featureloom Application Privacy Policy

Contents

1. Who the controller is
2. Two roles: when we are the controller and when we are not
3. What data, what for, on what basis and for how long
4. Recipients of the data
5. Signing in with Google
6. Payments
7. Transfers outside the European Economic Area
8. Logs and security
9. Your rights
10. Cookies and browser storage in the application
11. Changes to the policy

This policy concerns the featureloom application (app.featureloom.com, api.featureloom.com, mcp.featureloom.com) and the emails that we send. The featureloom.com website has its own policy. Version 1.3. Effective from 2026-11-01.

1. Who the controller is

The controller of the data described in this policy is VIGELION Tomasz Czubkowski, ul. Wiosenna 25, 60-185 Skórzewo, Poland, tax ID (NIP) 973-024-00-52 (“we”, “featureloom”). Contact for personal data matters: privacy@featureloom.com.

2. Two roles: when we are the controller and when we are not

If your data was entered into featureloom by a business or a person that uses the Service, that customer is the controller and you exercise your rights with that customer; we will forward a request addressed to us to the customer. Exception: we process the address given in an invitation as a controller (point 3).

3. What data, what for, on what basis and for how long

The periods are in Annex 2, here in brief. The bases are those of Article 6(1) GDPR.

purpose	data	basis	period
account and sign-in of the Organization's founder	email address, display name, language, protected password (if you set one), the version of the Terms and the moment of its acceptance, country, the Organization's name	point (b) (contract)	until the account or the Organization is deleted
account and sign-in of a person invited to an Organization	email address, display name, language, protected password (if you set one), the version of the Terms and the moment the invitation is accepted	point (b) (keeping the account at the person's request) and point (f) (enabling the customer's team to work)	until the account is deleted (the version of the Terms: as long as the membership of the Organization); we delete an account with no Organization after 12 months
sessions and their security	protected session token (the code stored in the sign-in session cookie), the shortened IP address you sign in from, browser name	point (b), point (f) (security)	14 days from signing in, 3 days without use; the record 90 days after the end
two-step sign-in (mandatory for the Organization Administrator of an Organization that has more than one person; for others when you turn it on or when the Organization requires it)	the protected secret of the authenticator app, protected recovery codes, error counter, the deadline of the obligation	point (b), point (f) (security)	until it is switched off or the account is deleted
passkeys (if you add them)	key identifier, public key, name, use counter, last use	point (b)	until the key or the account is deleted
signing in with Google (if you choose it)	the data in point 5(1)	point (b)	until it is unlinked or the account is deleted; details in point 5
people's consoles (with an `flc_` key and through OAuth sign-in) and automation keys	name, program, protected key or tokens, expiry dates, who issued it; places of use: shortened IP address, program name, day	point (b), point (f) (security)	`flc_` console 90 days and the record 90 days after the end; OAuth console up to 90 days from consent; key up to 180 days; places 90 days
emails about the account and security to the person and to Organization Administrators	email address, browser name, shortened IP address, the name of the person the email concerns or who performed the action	point (f) (account security and accountability in the Organization)	sent once; mail log as in Annex 2
invitation to an Organization	the invited person's email address, role, language, state; we receive the data from an Organization Administrator	point (f) (adding a new person at the request of an Organization Administrator)	the link 14 days; the record 90 days after the end
sign-up and password reset	email address, single-use link; at sign-up also the sign-up source and the browser language	point (b)	24 hours; the record 7 days (sign-up) and 90 days (reset)
bot protection (Cloudflare Turnstile) at sign-in, sign-up and a password reset request, and traffic passing through Cloudflare, our proxy server and our application	Cloudflare receives your request (IP address, technical data sent with it, browser characteristics)	point (f) (security)	at Cloudflare according to its policies (cloudflare.com/turnstile-privacy-policy); the logs of our proxy server and application: point 8
limiting sign-in attempts, sign-ups, password resets and invitation emails	the email address from a sign-in, sign-up or reset attempt, counter, time; for sign-up, reset and invitation also a marker derived from the email address	point (f) (security)	address: at the longest until a server restart; marker: at most 49 hours
one free trial per person	a marker derived from the email address (without the address itself), date	point (f) (preventing abuse of the trial)	24 months
the subscription and the model balance	plan, state, number of seats, country, the customer and subscription identifiers at the Payment Intermediary, scheduled change, who changed the subscription or opened a purchase, the top-up amount; balance entries: amount, model, tokens, who requested	point (b)	as long as the Organization
purchase data from the Payment Intermediary (source: Stripe)	first name and surname or business name, email address, billing address, tax number, the kind of payment method and its short form (for example the card type and last digits), amounts and payment history	point (b) (handling the contract), point (c) (taxes and settlements), point (f) (complaints, claims)	in the Intermediary's dashboard for the term of the contract and 5 years from the end of the calendar year in which the tax payment deadline passed (Annex 2)
emails about the subscription and the trial	email address, the Organization's name, in the deletion notice the amount of the balance	point (b)	sent once; the register of emails sent as long as the Organization
confirmation of the contract, of a purchase and of a withdrawal	email address, the Organization's name, plan, number of paid seats and period, or the top-up amount and the balance after it, the price including tax and the amount of tax, the version of the Terms, the end of the trial; in the confirmation of withdrawal the name and address of the person who submitted it	point (c) (the Polish Consumer Rights Act), point (b), point (f) (confirming the contract to businesses)	sent once; the record that the email went out as long as the Organization; mail log as in Annex 2
withdrawal from the contract and refunds	the withdrawal statement, its moment, the person who submitted it, the purchase it concerns, the state and moment of settlement, the amount paid and refunded, for a top-up the unused part, the moment the confirmation was sent; for a refund by bank transfer the account number	point (c) (the Polish Consumer Rights Act), point (f) (claims)	the record in the Organization as long as the Organization; correspondence and settlements as in Annex 2
sign-up origin and product statistics	country, the founder's language, browser language, sign-up source, kind of start, the dates of the steps (first agent, first plan, first payment, cancellation), the cost of the trial; without the name and addresses	point (f) (measuring whether the product works and where customers come from)	for the time the Organization exists and at most 26 weeks and 31 days after its deletion
Organization deletion register	the Organization's identifier (a pseudonym), source, plan, closing balance with currency, row counts, dates	point (f) (accountability, defence of claims)	6 years with a positive balance, 3 years with a zero or negative one, from the end of the year of deletion
correspondence, complaints, DSA notices	email address, first name and surname, content	point (b), point (c), point (f) (handling the matter)	until the matter is closed and 12 months
legal obligations (accounting, tax, replies to authorities)	billing data, the data indicated in the authority's request	point (c)	as required by law
establishment, exercise and defence of claims	billing documents, correspondence, the deletion register	point (f)	until the limitation period expires

