FughettaEU and UK Privacy Notice
Effective date: [EFFECTIVE DATE]
This notice applies if you are in the European Economic Area (EEA) or the United Kingdom. It adds to the Privacy Policy, which describes what we collect and why; where the two differ for people in the EEA or the UK, this notice applies.
Who is responsible
The controller of your account, usage and billing data is [COMPANY LEGAL NAME], [POSTAL ADDRESS], [PRIVACY CONTACT EMAIL].
- EU representative under Article 27 GDPR: [EU REPRESENTATIVE NAME AND ADDRESS].
- UK representative under Article 27 UK GDPR: [UK REPRESENTATIVE NAME AND ADDRESS].
- Data protection officer: [DPO CONTACT, if appointed].
For the code and files your agents put into projects ("Your Content"), the workspace owner is the controller and we process it on their behalf as a processor. Workspace owners can request our data processing agreement at [DPA CONTACT OR LINK].
Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Service: sign-in, workspaces, storage, builds | Account, workspace, token, usage data; Your Content | Performance of a contract (Art. 6(1)(b)) |
| Enforcing quotas and limits, usage analytics in the console | Usage data | Performance of a contract (Art. 6(1)(b)) |
| Billing and accounting records | Account, billing and usage data | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Security, abuse prevention and debugging | Technical and usage data | Legitimate interests in operating a secure service (Art. 6(1)(f)) |
| Service emails such as invitations and billing notices | Email address | Performance of a contract (Art. 6(1)(b)) |
| [MARKETING, if any] | [DATA] | Consent (Art. 6(1)(a)) |
Providing your email address is necessary to create an account; without it we cannot provide the Service. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Recipients and international transfers
We share personal data only with the service providers listed in the Privacy Policy (Supabase, Stripe, [CLOUD PROVIDER], [STATIC HOST], [EMAIL PROVIDER]), under contracts that limit their use of it to providing services to us.
Some of these providers process data outside the EEA and the UK, including in [COUNTRIES]. Where a country has no adequacy decision, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with supplementary measures where needed. [Where a recipient is certified under the EU-U.S. Data Privacy Framework or its UK Extension, we may rely on that instead.] You can ask for a copy of the relevant safeguards at [PRIVACY CONTACT EMAIL].
How long we keep data
Retention periods are listed in the Privacy Policy. When a period ends, we delete or anonymize the data, except where we must keep it longer to comply with the law or to establish, exercise or defend legal claims.
Your rights
You have the right to:
- access your personal data and get a copy of it;
- rectify inaccurate data;
- erase data, where there is no longer a reason to keep it;
- restrict processing in certain cases;
- data portability for data you gave us, processed by contract or consent;
- object to processing based on legitimate interests, and at any time to direct marketing;
- withdraw consent at any time, without affecting processing before the withdrawal.
Send requests to [PRIVACY CONTACT EMAIL]. We answer within one month, which we may extend by two further months for complex requests, telling you why. We may ask you to confirm your identity first.
Complaints
You can lodge a complaint with the supervisory authority where you live or work, or where you think an infringement occurred. Our lead supervisory authority in the EU is [LEAD SUPERVISORY AUTHORITY, if any]. In the UK, it is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.
Browser storage
The console stores your sign-in session, preferred language and theme in your browser's local storage. These are needed for the service you ask for, so we do not ask for consent for them. We do not use analytics, advertising or tracking cookies; if that changes, we will ask for consent first.