Privacy Policy

This policy explains what personal data Fronko (“Fronko”, “we”) holds when you use Fronko, why, how long we keep it, who we share it with, and the rights you have. We never sell personal data, and there is no advertising or third-party tracking anywhere in Fronko.

Who is responsible for your data

• Fronko accounts. For the details of people with a Fronko account, the sales enquiries people send us and reports about cards, we are the controller.
• Cards and leads. The cards an organisation publishes, and the leads its cards collect, belong to that organisation. It is the controller, and we process that data on its behalf under our Data Processing Agreement. If you sent your details through someone’s card, contact that organisation (its privacy notice is linked from the form) to ask what it does with them, or to have them deleted.
• Payments. Paddle.com is the merchant of record for our subscriptions. Paddle is the controller of the payment and billing details you give at checkout; see Paddle’s privacy notice. Card details never reach us.

What we collect and why

Data	Why	Legal basis
Account details: username, email, name, role, password (stored only as a secure hash), sign-in times	To run your account and let you sign in, verify your email and reset your password	Contract
Your organisation’s plan, subscription status and the Paddle customer reference	To provide the plan you pay for	Contract
Card contents, photos and files, and the leads cards collect	To provide the Service to the organisation (as its processor)	The organisation’s instructions
Card visits: device type, the referring site, which links were tapped, and a visitor count based on a hash that changes every day	To show organisations anonymous statistics about their cards	Legitimate interest. No cookies are used, nothing identifies the visitor, and browsers that send “Do Not Track” or “Global Privacy Control” aren’t counted
Feedback, sales enquiries and card reports you send us	To answer you and to keep Fronko safe	Legitimate interest
Your IP address, briefly in memory	To limit how often requests can be made, against abuse	Legitimate interest. Never stored
Error reports: what failed, on which page or request, and your browser and device type. No IP address, account details or what you typed	To find and fix faults in the Service	Legitimate interest
When you accepted these terms and this policy	To record our agreement	Contract

We send you emails your account needs: verification and reset codes, notices about your plan and payments, and security notices. We don’t send marketing emails.

Who we share it with

We use a small number of service providers (“subprocessors”) to host Fronko, store files, send email and report errors. They process data only on our instructions. The current list is on our Subprocessors page.

Data also goes where your organisation sends it: when it connects an integration such as HubSpot, a webhook or an identity provider, we send that service the data the integration needs. We disclose data to authorities only when the law requires it.

Fronko staff never see the contents of your cards or leads in our admin tools; they see totals only, such as how many cards an organisation has. Every staff action is logged.

How long we keep it

• Account details: until the account is deleted.
• Cards, files and leads: until the organisation deletes them or its account, or for the lead retention period it sets.
• Card visit statistics: about 13 months.
• Feedback, sales enquiries and card reports: 2 years.
• One-time email codes: 15 minutes.
• Backups: deleted data leaves our backups within their retention period.

Security

Data is encrypted in transit, secrets and tokens are encrypted at rest, passwords are hashed, files are private and opened only through short-lived links, and staff sign in with two-factor authentication. See our Security page for more.

International transfers

Some of our subprocessors may process data outside your country. Where data leaves the European Economic Area or the UK, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.

Your rights

You can access, correct, export or delete your personal data, object to or restrict how we process it, and complain to your data protection authority. Most of this is self-service:

• Download your data: Settings → Account → Download my data.
• Correct it: edit your cards and account details in the dashboard.
• Delete it: Settings → Account → Delete account, which takes effect immediately.

For anything else, email [email protected]. We reply within one month.

Cookies

Fronko uses only cookies that are strictly necessary, such as the one that keeps you signed in. Public cards set no cookies at all. See our Cookie Notice.

Children

Fronko isn’t meant for children under 16, and we don’t knowingly collect their data.

Changes

If we change this policy in a way that matters, we’ll tell account owners by email or in the dashboard before it takes effect. The date at the top shows when it last changed.

Contact

Fronko. Privacy questions and requests: [email protected].