Skip to content
Setup FoundrySetup Foundry
DESign in

Privacy Policy

Controller
Steidl IT GmbH
Hervicusgasse 19/2/15
1120 Vienna, Austria
Email: office@setupfoundry.com

This policy covers the websites setupfoundry.com, docs.setupfoundry.com and download.setupfoundry.com and the customer account at account.setupfoundry.com. A separate privacy policy applies to the Setup Foundry desktop software. You will find it in the software under "Help → Legal"; the software presents it for you to read when you first start it. If you would like to read it before installing, write to office@setupfoundry.com and we will send it to you.

When you visit this website
Each time a page is requested, your browser necessarily transmits data to our server: IP address, date and time, the address requested together with the method and protocol, the status code, the volume of data transferred, the page previously visited (referrer), browser and operating system identifiers, and the response time. Our server records this in access logs in order to keep the service secure and to detect attacks (Art. 6(1)(f) GDPR). The logs are rotated daily; a rotated log is deleted once it is more than 30 days old — that is, at the latest about one month after the visit.

As long as parts of our sites are open only to admitted visitors, we record every request to the admission address through which an access key is redeemed in a separate admission log: date and time, IP address, the site requested (for example download.setupfoundry.com) and the result (admitted, rejected, or temporarily slowed down after too many failed attempts) — never the key itself. This lets us detect attempts to guess keys and slow them down (Art. 6(1)(f) GDPR). These requests do not appear in the general access logs. Admission through your customer account (section "Access to downloads and documentation") does not appear in this log. The admission log is rotated daily; a rotated log is deleted once it is more than 14 days old.

This website uses no analytics and no advertising services, and embeds no third-party content. All content, including fonts, is served from our own server; visiting the site transfers no data to third parties.

Access to downloads and documentation
You reach the beta downloads and documentation after signing in to your customer account, if a valid beta licence is assigned to your account. For this, the account hands our access service a random identifier that is valid only once and only for one minute. With it the access service learns the licence numbers of your account, checks them with our licence server and sets this cookie:

  • site_access — a signed token stating that you may be admitted. It contains an identifier of the beta licence through which you were admitted, which makes it attributable to you; it never remains valid longer than that licence.

It is protected against access by scripts (HttpOnly) and is transmitted only over an encrypted connection (Secure). It is renewed each time you are admitted and expires by itself if you do not return for a longer period. It is strictly necessary for the access you requested (§ 165 para 3 Austrian Telecommunications Act 2021, Telekommunikationsgesetz 2021, TKG 2021) and therefore requires no consent; the associated processing is based on the contract for using the account and the performance of your participation in the test programme (Art. 6(1)(b) GDPR).

We will update this section when the beta ends.

Cookies and local storage
Apart from that, on the website we store only your display and language preferences, all only for our own sites under setupfoundry.com:

  • sprache — a cookie holding the language version you have chosen (de or en). It is created only when you switch languages, and makes sure you see the sites in your language on every visit. As long as you do not switch, no cookie is set; which version you see first then follows from your browser's language setting alone. The cookie is strictly necessary for the display you expressly chose (§ 165 para 3 TKG 2021) and requires no consent; the associated processing rests on our legitimate interest in a working multilingual site (Art. 6(1)(f) GDPR).
  • sf_farbe — a cookie holding the display you have chosen (light or dark). It is created only when you change the display with the switch in the page header, is valid for one year and for all our sites under setupfoundry.com, so that you see the same display on each of them. As long as you do not switch, no cookie is set; the site then follows your device's setting. The cookie holds only this value and no identifier relating to you; your browser sends it with every request to our sites, and we use it for nothing but the display. It is strictly necessary for the display you expressly chose (§ 165 para 3 TKG 2021) and requires no consent; insofar as personal data is processed, this rests on our legitimate interest in showing you the display you chose on all our sites (Art. 6(1)(f) GDPR).
  • Light/dark display — entries in your browser's local storage (fnd-web-modus, vitepress-theme-appearance, foundry-theme-modus). They record how you want the site displayed, are never transmitted to us and contain no identifier relating to you; they are strictly necessary for the display you requested (§ 165 para 3 TKG 2021).

You can delete all of these at any time in your browser; the sites work without them. No cookies are set for advertising or analytics, and there is no tracking pixel. What the customer account stores is set out in the next section.

When you use a customer account
In your customer account at account.setupfoundry.com you see your licences and orders, assign licences, download the software and manage your settings.

