just email hello@foundos.ai and we'll handle it.

Changes

If we update this policy, we'll update the date at the top. No surprises.

Contact

Questions? Reach out:
hello@foundos.ai