1. Who is responsible
The service provider identified above is the data controller for Fomkee accounts, website use, billing, security, support and business administration. Contact [email protected] for privacy questions or requests.
For personal data in monitor requests, responses, heartbeat bodies, status pages or alerts that a customer controls, the customer is normally the controller and Fomkee is its processor. The customer is responsible for lawful instructions and notices. Contact us before sending personal data if you need a data-processing agreement.
2. Data we process
- Account and workspace: identity-provider ID, email, display name, workspace, membership, role, invitations, API-key metadata and audit events.
- Monitoring configuration: targets, schedules, headers, bodies, scripts, heartbeat settings, status-page content and notification destinations.
- Results and incidents: timing, region, latency, status, errors, limited request or response evidence, heartbeat receipts, incident history and delivery outcomes.
- Billing: customer and subscription references, plan, amount, currency, tax and invoice details, payment method and payment status. Paddle, as merchant of record, collects payment credentials and the billing information it needs to calculate tax, issue invoices and process payments. Fomkee does not receive a card security code or full unmasked card number.
- Technical and security: IP address, request time, path, device or browser information, authentication outcome, logs and diagnostic context.
- Communications: messages and support correspondence you send us.
Monitored content can contain personal or confidential information even when Fomkee does not ask for it. Use dedicated health endpoints and return the minimum necessary data.
3. Why we process it
- to provide accounts, monitoring, alerts, status pages, billing and support under our contract;
- to secure and improve the Service, diagnose faults and prevent abuse based on our legitimate interests;
- to keep invoices, tax records and other information required by law;
- to respond to legal requests and establish or defend claims; and
- for optional processing where you give consent, which you may withdraw.
We do not sell personal data or use it for solely automated decisions with legal or similarly significant effects.
4. Providers and recipients
We share only what is needed with:
- Clerk for identity, authentication and waitlist functions;
- Paddle, as merchant of record, for checkout, tax calculation, invoicing, recurring payments, fraud prevention and payment records;
- Cloudflare for web delivery and network protection;
- Hetzner for application, database and backup hosting;
- PostHog for optional product and website analytics and consent-based, masked session replay;
- Resend for service and monitoring email;
- notification providers and endpoints that a customer configures; and
- advisers, authorities or transaction counterparties where reasonably required by law, claims or a business reorganisation.
Paddle acts under its own privacy notice when it processes purchaser and payment information as merchant of record. A configured notification destination receives the information the customer directs us to send.
5. International transfers
Primary Fomkee hosting is in the European Union. Some providers may process data from other countries. Where GDPR requires it, we rely on an adequacy decision, approved standard contractual clauses or another lawful safeguard. You may ask for information about the relevant safeguard.
6. Retention
- Account, workspace and configuration data is kept while the account or workspace is active and for the period needed to complete deletion, resolve disputes and meet legal duties.
- Check results and captured evidence are kept for the retention period shown for the applicable plan or feature. Some incident and audit facts remain longer so history stays intelligible.
- Billing, invoice and transaction records are kept for the period required by tax, accounting and payment law.
- Security, diagnostic and support records are kept only while needed for the issue, security purpose or legal claim, then deleted or anonymised on the applicable rotation.
- Deleted live data may remain in restricted backups until those backups rotate or restoration is no longer required.
Stopping a subscription does not itself delete an account or workspace. If access is terminated for continued non-payment, Customer Data associated with the affected workspace may be deleted after reasonable notice. Contact us to request deletion; some records must be retained where law or legitimate claims require it.
7. Cookies and local storage
Fomkee and its providers use storage needed for sign-in, security, workspace selection and payments. With your consent, PostHog uses first-party browser storage to connect product events across Fomkee pages and may create a masked reconstruction of your session so we can find confusing or broken journeys. We do not enable PostHog analytics or replay before you choose to allow it. Rejecting is free of disadvantage. You can change or withdraw your choice at any time from the Privacy settings link in the public-site footer or the account menu in the customer application. Paddle's hosted checkout uses its own necessary security and payment technologies.
On the public site, replay can include Fomkee's own page text and visual presentation. Form values and information produced by the endpoint showcase, including endpoint details, captured responses, headers, JavaScript output and email addresses, remain hidden. In the customer application, replay shows only interface text that we have explicitly classified as product-owned, such as navigation, field labels and dialog headings. Workspace, account, monitor and incident content remains hidden. Across both sites we hide form values and omit console output, request and response bodies and headers, cross-origin frames and canvas content. Query strings and dynamic identifiers are removed from recorded URLs. Analytics events use reviewed categorical properties and do not include monitor URLs or names, response content, JavaScript, email addresses or billing details. These safeguards reduce collection but do not make the data anonymous in every circumstance.
The consent record is stored for up to 12 months after acceptance or six months after rejection, unless you change it sooner or the processing purpose changes materially. PostHog analytics and replay data are retained only for the configured project retention period and as long as needed to understand and improve the relevant journey. Contact us if you want analytics data associated with your account deleted.
8. Security
We use measures intended to protect personal data, including TLS, access controls, workspace separation, hashing of API keys, encryption for designated credentials and secrets, and limited retention of rich monitoring evidence. No system is completely secure. Protect your account, keys, endpoints and destinations, and do not expose unnecessary information to monitoring.
9. Your rights
Subject to GDPR and its exceptions, you may request access, correction, deletion, restriction or portability; object to legitimate-interest processing; withdraw consent; and complain to a supervisory authority. Contact [email protected]. We may verify your identity. If we process data only for a customer, we may refer the request to that customer.
The Czech authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7.
10. Children and changes
Fomkee is not directed to children and account holders must be at least 18. We may update this Policy as the Service or law changes. We will show a new version and effective date and give reasonable notice of material changes where required.