Privacy Policy
Last updated: October 2026
1. Controller
AI ERA – Moustafa Saleem
Kolonnenstr. 8, 10827 Berlin, Germany
Email: hello@fulveo.com
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account info (email, name, public GitHub profile) | Provide the service | Art. 6(1)(b) GDPR (contract) |
| Workspace content (boards, plans, tasks, conversations with the Fulveo Agent) | Provide the workspace and the Fulveo Agent you use | Art. 6(1)(b) GDPR (contract) |
| Repository content from repositories you connect | Let the Fulveo Agent read your code to answer questions and build plans and diagrams | Art. 6(1)(b) GDPR (contract) |
| Organization membership, roles and invitations (including the invitee's email address) | Let an organization control who can open its workspaces and invite people | Art. 6(1)(b) GDPR (contract); for invitees, Art. 6(1)(f) GDPR (legitimate interest) |
| Workspace activity log (who changed what, and when) | Show a workspace's history to its members and keep the service secure | Art. 6(1)(f) GDPR (legitimate interest) |
| Connected AI agents (connection, permissions, and a log of each call) | Let an AI agent you connect act in your workspaces within the permissions you approved, and record what it did | Art. 6(1)(b) GDPR (contract) |
| Requests to join an organization (who asked, where from, an optional message) | Let you ask for access and let the organization's owner or an admin decide | Art. 6(1)(b) GDPR (contract); for the organization, Art. 6(1)(f) GDPR (legitimate interest) |
| A one-way hash of the network address a join request came from | Limit how many requests one address can send, to stop abuse | Art. 6(1)(f) GDPR (legitimate interest) |
| Links and invitations for boards and plans (what a link allows, who made it and when they confirmed what it shows, an optional password kept only as a one-way hash, when it expires, and for an invitation the invited person's email address) | Let a member share one board or plan with people outside the organization, and turn that sharing off. What a link or invitation shows is decided by the person who shares it: everything on that board or plan, including what people or AI agents add to it later. | Art. 6(1)(f) GDPR (legitimate interest) |
| Guest sessions on shared boards and plans (a session without an account, which board or plan it opened, when it last opened it, a random key that keeps it to one browser, and how many times it saved the board recently) | Let a guest open the one board or plan they were given, let the person who shared it see and end that access, and limit how often one guest can save a board | Art. 6(1)(f) GDPR (legitimate interest) |
| A human check before a guest session starts | Stop automated abuse of shared board and plan links | Art. 6(1)(f) GDPR (legitimate interest) |
| Comments on boards (the text, where it is pinned, and who wrote it; a guest's comment is marked as a guest's) | Let people discuss a board | Art. 6(1)(b) GDPR (contract); for guests, Art. 6(1)(f) GDPR (legitimate interest) |
| A keyed one-way hash of the network address behind a wrong board password or code | Limit how often one address can guess a board password or code | Art. 6(1)(f) GDPR (legitimate interest) |
| Anonymous pageviews, and the steps of a sign-up and a checkout (which plan and billing period was opened, and whether it was completed or closed; never card details). A link from fulveo.com to app.fulveo.com, or through Google or GitHub sign-in, carries a random visit ID in its address so one visit counts once; nothing is stored on your device for this | Aggregate usage statistics (no IP retained) | Art. 6(1)(f) GDPR (legitimate interest) |
| How you found us, kept with your account when you sign up: the campaign tags on the link you arrived from, the domain of the site that sent you, and the first page you saw. Not kept if you have stopped analytics | Learn which channels bring customers who stay | Art. 6(1)(f) GDPR (legitimate interest) |
| Error reports (what failed, where in the app it happened, and the page address with any board or plan link removed) | Find and fix crashes | Art. 6(1)(f) GDPR (legitimate interest) |
| Personalized analytics & session recording | Improve the product | Art. 6(1)(a) GDPR (consent) |
| Payment data | Billing (handled by Paddle) | Art. 6(1)(b), 6(1)(c) GDPR |
| Contact form: your name, email address and message, and a one-way hash of your network address used only to limit abuse | Answer your message | Art. 6(1)(f) GDPR (legitimate interest); Art. 6(1)(b) where it concerns a contract |
| Marketing email address | Newsletters & product updates | Art. 6(1)(a) GDPR (consent) |
Where we rely on legitimate interest (Art. 6(1)(f) GDPR), the interest pursued is operating, securing, and improving the Service.
3. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication | EU (Stockholm) |
| Fireworks AI, Inc. | AI model provider for the Fulveo Agent | USA |
| Google LLC | Sign in with Google, and backup AI model provider (Gemini), used only if the main provider fails | USA |
| Nebius B.V. | Backup AI model provider, used only if the main provider fails | EU (Netherlands) |
| Tavily | Web search when you ask the Fulveo Agent to search the web | USA |
| Vercel Inc. | Website hosting | USA (global CDN) |
| Cloudflare, Inc. | Human check on sign-in, sign-up, password reset, account setup, admin sign-in, the contact form, and before a guest opens a shared board | USA (global network) |
| Paddle.com Market Ltd | Payment processing | UK |
| PostHog Inc. | Analytics | EU (Frankfurt) |
| Loops Inc. | Email delivery | USA |
| GitHub Inc. | Sign-in, and repository access through the GitHub App you install | USA |
| Hetzner Online GmbH | Application infrastructure, operational logs and AI request traces | EU (Falkenstein, Germany) |
4. Your content is not used to train AI models
We do not train models on your content, and we do not sell it. Your boards, plans, documents, the messages you send the Fulveo Agent and any repository content it reads are used to answer you, and for nothing else.
The same holds at our model provider. Fireworks AI, which serves the Fulveo Agent, states that it does not use prompts or API inputs to train or improve its models without explicit opt-in, and does not log or store prompt or generation data for open models without explicit opt-in. We have not opted in to either. The model itself (minimax-m3) is open-weights, so no prompt is needed to improve it.
5. International transfers
Some sub-processors are located outside the EU/EEA. For these transfers we rely on the EU-U.S. Data Privacy Framework (where applicable) and Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
6. Retention
- Account & repository data: while your account is active. After deletion, soft-deleted for 30 days, then permanently removed.
- Deleted workspaces, boards and plans: kept in Trash for 30 days so they can be restored, then permanently deleted with everything in them.
- Workspace activity log: 90 days.
- Invitations: deleted 30 days after they expire or are accepted.
- Requests to join an organization: deleted 30 days after they are decided, withdrawn or expire. The network address hash is deleted after 24 hours; the address itself is never stored.
- Links and invitations for boards and plans: deleted 30 days after they are turned off, withdrawn or expire, together with the guest access that came from them.
- Guest sessions: a guest who has not opened a shared board or plan for 30 days is removed. The person who shared it can end a guest's access at any time. A guest they removed is kept, with no access, until that link or invitation is deleted, so the same browser cannot come back in. How many times a guest session saved a board is counted per board and kept for 24 hours.
- Comments on boards: kept with the board. When a guest is removed or an account is deleted, the text stays and the author is removed.
- Wrong board passwords and codes: the network address hash is deleted after 24 hours; the address itself is never stored.
- Billing data: Invoices and payment data are issued and retained by Paddle (our Merchant of Record) under their own privacy policy. We retain only the subscription identifiers and payout records needed for our own bookkeeping, for as long as required by applicable German tax and commercial law (§ 147 AO, § 257 HGB — currently up to 8 years).
- Analytics events and error reports: 30 days.
- Operational logs: 90 days on EU infrastructure.
- Contact form messages: deleted 12 months after they arrive.
- Marketing email contact: until you unsubscribe or request deletion.
7. Your rights
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20).
- Object to legitimate-interest processing (Art. 21) — including anonymous statistics, via the "Stop Analytics" link in the footer.
- Withdraw consent at any time (Art. 7(3)) — via the "Cookie Settings" link in the footer for analytics, or by unsubscribing from any marketing email.
To exercise these rights, contact hello@fulveo.com.
8. Right to lodge a complaint
Under Art. 77 GDPR you may lodge a complaint with a supervisory authority. A directory of German federal and state data protection authorities is at bfdi.bund.de.
9. Cookies
We use essential cookies for session and authentication (Art. 6(1)(b) GDPR). An essential cookie also remembers your cookie and analytics choices, so they apply on fulveo.com and app.fulveo.com alike. Analytics cookies (PostHog, EU servers) are set only after you accept the cookie banner (Art. 6(1)(a) GDPR) and can be withdrawn at any time via the "Cookie Settings" link in the footer.
We do not use advertising or tracking cookies.
10. Children
Fulveo is not intended for persons under 16. We do not knowingly collect data from children.