Privacy Policy

Foliant operates foliant.si and is responsible for the personal data described here. Foliant is based in the United Arab Emirates and is in the process of incorporating as a free-zone company; we will add our registered company details to this page once that is complete. We follow the UAE’s data-protection law and, for people in Europe and the UK, the GDPR. Contact us about privacy at hello@foliant.si.

For the portfolio and relationship data that you and your colleagues put into Foliant, your firm decides what is collected and why, and Foliant processes it on your firm’s behalf.

Account details: your name, work email, firm name, job title and the LinkedIn profile you give us at sign-up, and the workspace you belong to.

Sign-in data: the public part of your passkeys (Foliant never sees the private key or your biometrics), single-use sign-in links, and the date of your last sign-in.

Customer Data: what you add to Foliant, such as companies, investments, documents in the encrypted vault, notes, board materials, contacts, LP records, reports and signature requests.

Connected accounts: if you connect Google or Microsoft, Foliant reads the email and calendar data needed for your inbox and meeting features, and sends only the emails you approve. Connection tokens are stored encrypted. If you connect a CRM (Affinity, HubSpot or Salesforce), Foliant syncs the contacts, companies and deals you choose.

Public information about companies: to research companies you track, Foliant collects public information from company registers, regulatory filings (such as SEC Form D), government contract records and dated news. These sources can include the names and roles of company directors and officers.

Billing: if you subscribe, Stripe processes your payment details; Foliant receives your billing name, address, tax ID and subscription status, never your full card number.

Usage and diagnostics: an audit log of important actions in your workspace, error reports, and cookie-free page-view counts that use a daily-changing, one-way hash instead of your IP address. If you accept analytics cookies, Google Analytics also measures how the site is used (see section 6).

We use personal data to provide Foliant and its features, keep accounts secure, send the emails you ask for (sign-in links, invitations, briefs, reminders and receipts), bill for paid plans, provide support, understand which features are used so we can improve them, and meet legal obligations. Under EU and UK data-protection law, we rely on performance of our contract with you, our legitimate interest in running and securing a business service, your consent for analytics cookies, and legal obligation where it applies.

We send product updates and investor insights only to people who have agreed to receive them, either when signing up or in Settings, and every such email can be turned off in Settings at any time.

We do not sell personal data, we do not use Customer Data to train AI models, and we do not show advertising.

We use a small number of service providers, each bound to protect the data and use it only to provide their service to us:

• Cloudflare: hosting, database and file storage.
• Anthropic (and OpenAI, where a workspace chooses it): the AI models behind Foliant AI. Under their business terms, they do not train on our data.
• Exa: searching recent news about the companies you track (company names and websites are sent, not your Customer Data).
• Resend: delivering Foliant’s emails.
• Stripe: payments and invoices.
• Google and Microsoft: only if you connect your mail and calendar.
• Affinity, HubSpot and Salesforce: only if you connect them.
• Google Analytics: only if you accept analytics cookies.

Some of these providers process data outside your country, including in the United States. Where EU or UK law requires it, transfers are covered by the European Commission’s standard contractual clauses or an equivalent safeguard.

Foliant has no passwords to steal: you sign in with passkeys or single-use links. Vault files and connection tokens are encrypted before they are stored, every connection uses TLS, and important actions are recorded in your workspace’s audit log. Access is limited to people in your workspace, and Foliant staff do not access Customer Data except to provide support you request or to keep the service secure.

Foliant sets essential cookies to keep you signed in and to remember your choices. They are required for the service to work. Analytics cookies from Google Analytics are set only if you accept them in the cookie banner, and you can change your mind at any time from the link in the site footer. Our own page-view counts use no cookies.

We keep account and Customer Data for as long as your workspace is active. When you close your account, we delete Customer Data within 30 days of the end of the export window described in our Terms, except where we must keep records for legal, tax or accounting reasons. Database backups roll over within a further 30 days. Error reports are kept only as long as we need them to fix the problem.

Depending on where you live, you can ask us to access, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent at any time. If your data is in Foliant because a firm uses it, we may pass your request to that firm. Email hello@foliant.si, and we will reply within one month. You also have the right to complain to your local data-protection authority.

Foliant is a professional tool and is not intended for anyone under 18.

We will update this policy when our practices change and change the date at the top. If a change is significant, we will tell you by email or in Foliant before it takes effect.