Registration and sign-in. For an account we only need your email address; you may add your first and last name in the account if you wish. Without an email address we cannot run an account for you. There is no password: you sign in at www.setupfoundry.com/en/anmelden, and we send you an access code by email that is valid for ten minutes. Until you enter it, we keep your email address, the access code and any beta code you entered only in your sign-in session on our server; we check a beta code with our licence server. We create a new account only once you have entered the code from the email, and during the beta only with a valid beta code; we assign its beta licence to your account in the same step. If you already have an account, we add the beta licence of a valid beta code to it. If you do not redeem the code, these details lapse with the session, after 14 days at the latest. The legal basis is the performance of the contract for using the account and, before it is concluded, steps taken at your request prior to entering into it (Art. 6(1)(b) GDPR). To limit misuse, we briefly count requests per IP address and per email address, and checks of a beta code per IP address and per code. For this we keep only a check value derived from them, not the details themselves; the counters expire after 24 hours at the most, and we delete them no later than one day after that (Art. 6(1)(f) GDPR). We do not store an IP address or browser identifier with your account.

Cookies and local storage in the account.

  • csrftoken: a security cookie that protects our forms against requests that another site tries to trigger in your name. It is set on your first visit and is valid for one year, only for account.setupfoundry.com.
  • sessionid: keeps you signed in. It is created as soon as you request an access code and is valid for 14 days or until you sign out; scripts cannot read it.
  • sprache: a cookie with the language you chose. It is only created when you switch the language, is valid for one year and for all our pages under setupfoundry.com, including the website. The same value is kept in your browser's local storage.
  • sf_farbe: a cookie with the display you chose (light or dark). It is only created when you switch the display, is valid for one year and for all our pages under setupfoundry.com, including the website.
  • foundry-theme-modus: in local storage, records whether you chose the light or dark display; it is not sent to us.

These entries are strictly necessary for the account you asked for (§ 165 para 3 TKG 2021) and do not require consent. The processing is based on the contract for sessionid (Art. 6(1)(b) GDPR) and on our legitimate interest in a secure, multilingual account for csrftoken and sprache, and in keeping the display you chose for sf_farbe (Art. 6(1)(f) GDPR). The account does not load content from third-party servers and sets no cookies for advertising or analytics. If the customer account is accessible only by invitation, the cookie described in "Access to downloads and documentation" applies to it.

Access logs. The same applies to the account as to the website (section "When you visit this website"): logs with IP address, deleted after 30 days.

Licences. Your licences are managed by our licence server, a separate service on our server. For each licence it stores the holder's name and email address and the licence data. To show you your licences and downloads, the account queries it with your email address; licences issued to that address therefore appear in your account. If you assign a licence to your account using the licence number and the email address of your purchase, we store the assignment with that address and the time. We record every assignment attempt, including unsuccessful ones, with the time and the number entered, in order to detect misuse. The legal basis is the contract for using the account (Art. 6(1)(b) GDPR) and, for recording attempts, our legitimate interest in the security of licences (point (f)).

News by email. If you consent in the account to receive news from us, we store your consent with the time, language, the wording you agreed to and the route by which you consented, so that we can prove it (Art. 6(1)(a), Art. 7(1) GDPR). You can withdraw it at any time in the account; we also record the withdrawal with its time. We are not sending any such emails at present.

Cancelling and withdrawing without signing in. You can cancel a subscription or withdraw from a contract without signing in. We then store the details of your declaration (name, email address, order number, type and date of cancellation, any reason given, the address for the confirmation, language and time of receipt) and send the confirmation of receipt to the address you give. If the declaration belongs to an order with a different email address, we also inform that address. To limit misuse, we briefly count how many declarations arrive from the same IP address and for the same email address. For this we keep only a check value derived from them, not the addresses themselves; the counters expire after one hour (IP address) and 24 hours (email address) respectively. If a limit is reached, we still accept your declaration; only the confirmation by email is then sent after a check. Only if a very large number of requests arrives from the same IP address within one hour do we temporarily refuse further ones; you can then write to us by email. Declarations relating to an order are kept like the order records; declarations that we cannot match to any order, together with our confirmation of them, are deleted once it is clear that they do not concern a contract with us, and at the latest three years after the end of the calendar year in which we received them (Art. 6(1)(b), (c) and (f) GDPR).

How long we keep account data. We keep account data until you delete your account. Sign-in sessions end after 14 days or when you sign out; expired sessions are removed daily. The identifiers with which the account admits you to downloads and documentation are valid for one minute and only once; we delete them after one day. Access logs are deleted after 30 days. Copies of our emails containing access or deletion codes are deleted after 14 days at the latest. Assignments and assignment attempts relating to your account are kept as long as the account exists; attempts not linked to an existing account are deleted twelve months after the attempt. Deleted data may remain in our backups for up to one year; after that it is gone from them as well. Order records are kept for ten years (see "When you buy a licence").

