This policy explains how Fondoo ("we", "us"), handles personal data when you visit getfondoo.com or use the hosted Fondoo service (the "Service").
1. Two roles, two kinds of data
We are the controller for data about our own users and visitors: your account, billing, how you use the Service, and visits to getfondoo.com. This policy covers that data.
We are a processor for data our customers collect about their customers: their subscribers, buyers, site visitors, app users and the people who send them support tickets. Our customer (the business) decides how that data is used, and their own privacy notice applies. We process it only on their instructions, under our Data Processing Agreement.
If you're a customer of a business that runs on Fondoo, please contact that business directly about your data. If you contact us, we'll pass your request to them.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email, password (stored hashed), workspace and team details | You |
| Sign-in data | Basic profile and email from Google or GitHub, if you sign in with them | Google, GitHub |
| Billing data | Plan, invoices, billing address, payment status. Card numbers are handled by Stripe, not stored by us. | You, Stripe |
| Payments setup | Business and identity details you give Stripe when setting up Connect. Stripe collects most of this directly. | You, Stripe |
| Workspace content | Sites, posts, emails, products, files, settings, and data from services you connect | You and your agents |
| Connection keys | API keys and tokens for services you connect. Encrypted at rest and never shown back in full. | You |
| Agent and API activity | Which agent or API key did what, when, with what result (your audit log) | The Service |
| Usage and device data | IP address, browser, pages and features used, error reports | Your device, the Service |
| Support with us | Messages you send us | You |
| Website visits | Pages viewed, referrer, device type, approximate location derived from IP | Our cookie-free analytics |
3. How we use it, and our legal bases
If you're in the EU, EEA or UK, we rely on these legal bases under the GDPR / UK GDPR:
| Purpose | Legal basis |
|---|---|
| Create and run your account, provide the Service, process payments, send service emails (receipts, approvals, security alerts) | Contract |
| Keep the Service secure, prevent fraud and abuse, enforce our policies, fix bugs | Legitimate interests |
| Understand and improve the Service and our website, using cookie-free analytics | Legitimate interests |
| Send our newsletter or product announcements | Consent (unsubscribe any time) |
| Keep tax and accounting records, respond to legal requests | Legal obligation |
We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.
4. AI
- Fondoo does not call AI models on its own account at launch. We don't send your data to an AI provider of our choosing.
- When you connect an AI agent (such as ChatGPT, Claude, Codex or Cursor) or add your own AI key, the data your agent reads or sends goes to that provider at your direction, under your agreement with them.
- We don't use your data to train AI models.
See the AI and Agents Policy.
5. Who we share it with
- Sub-processors that help us run the Service, such as Stripe, Amazon Web Services, Cloudflare, Upload-Post, Railway, Neon, Sentry, Google and GitHub. The full list, with what each does and where, is in our Sub-processors list.
- Services you connect. When you connect a provider (a social network, your store, your AI agent), we send it what's needed for that connection.
- Legal and safety. When required by law, or to protect people, the Service or our rights.
- Business transfer. If the business is sold or reorganized, data may transfer to the new owner under this policy.
We don't sell your personal information, and we don't share it for cross-context behavioral advertising.
6. Cookies
- Our analytics are cookie-free. We don't use advertising or cross-site tracking cookies on getfondoo.com.
- We use strictly necessary cookies only: to keep you signed in, remember security settings, and protect against abuse. Our hosting and security provider, Cloudflare, may set cookies for bot and attack protection.
- Because we use only necessary cookies, we don't show a cookie banner on getfondoo.com.
Sites our customers run on Fondoo may use their own cookies and tracking tags. That's the business's choice and responsibility. Fondoo gives them a consent manager to help.
7. International transfers
We're based in the United States, and our main infrastructure is in the United States (for example, AWS us-east-1). Some sub-processors operate elsewhere (Upload-Post is in Spain; Cloudflare runs a global network). When we transfer personal data from the EU, EEA, UK or Switzerland to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or Swiss adjustments where relevant), or on our providers' own approved transfer mechanisms.
8. How long we keep it
| Data | How long |
|---|---|
| Account and workspace data | While your account is open. After it closes, you have 30 days to export, then we delete it within the following 30 days. |
| Trials that don't convert | Kept for 30 days after the trial ends so you can come back, then deleted. |
| Unclaimed agent-started drafts | Deleted after a reasonable period if no human claims them. |
| Backups | Deleted data ages out of backups within 14 days days. |
| Audit logs | For the life of the workspace, then deleted with it. |
| Email suppression records (unsubscribes, bounces, complaints) | As long as needed to keep honoring them, even after other data is deleted. We keep only the minimum needed. |
| Billing and tax records | As long as tax and accounting law requires (often up to 7 years). |
| Security and server logs | Up to 90 days, unless needed longer to investigate abuse. |
| Our marketing list | Until you unsubscribe. |
9. Security
We aim to protect personal data with reasonable technical and organizational measures, including encryption in transit, encryption of stored connection keys, access controls, two-factor authentication options, audit logs, approval gates for risky actions, backups and restore drills. No system is perfectly secure, and we can't guarantee security. More detail is in Annex 2 of our Data Processing Agreement.
10. Your rights
Everyone can ask us to:
- access the personal data we hold about you;
- correct it;
- delete it;
- export it in a portable format.
In the EU, EEA and UK, you can also object to processing based on legitimate interests, ask us to restrict processing, withdraw consent at any time, and complain to your data protection authority.
In US states with privacy laws (such as California, Colorado, Connecticut, Virginia and others), you may have rights to know, access, correct, delete and port your data, and to opt out of sale, targeted advertising and profiling. We don't sell data or do targeted advertising. We won't treat you differently for using your rights.
How to ask: email [email protected], or use the account and export tools in your dashboard. We may need to verify your identity. We aim to respond within 30 days (45 days where US state law allows, with notice if we need more time). An authorized agent may make a request for you with proof of authority. If we deny your request, you may appeal by replying to our decision; we'll explain the outcome and how to contact your state attorney general if you disagree.
11. Children
The Service is for adults running businesses. It is not directed at children, and we don't knowingly collect personal data from children under 13 (or under 16 in the EU, EEA and UK). If you believe a child has given us data, contact us and we'll delete it.
12. Changes
We'll update this policy as the Service changes. For material changes, we'll notify account holders by email or in the dashboard before they take effect. The effective date at the top shows the latest version.
13. Contact
Fondoo Mailing address available on request. [email protected]