Privacy policy

Who we are

Foye is a client front desk that creative studios use to work with their clients. It is run by Rae Agency (business ID 2296682-6, VAT FI22966826), Runeberginkatu 17, 00100 Helsinki, Finland ("Foye", "we"). Contact for privacy: admin@foye.app.

Two roles. When a studio uses Foye to work with you as its client, the studio decides what happens with your information and Foye handles it on the studio's behalf. Questions about that data go first to the studio, and we help it answer. For studio members' own accounts, and for running Foye itself, we decide and we answer.

What we collect

If you are a studio's client contact

• Your name and email address, added by the studio, and the client (company) you belong to.
• When you signed in, and the sign-in links sent to you (stored only as a hash).
• What you write and send in Foye: messages on steps, answers to forms (for example Discovery), files you upload, approvals and the times you gave them.
• Which slides of a Journey you have seen, and your notification settings.
• A line in the studio's audit log when you do certain things: upload or withdraw a file, invite or remove a coworker, leave the desk. It names your email address, what you did and when, never what you wrote or uploaded.

If you are a studio member

• Your name, email address and role in the studio; if you sign in with Google, your Google email.
• What you create and change in Foye, and when your studio's agents (AI tools connected with a token) acted, with the source they named.
• A line in the studio's audit log for sensitive changes: adding or removing people, files, links and connections, publishing, resetting a key, scheduling an erase. It names your email address, the action and which fields changed, never their content. Only the studio's owner reads it.
• Which days your studio had team members in Foye, and how many (a count per studio per UTC day, no addresses), so we can run and support the service during the beta.
• When something in Foye breaks: which page type (never a page address with names or ids in it), the kind of error and its short code, the app version, the time, and which studio it happened in. Never the error's message, what you typed, your address, cookies or IP address. It is only used to run and support the service during the beta.

If you are a studio owner paying for a plan

• Paddle (paddle.com) sells Foye's plans to you as our reseller and merchant of record, and is its own controller for what it collects to take payment: the payer's name, email, address and card details. Foye never sees your card. Paddle's privacy notice applies to that data.
• Foye gives Paddle your studio's id and the owner's email, so a payment can be matched to the studio. From Paddle we receive the plan, its status and its dates.
• When a studio is deleted, we cancel its subscription. Paddle, as merchant of record, keeps its own customer and invoice records afterwards, under its own terms and notice; we cannot erase them.

About a studio's clients as businesses (usually not personal data, but may contain it): project plans, brand guidelines, documents such as a brand strategy, and the health of the client's public website (availability, speed, screenshots).

We do not use analytics or advertising trackers. Cookies are only the ones needed to keep you signed in and remember your choices. Paddle's checkout sets its own, under Paddle's notice.

Google user data

A studio member may connect Google services to Foye. Each one is optional, asks Google only for the access it needs, and is used only for the feature it is connected for.

• Sign in with Google (openid, email, profile): your Google account's email address, name and profile picture. The address and name sign you in to your studio. Unless you upload your own photo, the picture is your face in Foye: your studio's team sees it, and so do your studio's clients when you write to them, act on their work or are named as their contact. A viewer's browser loads the picture directly from Google, so Google receives that viewer's IP address.
• Google Drive (drive): lists and opens the files in the Drive folders the studio mounts for a client, and saves files the studio adds there. Files are read and written in place in Drive. Foye keeps a copy of a Drive file only when the studio copies or moves it into the client's files in Foye (a Google document as a PDF), where it is kept and erased like the client's other files.
• Google Search Console (webmasters.readonly): read-only figures for a client's website: daily clicks and impressions, the top searches and pages, and whether Google has indexed the site's key pages. Kept 24 months. The studio sees them; the client sees only total clicks and impressions.
• Google Calendar (calendar.events.owned, openid, email): creates, updates and cancels the meetings the studio schedules in Foye on the member's own calendar, and reads back changes to those events (a new time, guests' answers). Foye also keeps the member's own Google Calendar events (the primary calendar), from 30 days back to 180 days ahead, so the member's Calendar in Foye shows them. Only that member sees them: not the studio's other members, and not clients. The one exception is the member's busy times (never titles or details): teammates in the studio who pick meeting guests see them, unless the member turns this off in Settings → Profile. Foye keeps no event description, only a call link found in it. The events are deleted when the member disconnects, when they reconnect with another Google account, and after a week of the connection needing a reconnect. The account's email address identifies the calendar.

Foye's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features described above, which the member can see in Foye.
• We never sell it, and never use it for advertising.
• We never use it to train AI or machine learning models, ours or anyone else's.
• We transfer it to others only as needed to run those features (our hosting and database providers, listed below), to comply with the law, or as part of a merger or sale with notice to you. AI agents a studio itself connects to Foye can read it on the studio's behalf.
• No person at Foye reads it unless you ask us to, it is needed for security or to investigate abuse, or the law requires it. Then we read only what that need calls for.