Deleting your account. You can delete your account yourself at any time in the account under "Delete account"; you can also ask us to delete it by writing to office@setupfoundry.com. We then delete your account data, your consent to receive news and the assignment of your licences, and on the licence server your name and email address, unless a purchased licence is linked to them. If you have bought from us, the order records are kept until the end of the retention period and used only for that purpose and for questions about these orders; the account itself is then changed so that it can no longer be linked to you. Until our licence server has confirmed the deletion, we keep your previous email address in a note so that we can complete the deletion there; we then delete this note as well.

When you buy a licence
You buy licences for Setup Foundry in your customer account at account.setupfoundry.com. Your contracting party for the software and the licence is Steidl IT GmbH. Payment, invoicing and VAT are handled by Sold through Link, LLC (United States), a company of the Stripe group, as merchant of record: Sold through Link, LLC accepts your payment and issues the invoice to you in its own name; the invoice shows "Sold through Link, LLC" as the issuer and Steidl IT GmbH only next to the product.

What we process ourselves. For your order we store your email address, the name for the licence record, the edition and term you chose, language, amount, order number and times, your two declarations about starting before the withdrawal period ends and, if you entered into it, the agreement on the pre-release version (early access), each with the time and the version of the text you agreed to. After payment we issue your licence through our licence server and send you the confirmation by email. For each payment and each renewal we record the invoice number, the amount, the country given at checkout and any refunds, as well as when and how a subscription ends. We keep a copy of the emails we send you about your order. The details in your order and at checkout are required for the purchase; without them we cannot conclude the contract. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); we also keep the copies of the emails so that we can prove that we have met our statutory obligations (points (c) and (f)).

What Stripe receives from us. So that you can pay, we send the Stripe group your email address, the order number, the product you chose and the language (Art. 6(1)(b) GDPR). The recipient is Stripe, LLC in the United States. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, in which Stripe, LLC participates; as a fallback, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).

What Link collects itself. You enter your payment details and the other checkout details directly with Link. Link processes them as an independent controller, for payment, invoicing, VAT, fraud prevention and support for payments and subscriptions; Link sends you receipts and invoices itself. Which Stripe company is responsible for you, on what basis your data is transferred to the United States in the process and how long Link keeps it is set out in Link's privacy policy at link.com/privacy.

What we receive from Link. Link tells us whether and how much you paid and whether a payment was refunded or charged back, together with the details you gave at checkout: name, email address and country and, if you provide them, billing address and VAT ID. We do not receive your full card number or the card security code. If you pay by card, we see the card brand and type, the last four digits, the expiry date, the country in which the card was issued and technical details of the payment, such as the result of the card check. We use these details to issue your licence, renew it or block it after a refund or chargeback, and to answer your questions about the order (Art. 6(1)(b) GDPR). Issuing, renewing and blocking happen automatically as soon as Link reports the payment, the refund or the chargeback to us; a licence likewise ends automatically when its term runs out. If you think such a decision is wrong, write to us at office@setupfoundry.com; a person will then review the case, and you can put forward your point of view (Art. 22(2)(a) and (3) GDPR).

VAT ID. If you enter a VAT ID at checkout, Link checks whether it is valid. If Link charges VAT at checkout, we issue the licence right after payment. If Link does not charge VAT, we only issue the licence once the number has been confirmed; if it is not confirmed, we cancel the order and refund the full amount (Art. 6(1)(b) GDPR). This happens automatically as soon as Link reports the result of the check to us. If you believe your number is valid, write to us at office@setupfoundry.com; a person will then look at your case.

How long we keep order records. We keep the details of your order, your declarations, the payment notifications, the copies of our emails, our correspondence about the order and Stripe's monthly settlement reports for ten years from the end of the calendar year to which they relate. The statutory basic period is seven years (§ 132 Austrian Federal Fiscal Code, BAO; § 212 Austrian Commercial Code, UGB); however, the tax authority can assess taxes for up to ten years after they arise (§ 209(3) BAO), and while proceedings are pending we keep the records beyond that (Art. 6(1)(c), Art. 17(3)(b) and (e) GDPR). If you delete your account, these records are kept until the end of the period and used only for that purpose and for questions about these orders; then we delete them.

Change ahead. We plan to take over sales ourselves in future. Steidl IT GmbH will then also be the seller and issue the invoice, and Stripe will only process the payment. We will update this section before we switch.

When you write to us
We process the details you give us and the content of your message in order to deal with your enquiry (Art. 6(1)(b) GDPR where it concerns an order, otherwise Art. 6(1)(f)). Messages relating to orders are kept for as long as the other order records (ten years, see "When you buy a licence"); all others are deleted once the matter is closed and no further questions are to be expected. Providing your details is voluntary; without them, however, we cannot reply to you.

