Legal
Privacy policy
How Planetary.Blue collects, uses, discloses and protects personal data in connection with Foundry by BIRI™.
Effective date: set at launch · Last updated: 6 November 2026
Applies to the Foundry by BIRI™ website and workspace. Your BIRI™ account is covered by the privacy policy at biri.blue.
1. Who we are
Foundry by BIRI™ ("Foundry") is operated by Planetary.Blue ("Planetary.Blue", "we", "us", "our"), a company registered in Singapore. Planetary.Blue is responsible for personal data collected through Foundry.
This policy is written to meet our obligations under Singapore's Personal Data Protection Act 2012 (PDPA) and, where they apply, the EU and UK General Data Protection Regulation. "Personal data" means data about an individual who can be identified from that data, or from that data together with other information we have or are likely to have access to.
2. Summary
We hold the account details BIRI passes to us when you sign in, the work you and your colleagues do in Foundry, and the technical records needed to run it. We use them to provide Foundry and keep it secure.
We do not sell personal data, and we do not run advertising, analytics or session recording in Foundry. Your project's documents can be seen only by the people on that project. When you use the chat, parts of your documents go to the AI provider you chose, and keywords from your question go to BIRI.
3. Personal data we hold
| Category | What it includes |
|---|---|
| Account details | Your name, email address and BIRI user identifier, passed to us by BIRI when you sign in, and an access token that lets Foundry search BIRI for you. The token is stored encrypted. |
| Your work | Documents you write, comments and replies, the passages they refer to, project names, and the steps, requirements and definitions of done in your projects. |
| Your actions | Who ticked a requirement and when, who resolved a comment and when, and each decision on a step, with the name, time and reason. A decision is kept as a permanent record of the project. |
| Project membership | Which projects you are on, and your role on each. |
| AI settings | The providers you connect, their names and addresses, your API keys, the models you choose, and the results of connection tests. API keys are stored encrypted. |
| Search index | Passages of your documents, and numeric representations of them, kept so that search and the chat can find them. |
| Technical records | Session records linking your browser to your sign-in, and server logs that may include your IP address, the pages requested and the time. |
Foundry does not store your chat conversations. A conversation exists in your browser and clears when you leave the page.
4. What we do not do
- We do not sell personal data, or disclose it for the marketing of others.
- We do not run advertising, analytics, or session recording in Foundry.
- We do not use your documents to train artificial intelligence models, and we do not sell them to anyone who does.
- We do not pay for your AI use or hold a shared AI account: Foundry uses the key you provide.
- We do not use personal data or payment to influence a BIRI rating. Foundry shows a rating exactly as BIRI returns it.
5. How we use personal data
We use personal data only for purposes a reasonable person would consider appropriate in the circumstances:
- To provide Foundry: signing you in, showing you your projects, saving and syncing your work, and running search and the chat.
- To keep a record of a project: showing who did what, as the project's owner and team expect.
- To secure Foundry: controlling access, and detecting and investigating misuse.
- To support you: answering enquiries and telling you about changes to the service or this policy.
- To meet legal obligations.
Under the PDPA we rely on your consent, on consent deemed given when you voluntarily provide data for an evident purpose, and on the exceptions the Act permits. Where the GDPR or UK GDPR applies, our legal bases are the performance of our contract with you, our legitimate interests in operating and protecting Foundry, compliance with legal obligations, and consent where it is required.
6. Who can see your work
Your documents, comments, steps and decisions can be seen by the people on that project, according to their role. Your name and email address can be seen by the others on your projects. An administrator of Foundry gets no access to a project they are not on.
Our own staff can reach the servers that run Foundry, so that they can operate and repair it. They do so only when needed for those purposes.
7. AI providers and BIRI
You choose your own AI provider, using your own account and API key. We use your key only to send your requests to that provider.
