Privacy Policy
Last updated 1 October 2026.
This policy explains the personal data Foyer processes when you use our website, dashboard, website assistant, preview extension and APIs. Foyer is operated by ReachLLM, Inc. (US). Contact us at hello@tryfoyer.ai about privacy or your rights.
Our support and legal-notice address is ReachLLM, Inc., 2261 Market Street, STE 71652, San Francisco, CA 94114, US.
Who is responsible
When a business uses Foyer on its website, that business ordinarily decides why its visitors' information is collected and acts as controller. Foyer processes those interactions on its instructions. The business's privacy notice explains its own purposes and choices. Foyer is responsible for its own account administration, billing, service security and website operations.
Information we process
For customer accounts we process contact and authentication information, account and agent settings, onboarding responses, subscription/payment identifiers and service usage. Stripe handles card payments; our application does not store full payment-card numbers.
For an agent's knowledge we process customer-selected URLs, text extracted from pages, pasted knowledge and instructions, and searchable numerical representations of that content. Public pages can contain personal information. Customers should provide only content they are entitled to use and should avoid unnecessary personal or sensitive information.
When a visitor starts a conversation, we process their messages or live audio, the assistant's responses, conversation identifiers, timing, relevant page/context information and a transcript. We may create a summary and evaluate the conversation to help the customer understand the outcome. If the visitor provides a name, email, phone number or other contact details, those may become a lead or follow-up record.
The cookie and privacy prompt links to this policy, which explains transcript and audio storage. Detailed choices can be reopened from Privacy settings in the footer. Accepting optional cookies is separate from starting an AI conversation. Where recording is enabled, recordings may be retained by the voice provider and copied to Foyer's private audio storage for customer playback. Live speech processing, recording, transcript storage and model training are different activities. The browser's microphone prompt gives device access; it does not replace the website's notice or any legally required recording permission.
Optional visitor choices
The assistant provides separate choices for optional analytics, remembering visitor preferences and, where enabled, sharing checkout details. These choices are off until selected. You can use basic voice or text conversation without accepting them and change your choices through the assistant's privacy controls.
With analytics enabled, Foyer can process page activity, engagement counts, approximate location, device/browser information and an identifier for the customer's analytics. Remembering a visitor allows a browser identifier and relevant context to persist for later visits. Choice records are stored locally so the assistant can respect them. Changing a choice stops the associated future optional processing and clears the relevant remembered browser state; it does not by itself erase records already held by the customer or service. You can separately request erasure.
Sharing checkout details allows the assistant to read contact and cart details to help with an unfinished checkout. It does not authorize calls or texts. Telephone or SMS follow-up requires separate, explicit contact permission; a phone number, an analytics choice or an old inferred permission is not enough to authorize a new call.
Basic service delivery still involves request and security metadata, such as an IP address reaching our hosting services. Local location lookup does not require sending an IP to a separate geolocation API. Hosting or security logs may nevertheless contain request metadata. We do not describe this processing as anonymous merely because it uses an identifier instead of a name.
Our marketing website offers optional PostHog analytics and session replay. PostHog loads only after you accept through Website privacy settings. Replay captures public page layout, navigation and interactions; form inputs, private assistant content and other private areas are masked or excluded. We do not intentionally send names, email addresses, URL query strings or fragments, referrers, network bodies or console logs. Analytics uses an anonymous identifier for the browser tab; we do not identify you by your account or create a person profile. Your accept or decline choice is stored locally for up to 180 days. You can decline or withdraw through the Privacy settings link in the footer. Withdrawal stops future capture and clears the optional identifiers; it does not delete recordings already held. RB2B marketing identification remains off. Historical analytics and recordings remain subject to retention and rights requests. Other scripts installed by a customer's website are controlled by that customer.
The Foyer dashboard separately offers optional PostHog analytics and masked session replay through the Privacy settings link in the footer. The same affirmative choice and 180-day choice expiry apply. Dashboard inputs and customer content are masked, customer media is excluded, and page paths are reduced to general sections without account or conversation identifiers. We use a browser identifier stored locally after consent, without identifying it by email or creating a person profile. Declining leaves normal account use available; withdrawal stops future capture and clears optional identifiers. PostHog processes opted-in analytics and replay through its US Cloud service.
How information is used and shared
We process information to operate the assistant, retrieve relevant knowledge, save conversations and enabled recordings, deliver requested follow-up, administer accounts, bill for usage, maintain service security and meet legal obligations. Customer-requested notifications and webhooks can send relevant data to the customer's chosen destinations.