When you sign up for news
On setupfoundry.com you can enter your email address to receive information about Setup Foundry from us by email: about its development, invitations to the beta, the release of new versions and offers to buy it. We write to you when there is something new, such as an invitation to the beta or the start of sales, at most once a month. We only write about Setup Foundry itself, no third-party advertising, and we do not pass your address on. Signing up does not give you access to the software.

For this we store your email address, the language, the time of your sign-up and of your confirmation, the wording you agreed to and the page on which you signed up. We do not store an IP address for this; the access logs are covered by the section "When you visit this website". To protect the form against misuse, we briefly count how many sign-ups arrive from the same IP address and for the same email address; for this we keep only a check value derived from them, which expires after one hour or 24 hours respectively. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021, Telekommunikationsgesetz 2021, TKG 2021); we store the details of your consent in order to be able to demonstrate it (Art. 7(1) GDPR).

You are on the list only once you click the link in the email we send you after signing up. The link is valid for 14 days; if you do not confirm, we delete the entry automatically after that.

You may withdraw your consent at any time and object at any time to the use of your address for our news: using the unsubscribe link at the end of every email or by writing to office@setupfoundry.com. This does not affect the lawfulness of the processing up to that point. After you unsubscribe we will not write to you again. We keep a record that you signed up and unsubscribed for three more years, because an offence under the Telecommunications Act becomes time-barred only after three years, and use it only for that purpose; after that we delete it.

We send the emails through our email service Google Workspace (see "Who else receives the data"). We do not measure whether or when you opened an email or clicked a link in it, and we use no tracking pixel for that purpose.

When you use our contact form
You can write to us using the contact form at www.setupfoundry.com/en/kontakt. For this we need your email address and your message; you may give your name, but you do not have to. We use these details to deal with your enquiry, on the same legal basis as for any message to us: Art. 6(1)(b) GDPR where it concerns an order or an enquiry before an order, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)). The form passes your details to our own service at account.setupfoundry.com, which runs on the same server as this website. It forwards them, with the date, the time and the language of the page, by email to our mailbox office@setupfoundry.com, using our email service Google Workspace (see "Who else receives the data"); your address is set as the reply address. We do not send you a copy or a confirmation of receipt. We do not store the message on our server, not even if sending fails. As soon as you first move into a field, the page fetches a token from the same service that lets us recognise messages sent too quickly by machines; no cookie is set. These requests appear in the access logs like any page request (section "When you visit this website"). To protect the form against misuse, we count how many messages arrive from the same IP address and, if there are too many within one hour, temporarily accept no more (Art. 6(1)(f) GDPR). For this we keep only a check value derived from the IP address, not the address itself; it expires after one hour and is deleted no later than one day after that. We keep the email with your message and our replies like other messages to us (section "When you write to us"); if they do not concern an order, we delete them no later than six months after the last message on your matter. Providing your details is voluntary; without an email address and a message, however, we cannot reply to you. Your rights, including the right to object, are set out below under "Your rights".

Who else receives the data

  • Andreas Steidl, sole proprietor, Hervicusgasse 19/2/15, 1120 Vienna, Austria — operation and hosting of these websites, the customer account and the licence server on behalf of the company, processor (Art. 28 GDPR). For this he uses server infrastructure of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, as a sub-processor, with further sub-processors of the Anexia group in Austria and Germany; the processing takes place at the data centre in Vienna. No processing outside the European Union takes place in this context.
  • Google Cloud EMEA Limited, Dublin, Ireland — email service (Google Workspace), processor; we also use it to send all emails of the customer account, such as access codes and confirmations. Google may also process data in the United States; the basis for this is the European Commission's adequacy decision on the EU-US Data Privacy Framework, supplemented by standard contractual clauses.
  • Stripe, LLC and Sold through Link, LLC, both United States, companies of the Stripe group: payment, invoicing and VAT when you buy a licence; Sold through Link, LLC as merchant of record and independent controller. Details under "When you buy a licence".

Your rights
You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). A message to office@setupfoundry.com is sufficient; we will reply within one month.

Right to object (Art. 21(1) GDPR)
Where we process data on the basis of legitimate interests (this concerns the access logs, the admission log, the language cookie, the display cookie, the security cookie in the customer account, the recording of assignment attempts, the counters against misuse and messages outside an order), you may object at any time on grounds relating to your particular situation.

Right to lodge a complaint
You may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Changes
If our processing changes, we will update this policy. Last updated: 28 October 2026.