Plain-English Licensing, Privacy & Sovereign Data Governance.
Everything that governs your ownership and use of FoundrySuite—written in clear business English you can read in ten minutes, backed by verifiable technical enforcement.
Who is behind the product
The vendor
Project Foundry LLC, which is the party to the license agreement, the controller named in the privacy notice, and the name in the footer of every page on this site.
How to reach us
One address serves support, licensing and data protection: [email protected]. Put “data protection” in the subject line for a data request and it reaches the right person rather than support.
Zero Hidden Telemetry or Cloud Sub-Processors
Because FoundrySuite processes and stores data exclusively on your hardware, there are no third-party cloud sub-processors, data brokers, or unilateral SaaS terms-of-service changes that can compromise your business records. Your customer list, pricing margins, and general ledger never sit on a multi-tenant cloud server waiting to be breached or subpoenaed via a third party.
The four documents
Each is a file in the download, written to be read rather than survived.
End User License Agreement
The contract. What the license grants and restricts, that it is per workstation and not per user, that it is perpetual, and that replacing a machine does not require a new purchase. It also sets out what happens to your data, what we may and may not do with AI output, the warranty disclaimers, the limitation of liability, and the governing law.
File in the download: EULA.md. Sections a buyer usually wants: 1.1 the license and the thirty-day trial, 1.2 the installment plans, 1.3 moving to another machine, 4 your data, 5 AI features and model use.
Privacy Notice
What the software processes, what we process, and why there is no processor relationship for your business data. Section 1 names every outbound connection the software can make; section 3 names the controller for the data about you, the lawful basis for each item, how long it is kept, and your rights — including the right to complain to a supervisory authority and the one-month deadline we hold ourselves to.
File in the download: PRIVACY-NOTICE.md.
AI Facts Sheet
Written for a compliance officer rather than a lawyer. What the four AI features do, what is sent to a model and what is never sent, what the research feature puts on the wire, and the fact that we supply no model and host no weights — so the provider obligations for a general-purpose model do not sit with us.
File in the download: AI-FACTS-SHEET.md.
Compliance Notes
The engineering-side position: transport, session storage, tenant isolation, retention windows, and the AI disclosure record written for every model call. It also contains an honest list of what is still missing, which is the part worth reading first if you are doing a procurement review.
File in the download: COMPLIANCE.md, alongside a deployment guide for the network-access case, which is the one deployment where decisions are yours rather than defaults.
Where to read the behavior rather than the paperwork
The security page describes what the software refuses to do, and the AI page describes what the model is permitted to touch. Both are written to be checked against the running product.
Who you are contracting with
Both documents open with the same contact block, and a procurement reviewer will read it before anything else. Here it is in full, so you do not have to take a PDF's word for it.
Project Foundry LLC
701 South St., Ste 100
Mountain Home, AR 72653
United States
This is the registered address in the EULA and the Privacy Notice — where formal notice and a data-subject request are served. The EULA is governed by the laws of the State of Arkansas.
Both of these facts used to be marked «FILL: …» in the documents themselves rather than guessed at. They are filled in now, and a test in the source checks that no unrecognized placeholder has appeared since — so a third gap cannot slip in unnoticed, and a filled one cannot be quietly left on the list as if it were still outstanding.
What that means for you
Nothing in these documents is provisional. The license grant, the data terms, the AI terms, the governing law and the refusal list are complete as written.
If your procurement process needs something these documents do not say — a tax identifier, a signed W-9, a data-processing agreement, a security questionnaire — ask us and you will get a real answer from a person.
Those two facts stayed marked until they could be verified, rather than filled with a plausible guess, because a wrong registered address in a contract is the kind of error nobody checks until it matters.
Questions these documents raise
Who is the data controller for my business data?
You are, not us. The privacy notice is explicit that we do not act as a processor on your behalf, because your data never reaches us — there is no server for it to arrive at. We are a controller only for the business data described in section 3: information about you and other people who contact us.
What happens to my data if I stop paying?
It stays where it is, in a format you can read without us. The EULA says a license is not a subscription and does not need to be returned; uninstalling ends your right to use the software and creates no debt, and your right to use the data you produced does not terminate with it.
Do you host the AI model weights?
No. The EULA states that you choose the model and we do not provide the weights; the AI facts sheet says the same. What the installer does carry is an address: the manifest pins each file to a specific revision of a Hugging Face repository and records the SHA-256 of those bytes, so when you ask for them the software fetches them and verifies them — about 5.7 GB, once. It asks before it starts: the program shows you the total and who publishes each file, and fetches nothing until you have agreed, so nothing reaches the network on its own. Declining is recorded nowhere and is asked again next time. Naming where to fetch from is a different act from shipping the bytes, which is why the general-purpose-model obligations stay off us.
You can also decide in advance which models you want at all. The download prompt draws a box per model, and a model you untick is not offered again, is not counted, and is not fetched. That decision is kept, in model-preferences.json in your own data directory — a file describing how this installation is configured, never transmitted, and yours to read, change or delete. It is kept apart from the consent record deliberately: an agreement expires when the manifest changes and is asked again, while a configuration preference does not. Declining the question, by contrast, still writes nothing down and is asked again next time. The same file holds the path to a model file you supply yourself, and the software will report a missing file at that path rather than substitute another model for the one you chose.
The language model is IBM's, from IBM's repository. The two OCR files are not DataLab's: DataLab publishes no GGUF of the model they trained, so both are community quantizations fetched from a third-party Hugging Face account, and your agreement is recorded against the files and their total, so a change to either makes it ask again. The digest verifies the bytes and the pinned revision fixes them in place; neither makes that account the vendor of the OCR model. Full detail, with every repository named, is in section 1 flow 5 of the Privacy Notice.
Can I read these before I buy?
Ask and we will send them. They are also reproduced in full inside the download, which is the version you should hold on to — it is the one that shipped with the software you are running.