Privacy and subprocessors.
Version 1.2, effective 17 August 2026. Questions: hello@foundationcollective.co.uk
Who we are
Restated is operated by Restated Ltd (company number SC790998), a company registered in Scotland whose registered office is 13 Corskie Park, Dunecht, AB32 7AE, part of the Foundation Collective group (Foundation Collective Limited, company number SC695110, at the same address). We are the data controller for our website and account management, and typically the data processor, acting on your instructions, for content you submit to the service as a subscriber. Contact us at hello@foundationcollective.co.uk.
What we collect
Account details (name, email, organisation), authentication and session data, subscription and usage records (payment card details are handled by Stripe and never stored by us), and the content you choose to submit: briefs, brand materials, documents you attach to a generation, and the outputs generated for you.
AI processing: the commitments that matter
Content you submit is processed by our AI provider (Anthropic) solely to generate your outputs, under a paid API agreement: it is not retained by them for, or used in, model training. We never use your content to train models, never sell personal data, and never share it with advertisers.
Documents attached to a generation are extracted to text for that job and purged from our systems within 48 hours. Generated artifacts remain in your library under your organisation's control until you delete them. Ringfenced deliverables go further: content typed into a sealed vessel never touches our servers or any AI system at all. The file's certificate explains how to verify that yourself.
Subprocessors
These third parties process data on our behalf to deliver the service. We give active subscribers at least 30 days' notice of changes to this list, by email and by updating this page.
| Subprocessor | Purpose | Processing location |
|---|---|---|
| Anthropic PBC | AI generation: powers content and design generation | United States (paid API; inputs are not retained for or used in model training) |
| Supabase Inc. | Database, authentication, file storage | Frankfurt, Germany (EU) |
| Netlify Inc. | Application hosting and delivery | EU compute (Frankfurt region functions); global CDN |
| Hetzner Online GmbH | Design rendering workers for premium generations | Nuremberg, Germany (EU) |
| Stripe Payments UK, Ltd | Payment processing and subscription management | United Kingdom |
| Resend Inc. | Transactional email delivery | EU endpoint |
| GitHub, Inc. | Versioned storage of brand-skill content synced into the service | EU/US (content authored by Foundation Collective, not client document uploads) |
Retention
Account information: for the life of your account plus 30 days. Attached documents: extracted text purged within 48 hours of the generation completing. Generated outputs and brand materials: until you delete them or your organisation is closed. Billing records: as required by tax law.
Your rights
UK and EU data protection law gives you rights of access, rectification, erasure, restriction, portability and objection. Write to hello@foundationcollective.co.uk and we will respond within one calendar month. You may also complain to the ICO (ico.org.uk).
The rest of the pack
Our data processing terms set out our obligations as your processor in full, including the security measures we apply and how international transfers are protected. They apply automatically to every subscription; a countersigned copy is available on request. The commercial relationship is governed by the subscriber terms.