Legal
Privacy notice
Operator details not configured. Set the LEGAL_* environment variables before launch.
1. Who is responsible
The controller for personal data processed through faroluma.com is [operator name], [address]. Contact for privacy matters: [email protected].
2. What we process and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Free check: email address, business name, city, country, website, industry, optional phone; a daily-salted hash of your IP address and its network prefix | Running the free check, sending the result, preventing abuse of a free service | Art. 6(1)(b) (your request); Art. 6(1)(f) (abuse prevention) | Unverified requests: deleted after 30 days. Verified requests: 12 months unless you create an account or ask us to delete them earlier |
| Account: name, email, password hash, language, time zone, organisation and role, session records (network prefix, browser) | Providing the service, security of your account | Art. 6(1)(b); Art. 6(1)(f) (security) | For the life of the account; deleted 7 days after you request deletion |
| Business data you enter or we measure (listing data, search positions, website checks, AI answers that mention the business) | Audits, scores, reports, monitoring | Art. 6(1)(b) | For the life of the account |
| Billing: company name, address, VAT number, invoices, payment status (card data is handled by Stripe and never reaches us) | Payments, accounting obligations | Art. 6(1)(b); Art. 6(1)(c) (tax law) | As long as tax law requires (often 10 years) |
| Marketing emails (only if you ticked the box) | Product news and offers | Art. 6(1)(a) (consent, withdrawable at any time) | Until you withdraw consent |
| Contact form messages | Answering you | Art. 6(1)(b) or (f) | 24 months |
| Technical logs (request ID, path, status, timing; IP addresses are not stored in application logs) | Operating and securing the service | Art. 6(1)(f) | 30 days |
3. Data about other businesses
Audits record publicly visible information about businesses that appear in search, Maps and AI answers next to yours (for example their names, websites, ratings and review counts). Where such a business is a sole trader, this can be personal data. We process it on the basis of legitimate interests (Art. 6(1)(f)) to show you your competitive context, keep it only as part of your audit history, and never build profiles of individuals.
4. Who receives data
We use the service providers listed on the subprocessors page. Measurement providers receive business information (name, city, website, search phrases) — not your account details. Some providers are located in the United States; where required, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. Each transfer mechanism must be confirmed against the provider's current data processing agreement before launch.
5. Automated decisions
Scores and findings are produced automatically from measurements and fixed rules. They describe a business's online visibility; they do not produce legal effects for any person.
6. Your rights
You can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You can export your data and delete your account in your account settings; every free-check email contains a deletion link. You can withdraw consent at any time. You may lodge a complaint with a data protection authority, in particular in your country of residence.
7. Security
Data is encrypted in transit; passwords are stored with Argon2; API tokens and share links are stored only as hashes; credentials you connect to Faroluma in the future (for example a business listing account) will be encrypted at rest; access is limited by role; backups are encrypted. See our security contact for reporting vulnerabilities.
8. Changes
We will announce material changes in the product and by email to account holders.
Version 2026-10 (draft)