# ETP Foundry: privacy notice

**Draft v0.2, pending counsel review, 19 October 2026**

> **In short.** We collect only what we need to run the service: access requests, your sign-in identity, your account settings, hashes of your API keys, your conversations with the in-console assistant (deleted after 90 days), audit events and server logs. No analytics, advertising or tracking. Data is held in Google Cloud in the United States. Ledger records are permanent but identify parties by Canton party identifier, not by name. You can ask to see, correct or delete your data at hello@etpfoundry.com.

> **What changed from v0.1.** Wording only: the examples and the reasons for keeping records now describe the fund model (signing a fund action rather than confirming a fixing), and the record rule is referenced to the Methodology and Rulebook currently in force. What we collect, where it is kept, how long, and your rights are unchanged.

This notice explains what personal information ETP Foundry collects through etpfoundry.com, the signed-in desk, the public API and the hosted MCP, why, where it is kept, and what your rights are. It is written for Canada's *Personal Information Protection and Electronic Documents Act* (PIPEDA).

## 1. Who we are

**Lucilla, Inc., federal corporation no. 16699448, Toronto, Ontario, trading as ETP Foundry** ("we"). We are responsible for the personal information described here. Privacy contact: **hello@etpfoundry.com** (subject line "Privacy").

## 2. What we collect

| Data | Where it comes from | Why we hold it |
|---|---|---|
| **Access requests**: name, e-mail, firm, optional seat and message | The form at /request-access | To reply to you and decide whether to grant access. It is written to the desk's append-only event log so that a request is not lost in a mailbox |
| **Sign-in identity**: Google account e-mail, a Firebase user id, e-mail verification status, provider metadata | Google sign-in through Firebase Authentication (the only way to sign in) | To check your e-mail against the desk's roster of invited users. An address not on the roster is refused, and the refusal is logged |
| **Account settings**: role, seat, per-user settings, signer webhook URLs | Set by us when you are invited, or by you in the console | To run the desk for you |
| **API keys**: a SHA-256 hash of each `ck_` key (never the key itself) and when it was last used | Created by you in the console | To authenticate calls to the API and the hosted MCP |
| **Assistant conversations**: what you type to the in-console assistant, its replies, the steps it took, and your approvals or rejections; a daily usage count | The "Ask the desk" assistant | To show you your history and keep the assistant within its limits. See the AI-use disclosure |
| **Audit events**: actions you take in the desk (for example signing or refusing a fund action, or creating an API key), with your identity | The desk | Fund records must be attributable and kept (Methodology v1.1 §9.4; Rulebook v0.3 §9) |
| **Server logs**: request metadata, IP address, errors, authentication refusals | Google Cloud Logging | Security and operations |
| **E-mail** you send us | Google Workspace | To reply |

We do **not** use analytics, advertising or tracking cookies. The site keeps sign-in state and a few display preferences in your browser's own storage. Nothing is shared with third parties for marketing. We do not collect payment card data or identity documents through the site.

## 3. Where it is kept and who processes it

All desk data is held in Google Cloud, in region `us-central1` (United States). The assistant's messages are processed by Google Vertex AI (location `global`, which may route processing outside the United States). Our service providers are listed in the sub-processor list (etpfoundry.com/documents/subprocessors-v0.2.md). We do not sell personal information.

## 4. How long we keep it

| Data | Retention |
|---|---|
| Access requests and audit events | Kept in the desk's event log, under our seven-year records policy |
| Sign-in identity and account settings | While you have access; deleted on request after that |
| API key hashes | Until the key is revoked |
| Assistant conversations | Deleted automatically **90 days after the last message** in the conversation. You can delete any conversation yourself before then ("Delete this conversation" in the console's conversation history), and we delete any conversation on request. Each deletion, and each automatic purge, is recorded in the audit log by conversation id, never its content |
| Server logs | Google Cloud Logging default (30 days) |

Records written to the Canton ledger (for example, who signed a fund's NAV) are permanent by design and cannot be erased. We keep personal information off the ledger: ledger records identify parties by their Canton party identifier.

## 5. Your rights

You may ask to access or correct the personal information we hold about you, or withdraw consent and ask us to delete it, subject to the records we must keep. Write to hello@etpfoundry.com. We answer within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada.

## 6. Security

See the security overview (etpfoundry.com/documents/security-overview-v0.1.md). If a breach creates a real risk of significant harm, we will notify the affected individuals and the Privacy Commissioner as PIPEDA requires.

## 7. Changes

We keep every version of this notice on file. The date above shows which one is current.