Privacy

Version 1 · November 2026

This notice says what personal data FoldOS Limited collects, why, who else handles it, how long it's kept, and what you can ask us to do. Fold isn't open to hosts yet. This notice also covers how Fold will handle data once it is, so hosts, guests and crew can read it before they use Fold.

Who we are

FoldOS Limited ("Fold", "we", "us") makes Fold, software that people who run retreats, teacher trainings and other multi-day experiences ("hosts") use to take bookings and look after their guests and crew. We are a company registered in England and Wales, company number 17557133. Our registered office is 28 Leconfield Road, Lancing, England, BN15 9JB. For anything about your data, email hello@foldos.app.

Our two roles

• When you visit this website, write to us, or sign up to Fold as a host, we decide what happens to your data. In data protection law we are the "controller".
• When you book with a host, or work on a host's retreat as crew, the host decides what happens to your data. The host is the controller, and Fold holds and processes the data for them, on their instructions, under a data processing agreement in our terms with hosts. For questions about that data, ask the host first. We will help them answer.

This website

• This website sets no cookies and uses no analytics or tracking.
• Our hosting provider records basic details of each visit (your IP address, the page asked for, your browser's description and the time) to run the site and keep it secure, and keeps them for a short time. Our lawful basis is our legitimate interest in running a secure website.
• Once Fold is open, its apps use only the cookies they need to work, such as keeping you signed in. Any analytics is loaded only if you say yes.

When you email us

We use your name, email address and what you write to answer you. Email sent to a foldos.app address is forwarded to our mailboxes. We keep correspondence for up to two years after we last hear from you, unless we need it longer for a legal claim. Our lawful basis is our legitimate interest in answering you.

Hosts

When a host signs up, we keep the owner's and team's names, email addresses and phone numbers, the business's details, sign-in records, and the host's Fold plan and invoices. We use them to provide Fold, bill the plan, give support and keep accounts secure. Our lawful basis is our contract with the host, and our legal duty to keep financial records. A host's card for the Fold plan is held by Stripe, never by Fold.

When a host closes their account, they can export their data first. We delete their personal data 90 days after the account closes. Payment records, receipts, records of what people agreed to and our security log are kept for as long as UK law requires, usually six years.

Guests and crew of a host

Fold holds this data for the host, and the host decides how it's used. Depending on what the host uses, it can include:

• your name, email address and phone number
• your booking, what you've paid and what's still due. Card details are held by Stripe for the host. Neither Fold nor the host ever sees your full card number.
• your flights, food choices and allergies
• a health note, only if you choose to give one. It is shared with the retreat team so they can look after you, and deleted 30 days after the retreat ends.
• your profile, photos and posts within the retreat. You choose whether other guests can see your profile, and you can ask for any photo of you to be taken down.
• messages between you and the host, by email, WhatsApp, Instagram or the portal
• for crew: contracts, waivers and paperwork such as visas and insurance. Paperwork is deleted 90 days after a crew member's last retreat unless the host keeps it.
• records of what you agreed to (terms, waivers and consents), with the time

WhatsApp and Instagram

A host can connect their own WhatsApp Business number or Instagram account to Fold. Messages between you and the host then pass through Meta's platform and are kept in Fold, so the host can read and answer them in one inbox. Fold uses these messages only to show them to the host, send the host's replies and sort them for the host. Fold doesn't use them for advertising and never sells them. Meta's own privacy policy covers what Meta does with them.

AI

Fold can suggest a draft reply, or sort incoming messages, using an AI provider that works for us under a data processing agreement. A person always reads a draft and decides whether to send it. A letter written by AI after a retreat says so, and it reads a guest's private journal only if the guest says yes. Fold makes no automated decisions that have legal or similarly significant effects on anyone.

Who else handles data for us

We use these companies to run Fold. Each may only use the data to do that work:

• Supabase: our database and sign-in, in London
• Vercel: hosting for this website and Fold's apps; our code runs in London
• Resend: sending and receiving email, in Ireland
• Sentry: error reports, in the EU
• Cloudflare: our domain and email forwarding
• Google: our mailboxes
• Stripe: payments. Guests pay into each host's own Stripe account, and Stripe is responsible for card data.
• Meta: WhatsApp and Instagram messages, when a host connects them
• an AI provider, which we'll name here once it is chosen

We never sell personal data.

Data outside the UK

Fold's database is in London. Some of the companies above are based in the US or handle data there. When personal data leaves the UK, it's protected by the UK's data bridge with the US, or by the UK's approved contract terms for international transfers.

Keeping data safe

Data is encrypted on its way to and from Fold. Each host's data is kept apart from every other host's. Fold staff look inside a host's account only when the host asks for help, and every look is logged where the host can see it.

Your rights

You can ask for a copy of your data, and ask us to correct it, delete it, limit how it's used, stop using it, or send it to you in a format you can take elsewhere. Where we use your data because you said yes, you can change your mind at any time. Email hello@foldos.app. We answer within one month. If the data belongs to a host's records, we pass your request to the host and help them answer.

Deleting your data

To ask us to delete your data, email hello@foldos.app from the address we know you by, and say what you'd like deleted. A host can also disconnect WhatsApp or Instagram from Fold at any time, and close their account. We confirm when it's done. We delete within 30 days, except records the law makes us keep. If the data is held for a host, we pass your request to them, as above.

Complaints

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

Changes

We'll update this notice as Fold changes, and show the version and date at the top.