- Your AI provider. When you ask the chat a question, your question, recent turns of the conversation, the passages Foundry finds in your project's documents and any BIRI references are sent to the provider you chose. That provider's own terms and privacy policy govern what happens next, so please read them before connecting it.
- BIRI. Foundry consults BIRI on every chat question. Keywords taken from your question are sent to BIRI with your access token, use one of your BIRI searches, and are recorded by BIRI. The text of your documents is not sent to BIRI.
9. Disclosure to others
We disclose personal data only in these circumstances:
- Service providers. We use a hosting provider to run Foundry. It may process personal data only to provide its service.
- At your direction. When you connect an AI provider, or add someone to a project.
- Legal and regulatory. Where required by law, court order or a lawful request from a competent authority, or to establish, exercise or defend legal claims.
- Protection. Where we reasonably believe it is necessary to prevent fraud, abuse or a threat to anyone's safety.
- Corporate transactions. In a merger, acquisition, financing or transfer of assets, where the recipient must honour this policy and we will tell you of any material change.
10. International transfers
Our service providers, and the AI provider you choose, may store or process personal data outside Singapore, including in countries whose data protection laws differ from your own.
Where we transfer personal data out of Singapore, we take reasonable steps to satisfy ourselves that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on adequacy decisions or approved standard contractual clauses.
11. Security
We make reasonable security arrangements to protect personal data. These include checking access on every request, limiting each person to the projects they are on, and encrypting API keys and BIRI access tokens when stored. Your session is stored only as a hash.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in and API keys confidential. If you believe your account has been compromised, or you find a security problem, please contact us straight away. If a data breach is likely to result in significant harm, we will notify affected individuals and the Personal Data Protection Commission as required by law.
12. How long we keep personal data
We keep personal data only for as long as it is needed for the purposes in this policy, or as the law requires.
| Type of data | How long |
|---|---|
| Account details | For as long as you use Foundry, and for a limited period afterwards to resolve disputes and meet legal obligations. |
| Your work and the project record | For as long as the project exists. If you leave a project, your name stays on what you did there, because it is part of that project's record. |
| AI settings | Until you remove the provider in Settings, or your account is closed. |
| Search index | Updated as documents change, and removed with the document. |
| Sessions | Up to 14 days, or until you log out. |
| Server logs | For a limited period appropriate to security monitoring. |
13. Your rights and choices
Subject to the exceptions permitted by law, you may ask to access the personal data we hold about you, correct it, withdraw consent, and close your account and ask us to delete your personal data. Your name and email come from your BIRI account, so please correct those there.
If you are in the European Economic Area or the United Kingdom, you also have the right to erasure, to restrict processing, to object to processing based on our legitimate interests and to data portability, and you may complain to your national supervisory authority.
Foundry does not yet have a self-service way to delete an account or a project. To exercise any of these rights, write to privacy@planetary.blue. We may need to verify your identity. We aim to acknowledge requests within ten business days and to respond in full within thirty days, and if we decline a request we will explain why. If you are not satisfied, you may contact the Personal Data Protection Commission of Singapore.
14. Personal data in your documents
The documents you write may contain personal data about other people. You and your organisation are responsible for having the right to put it in Foundry, and for deciding who you add to a project. If you use the chat, remember that passages of those documents go to your AI provider.
15. Children
Foundry is intended for researchers, professionals and organisations, and is not directed at children. We do not knowingly collect personal data from anyone under the age of majority in their jurisdiction without appropriate consent. If you believe a minor has provided us with personal data, please contact us and we will delete it.
16. Changes to this policy
We may update this policy to reflect changes to our practices, to Foundry or to the law. The date at the top of this page shows when it was last revised. Where a change is material, we will give notice through Foundry or by email before it takes effect.
17. Contact us
Questions, requests and complaints about personal data should go to our Data Protection Officer:
Data Protection Officer, Planetary.Blue
Email: privacy@planetary.blue
Registered address: to be supplied, Singapore
For anything else, see our contact page.