Privacy Policy

Effective date: [EFFECTIVE DATE]

This policy explains how [COMPANY LEGAL NAME] ("[COMPANY]", "we", "us") handles personal data when you use Fughetta at [DOMAIN] (the "Service"). For the data in your projects, we act as a processor on your behalf; for account and usage data, we act as the controller.

What we collect

Account data. Your email address and, if you give it, your name. If you sign in with GitHub or Google, we receive your email address and basic profile information from that provider. Passwords are handled by our authentication provider and stored only as hashes.

Workspace data. The workspaces you create or join, your role in each, and invitations you send or receive, including the invitee's email address.

API tokens. Each token's name, prefix, the workspace it's limited to, when it was created, last used, expires and was revoked. We store only a SHA-256 hash of the token itself and can't recover it.

Your Content. The files your agents write to your projects, their configuration, and the output of builds, tests and runs. We process it only to provide the Service. We don't use it to train AI models.

Usage data. For each workspace and project: builds, failed builds, build seconds, bytes synced, tool calls and tool errors per day; recent builds with their time, configuration, worker and outcome; and storage used. We use it to enforce quotas and show you analytics.

Billing data. If you add a payment method, Stripe collects your payment details. We receive and keep a customer id, invoices, amounts, currencies and billing periods, not your card number.

Technical data. Our servers and providers record request metadata such as IP addresses, timestamps and user agents in logs used for security and operations.

Browser storage. The console stores your sign-in session, preferred language and theme in your browser's local storage. We don't use advertising or third-party tracking cookies.

Why we use it

Purpose	Data	Legal basis (where GDPR applies)
Provide the Service: sign-in, workspaces, storage, builds	Account, workspace, tokens, Your Content, usage	Contract
Enforce quotas and limits, show usage and analytics	Usage	Contract
Billing and invoices	Account, billing, usage	Contract; legal obligation for records
Security, abuse prevention, debugging	Technical, usage	Legitimate interests
Service emails (invitations, sign-in links, billing notices)	Account, workspace	Contract
[MARKETING, if any]	[DATA]	[Consent]

Who processes it for us

Provider	What for	Data
Supabase, Inc.	Authentication and the accounts database	Account, workspace, token metadata, daily usage
Stripe, Inc.	Payment methods and invoices	Billing data, invoice amounts, currency
[CLOUD PROVIDER]	Hosting the gateway, file storage and build workers	Your Content, usage, technical data
[STATIC HOST, e.g. Vercel or Netlify]	Serving this website and the console	Technical data
[EMAIL PROVIDER]	Sending service emails	Email address

We don't sell personal data and don't share it for cross-context behavioral advertising. We may disclose data if required by law, to protect rights and safety, or as part of a merger or acquisition, subject to this policy.

International transfers

Our providers may process data in [REGIONS]. Where data leaves the EEA, UK or Switzerland, we rely on [TRANSFER MECHANISM, e.g. Standard Contractual Clauses].

How long we keep it

Account data: while your account exists, then [ACCOUNT RETENTION PERIOD].
Your Content: while the project exists. Removing a project or workspace from the configuration stops using it but doesn't immediately erase its files; we delete them within [CONTENT DELETION PERIOD], or sooner on request.
Usage data: per-day statistics on our servers are kept for 32 days; daily rollups are kept for [USAGE ROLLUP RETENTION PERIOD].
Billing records: as long as tax and accounting law requires, typically [BILLING RECORD RETENTION PERIOD].
Logs: [LOG RETENTION PERIOD].
Backups: overwritten within [BACKUP RETENTION PERIOD].

Security

API tokens are stored as hashes, sessions are verified cryptographically, each build runs in an isolated process group with resource limits, and workspaces are only visible to their members. No system is perfectly secure; tell us about vulnerabilities at [SECURITY CONTACT].

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict some processing, and to withdraw consent. You can update your name, revoke tokens and delete workspaces you own in the console, and contact us at [PRIVACY CONTACT EMAIL] for anything else. We'll respond within [RESPONSE PERIOD]. You may also complain to your local data protection authority.

For Your Content in a workspace, please contact the workspace's owner first: they control it.