Disconnecting a service in Foye deletes the access Foye holds for it and stops it reading. You can also remove Foye's access at any time in your Google account, at myaccount.google.com/connections.

How we keep Google user data, and everything else in Foye, safe is set out below under How we protect your data.

Why, and on what basis

Where it is kept

The database and server functions are in Stockholm, Sweden; files are stored in the EU. A few services sit outside the EU: the AI model (Anthropic, USA), email delivery and Google's services. Email is sent from Ireland. They are covered by data processing agreements and the EU's Standard Contractual Clauses (several also by the EU–US Data Privacy Framework). The AI model provider deletes what it receives within 30 days and does not train its models on it. Paddle, which takes payment for plans, is in the United Kingdom and is its own controller for payment details.

• Supabase: database and sign-in, Stockholm
• Vercel: hosting and server functions, Stockholm
• Cloudflare: file storage in the EU; screenshots of public websites
• Resend: email delivery, Ireland
• Anthropic: the AI model that drafts brand strategies, USA
• Paddle: payment for plans, as merchant of record and its own controller for payment details, United Kingdom
• Google: sign-in, Drive, Search Console and Calendar, as connected; PageSpeed and Web Fonts
• DataForSEO: search positions of public websites, Estonia

How we protect your data

We protect all the information in Foye this way, and take the most care with what is sensitive: the access Google gives us, the files and messages a studio and its clients exchange, and sign-in links.

• Encrypted in transit. Foye is served only over HTTPS: a plain HTTP request is redirected, and browsers are told to use HTTPS only. Foye talks to its database, file storage, Google and our other providers only over encrypted (TLS) connections.
• Encrypted at rest. The database, its backups and the stored files are encrypted on disk by our providers (Supabase and Cloudflare).
• Google access kept on the server. The keys Google gives Foye to reach a connected service are kept in a part of the database that no browser and no signed-in account can read. Only Foye's server uses them, only for the feature they were given for, and they are deleted when the service is disconnected.
• Each studio kept apart. Every read and write is checked in the database itself against who is asking: a studio reaches only its own data, and a client contact reaches only what their studio has shared with them.
• Files behind short-lived links. Files are kept in private storage, never at a public address. Each time someone opens one, Foye checks that they may, then hands out a link that works for five minutes.
• Safe sign-in. Foye keeps no passwords. People sign in with Google or with an emailed link that works once and expires within an hour, and we store that link only as a hash. Email sign-in is protected against automated attempts.
• Least access. Foye's secret keys live only on its servers, never in a browser. Only the few people who run Foye can reach its production systems, and only to keep it working and secure. The studio's audit log records sensitive changes, so a studio's owner can see who did what.
• If something goes wrong. If personal data is exposed, we tell the studios affected without delay, and the data protection authority within 72 hours, as the law requires.

How long

• Client data stays as long as the studio works with the client. When a studio deletes a client, everything about that client — contacts, projects, steps, messages, files, form answers, documents — is erased by a scheduled job after a short waiting period, and the files go with it.
• A studio whose plan has ended becomes read-only. Its data is deleted when the owner asks, within 30 days, or after 24 months without a studio sign-in; before a deletion for inactivity, we write to the owner 30, 7 and 1 days ahead.
• Studio member accounts stay while you are a member; removing you from the studio ends your access.
• Backups: daily copies are kept 30 days; one copy a month is kept for 12 months. A deleted client disappears from backups as they age out. Files are to be copied nightly to a second EU bucket, and a file deleted in Foye is to stay in that copy up to 30 days; this copy is not running yet.
• Email records (who was sent which kind of email, when) are kept 13 months, or erased with the client sooner.
• Notifications in Foye are kept 90 days after you read them, 13 months if you never do. The exception: a notification that records you were told about an item (that it was shared with you or asked of you) is kept as long as the item, because it is the studio's record that you were told.
• The studio's audit log is kept 13 months. If you are removed or your client is erased, the log's existing lines keep your email address until they are 13 months old: they are the studio's record of who did what. The exception: the one line recording that a client was added is kept while the client exists (it names no content), so the log can still say which studio a client belonged to when the client is erased; it then goes 13 months after.
• Search Console figures are kept 24 months.
• Studio activity days (per studio and day, how many team members were in Foye; no addresses) are kept 13 months.
• Error records (page type, error kind and code, version, studio, time; no personal data) are kept 90 days.
• Paid-call records (per studio: which service was called and for what, the model, token counts or units, whether it worked, the error kind and the cost; never what was sent or returned) are kept 13 months.
• These periods are applied by a nightly job in the database.

Your rights

You can ask to see your data, correct it, have it erased, restrict or object to its use, or get a copy in a common format. If you are a studio's client, ask the studio, or ask us and we will pass it on and help: admin@foye.app. A studio can export everything about a client from Foye in one file. You can also complain to your data protection authority: in Finland, the Data Protection Ombudsman (tietosuoja.fi).

Changes

We update this notice when what Foye does changes, and say so in Foye before it takes effect.