PRIVACY AT FOLVIRA

Privacy Policy.

Updated 17 October 2026

This policy covers accounts, saved designs, subscriptions, support and repost requests. Payment details are entered on Stripe-hosted pages.

Who controls your information

Folvira is operated by Martin Molek, IČO 09525360, with registered address at Sibiřská 369, 403 31 Ústí nad Labem, Czech Republic. Contact: [email protected]. Martin Molek is the controller of personal data processed to operate Folvira.

Information and purposes

• Account and sign-in: email address, display name, account identifier and authentication records, to provide and secure your account. If you choose Google sign-in, Google provides the account details required for authentication.
• Designs: editor settings, saved designs and photos or logos you save, to restore work across your devices. Photo enhancement runs in your browser; enhancement itself does not send the photo to a processing server. Saving a design can upload its assets to your private account storage.
• AI writing: when you request quote or caption suggestions, Folvira sends your selected topic, niche, tone, post text and recent suggestions to Cloudflare Workers AI. Our backend verifies your account and usage allowance. Completed suggestions are stored privately for recovery and automatically removed within three days; generation inputs are not stored in the writing job records. Generation request identifiers, status and timestamps are used to enforce limits and prevent abuse.
• Billing: subscription tier, status, period end, cancellation status and Stripe customer, subscription and price identifiers, to activate access, manage renewals and maintain payment records. Stripe collects payment and billing information on its hosted pages. Folvira does not store your full card number or security code.
• Support and reposts: messages, submitted Instagram links, notes, decisions and timestamps, to answer requests, review submissions and apply monthly limits. Authorized administrators can access these records. Approved reposts make the submitted public content visible through Instagram’s Repost feature.
• Withdrawal statements: your confirmed name, account email, subscription reference, statement, receipt time, associated support request and email delivery status, to record and respond to a withdrawal and meet consumer-law obligations.
• Service activity: for signed-in members, we record the last visible workspace entry or interaction and whether an export was started, a design saved, a photo enhanced or AI suggestions generated. We keep one daily account record for up to 90 days, using UTC dates, to understand service adoption and return use. Only authorized administrators can view this account-level activity. It does not record post contents, images, keystrokes, browsing histories or new advertising identifiers. This processing relies on our legitimate interest in understanding and improving our service; you may object through the contact below.
• Technical records: request and browser information needed for delivery, security and troubleshooting. Workspace error reports include your account identifier, page, short error message and browser information; the reporting feature does not attach designs or uploaded images. Do not put passwords or payment details in support messages.

Legal bases

We process account, design, subscription, support and repost information where necessary to perform our contract with you or take requested steps before it. Security and troubleshooting rely on our legitimate interests in operating a reliable service and preventing abuse. Accounting, tax and legally required records rely on legal obligations. Where processing requires consent, we request it separately and you may withdraw it without affecting prior lawful processing.

Providers and recipients

Supabase provides authentication, database and private file storage. Cloudflare delivers and protects the website and processes optional AI writing requests. Stripe provides checkout, billing and the customer portal; it also processes some information as an independent controller for its own legal, fraud-prevention and payment purposes. Google is involved if you choose Google sign-in. GitHub hosts the source and deployment workflow; it is not the application’s design database. Instagram/Meta processes public content shared through its platform under its own terms. We may disclose records to authorities where legally required.

Provider information: Supabase, Cloudflare, Stripe and Google.

International processing

Providers may process information outside your country, including outside the EEA. Applicable transfers must use a valid legal mechanism, such as an adequacy decision or standard contractual clauses. Contact us for information about the safeguards relevant to your data or a copy where applicable.

How long information is kept

Account information and saved designs are retained while your account remains open, unless you delete a design or request account deletion. A downgrade alone does not delete saved designs. Support, repost and security records are retained only as needed to handle the request, prevent abuse, resolve disputes or establish legal claims; retention depends on the nature and status of the issue. Required billing and accounting records are retained for the applicable statutory period even after account deletion. Backups may retain deleted records until the provider’s backup rotation completes; such copies are not kept for ordinary active use. Ask us for the retention criteria applicable to a particular record.

Local storage and security

Browser storage is used for sign-in sessions and workspace preferences. Payment providers use their own session and security technologies on their pages. Private design storage is restricted to the authorized account. No online service can guarantee absolute security. Protect your device and account and contact us if you suspect unauthorized access.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. Where consent is used, you can withdraw it. You may delete individual saved designs in the workspace. For other requests, choose Help & support → Privacy or account request or email [email protected], including if you cannot sign in. We verify identity proportionately and normally respond within one month; where legally permitted, complex requests may take up to two additional months, with notice and reasons.

You may complain to the Czech supervisory authority, the Úřad pro ochranu osobních údajů, or the data-protection authority in your country. Providing account information is necessary to use signed-in features; billing information is necessary to purchase Pro. Optional support notes are your choice. Folvira does not make decisions with legal or similarly significant effects based solely on automated processing.

Changes

We update this policy when our processing changes and indicate the update date above. Material changes are communicated as required.