Faable privacy & data

We are the controller of your relationship with us.

Email address, name, profile picture, identifiers from the identity provider you signed in with (e.g. GitHub, Google)

Billing name, billing address, VAT/tax ID, plan, invoices, payment status

Billing data Billing name, billing address, VAT/tax ID, plan, invoices, payment status

Security data Authentication events, session data, IP address, user agent, rate-limit and abuse signals

Product analytics Pages viewed, features used, pseudonymous device/session identifier

Support data Emails, ticket contents, and anything you choose to send us

Create and authenticate your account, associate you with a team

Charge for the Services, issue invoices, comply with tax and accounting law

Detect and prevent fraud, abuse, credential stuffing, and platform misuse

Understand which parts of the product and documentation work

deleted or anonymised within 30 days of account closure

6 years , as required by Spanish commercial and tax law

Up to 90 days

Up to 12 months where needed to investigate abuse and security incidents

30 days rolling, after which they expire automatically

3 years from the last message

Up to 12 months at event level

Application workloads and identity data run on infrastructure located in the European Union .

Where a transfer to a third country happens, it is covered by an adequacy decision, by the EU Standard Contractual Clauses, or by both

Where a transfer to a third country happens, it is covered by an adequacy decision, by the EU Standard Contractual Clauses, or by both

We use a small set of specialised providers. Each is bound by a data processing agreement holding them to the same obligations we accept towards you.

The commitments above form our DPA and are incorporated into the Terms of Service . If your organisation requires a countersigned DPA, request one at privacy@faable.com .

Customer content (apps, deployments, artifacts, Auth users) Deleted within 30 days of account closure or on your request

Access the personal data we hold about you and get a copy of it.

Rectify data that is inaccurate or incomplete.

Erase your data (“right to be forgotten”), where no legal obligation requires us to keep it.

Restrict or object to processing based on our legitimate interests.

Port your data to another provider in a structured, machine-readable format.

Withdraw consent at any time, without affecting processing already carried out.

We do not sell personal data.