The services involved depend on the enabled features:
| Service | Purpose |
|---|---|
| Railway | Application hosting and operational logs |
| Supabase | PostgreSQL data, knowledge/search representations, configured authentication and private recording storage |
| ElevenLabs | Voice conversations and associated transcript/recording processing |
| OpenAI API | Knowledge/query embeddings and inference where configured |
| OpenRouter and the selected model provider | Conversation evaluation, routed inference and optional visual assistance |
| Firecrawl | Importing customer-selected web content |
| AgentPhone and its service providers | Optional telephone recovery/follow-up and associated call data |
| Resend | Authentication and customer-requested operational/lead emails |
| Stripe | Payments, subscription and billing administration |
| PostHog | Optional dashboard and marketing analytics and masked session replay after consent, using its US ingestion service |
| Netlify and applicable network/edge services | Marketing-site delivery, request handling and security |
Selected language models may be supplied by Anthropic, OpenAI, Google or another provider available through the configured route. A customer who supplies its own provider account or connects an external integration also determines that destination and its settings. Google Fonts requests on the marketing site disclose connection metadata to that service. The preview extension uses customer authentication and displays the same assistant; its conversation processing follows this policy.
We do not operate a Foyer model-training pipeline using customer conversations. That is not a guarantee about every external provider or customer-configured account: provider training, logging and retention rules depend on the service, contract and settings. Our provider-specific agreement and transfer review is still being completed. We do not currently give a blanket assurance that every configuration meets GDPR requirements.
Legal grounds
Where Foyer acts as controller, we process information as needed to perform a contract with an individual, meet applicable legal duties, and pursue necessary account administration and security interests, subject to the individual's rights. Where the customer is an organization, business contact/account administration may instead rely on legitimate interests. Optional processing that requires consent is based on the relevant choice and can be withdrawn. Customers are responsible for determining and explaining the grounds for their visitor processing, including recording and contact permissions. A browser permission or agreement with a business customer does not automatically supply a legal basis for every visitor activity.
Retention and deletion
For completed conversations created from the rollout boundary, the default retention period is 90 days; account owners can select 7, 30, 90 or 365 days. The setting applies from the rollout boundary shown in the account's privacy settings. Older conversation history is preserved until the owner reviews and separately applies a retention decision. It has not already been deleted by this release.
Expired completed conversations are queued for scoped deletion, including their associated transcripts and recording cleanup. Active or unfinished conversation records are not automatically removed by this completed-conversation cleanup. Provider failures remain pending or require action. Other records, including independent leads/profiles, customer knowledge, billing records, security logs and historical analytics, have separate purposes and retention requirements; the conversation setting is not a universal expiry for all data. The retention schedules for those records are under review. Contact us for the applicable retention criteria and the status of a specific request.
Owners can request scoped export or erasure through the privacy controls. An export may identify recordings that require authenticated download. Erasure status distinguishes local deletion from outstanding provider work. AgentPhone cleanup may require a manual provider step. A submitted request is not a promise that every remote copy has already disappeared.
Backups, restricted security records and records lawfully required for accounting or disputes may remain separately. Their expiry depends on the applicable system and legal requirement. Deletion must be reapplied if affected data is restored. Copies already delivered to a customer's inbox, webhook or downloaded files also require that customer's action.
International processing and security
Foyer uses services in the United States and potentially other countries. Our current database endpoint is in US East; this is not an EU-only service. Storage location does not identify every location from which a provider may access data. Applicable transfer safeguards depend on the entities, services and agreements involved. We are completing that review and do not claim that a generic vendor document establishes an executed transfer agreement for every route.
We use encrypted connections, authenticated customer access, tenant-scoped controls and private recording storage. These measures do not constitute a security or privacy certification. We investigate incidents and provide notices required by applicable law and our effective agreements.
Your rights and contact
Depending on the applicable law, you may request access, correction, erasure, restriction, portability or an objection to processing, withdraw consent and complain to a competent data-protection authority. Some rights have legal conditions or exceptions.
For visitor information, the website business is ordinarily the controller. Foyer will help that business handle requests, and you may contact us directly to identify the appropriate route. For information Foyer controls, email hello@tryfoyer.ai. We may need proportionate information to verify identity and protect other people's data. Where GDPR applies, the responsible controller must respond without undue delay and within one calendar month. A permitted extension requires notice and reasons within that first month. This response deadline does not mean that every requested deletion is automatically complete; a response must explain any lawful exception or remaining work.
Foyer is not designed for use directed at children or for submitting sensitive information without a separately agreed and assessed arrangement. Contact us if such information has been submitted so that we can investigate and respond appropriately.
We may update this policy as the product evolves. Material changes will be announced in-app and by email to active customers at least 14 days before they take effect. Older versions are available on request. Privacy questions: hello@tryfoyer.ai.