What we collect. Why we collect it.

Who we are

Minnow IT Ltd, a company registered in England and Wales, company number 07970411, with its registered office at Bristol and Bath Science Park, Dirac Crescent, Bristol BS16 6TH, United Kingdom. Throughout this page, “we”, “us” and “Foldr” mean Minnow IT Ltd.

What this page covers

It covers the marketing website at foldr.com and the Foldr SaaS service at app.foldr.com and any customer subdomains we operate. It does not cover Foldr Appliance deployments running on a customer’s own infrastructure; the customer is the data controller for their own appliance and we have no operational visibility into it.

Data we collect from the marketing site

• Forms you submit, such as trial sign-up, demo requests and contact emails. We use the information to reply to you.
• Standard server logs, including IP address, request path and timestamp. Used for security and to size capacity.
• Theme preference, stored in your browser’s localStorage. Never sent to us.

The marketing site does not run third-party analytics or advertising trackers.

Data we collect from Foldr SaaS

• Account information: name, email, role, the organisation you belong to. Provided when an account is created.
• Authentication metadata: when you logged in, from where, which method (SSO, password, passkey). Used for security and audit.
• File and folder metadata: paths, sizes, modified dates, custom field values. Used to render the product surface.
• Activity log: which user did what to which file, kept per share for audit.
• Search index: extracted text from files inside the connected backends, stored so search returns results in milliseconds.

We do not read the bytes of your files outside the indexing and conversion pipeline that you have configured. Files are not used to train any model, ours or anybody else’s.

Data we collect through Grace and AI features

When Grace, Captur or any other AI-backed feature is enabled, the questions and file content needed to answer them are processed through AWS Bedrock, which invokes Anthropic Claude foundation models. Per Bedrock service terms, prompts and completions are not used to train any model and are not shared with the foundation model provider. The default Bedrock routing is US-region; EU-only routing is available on request. Anthropic is not a Foldr sub-processor; Bedrock (AWS) is. Foldr respects the customer’s configured opt-out for any AI processing. The current sub-processor list is on the Trust Centre.

Where data is stored

Foldr SaaS data is stored in the United Kingdom and the European Union, on infrastructure operated by us. Backups are encrypted and held in the same region as the primary store.

How long we keep it

• Marketing form submissions: up to 24 months after last contact.
• Server logs: 90 days.
• SaaS account data and file metadata: for the lifetime of the account, plus 30 days after closure for recovery.
• Search index: rebuilt continuously; deleting a file removes it from the index within minutes.
• Activity log: retained per the customer’s configured policy.

Your rights

Under UK GDPR and the Data Protection Act 2018 you have the right to access, correct, export and delete personal data we hold about you. For the marketing site, write to [email protected]. For SaaS, contact your administrator first; they can fulfil most requests directly inside the product. If you’re unhappy with how we handle a request, you can complain to the Information Commissioner’s Office at ico.org.uk.

Sub-processors

Foldr SaaS uses a small set of sub-processors for hosting, email delivery and (when enabled) AI processing. The current list is available on request and is included in the signed DPA.

Changes

We’ll update this page in place when policy changes. Material changes are emailed to administrators of active SaaS customers.

Questions

Anything unclear? Email [email protected] and a human will reply.