Creating an account requires giving an email address and a display name and setting up a way to sign in, and, when creating an Organization, also giving its name and the country; you give the other data voluntarily, when you turn on a given function.

4. Recipients of the data

Processors acting on our instruction: the public list in Annex 3 part 1 (passing traffic on to our server and bot protection, handling of the checkout and subscriptions).
Separate controllers: the Payment Intermediary for the data given at the checkout (point 6), Google as the sign-in provider (point 5), Cloudflare for the data from the Turnstile challenge (cloudflare.com/turnstile-privacy-policy).
Your Organization: every member of it sees your name and email address, the date you joined and whether you are an administrator; Organization Administrators see in addition your rights, the number of consoles, the last use of a console and the state of two-step sign-in, and receive this data in the Organization's export.
Tools that the Organization or a person connects: Slack (when the Organization turns on the integration) and agents and MCP clients (when you or the Organization connect them); we send the data on the instruction of the Organization or of the person to their own tool, which processes it under their contract (Annex 3 part 2).

5. Signing in with Google

When you use Google to sign in, Google passes us a confirmation of your identity (a token), from which we read: the Google account identifier (sub), the email address, whether the address is confirmed, and the Google Workspace domain, if the account belongs to one.
We treat an address from Google as confirmed only for Gmail accounts and for Workspace accounts in the domain that the confirmation indicates as its own; otherwise we treat it as an address to be confirmed.
The Google identifier is used only for signing in. The email address from Google becomes the address of your account and serves the purposes in point 3: we send emails to it, it protects the one-time trial, the members of your Organization see it and it goes into its export. We do not sell data from Google, do not use it for advertising or for assessing creditworthiness and do not pass it to other entities apart from the recipients in point 4. We comply with the Google API Services User Data Policy, including the Limited Use requirements.
You can unlink signing in with Google in the application, in the account settings (ways to sign in); we then delete the stored Google identifier.

6. Payments

Payment is handled by Link (Sold through Link, LLC, a company of Stripe, LLC) under Stripe Managed Payments. You give your card details, billing address and tax address to Stripe. For that data and for their own purposes Stripe and Link are separate controllers (stripe.com/privacy).
From Stripe the application receives: the customer, subscription and payment identifiers, the country, the plan, the number of seats and the period, and the state and events of the purchase and payment, including the amount paid, the amount of tax and the amount refunded.

7. Transfers outside the European Economic Area

Data may go outside the EEA only to the entities listed in Annex 3 or to the separate controllers in point 4, on the basis of: an adequacy decision (the EU-U.S. Data Privacy Framework for certified entities: Google LLC, Stripe, LLC, Cloudflare, Inc.) or the European Commission's standard contractual clauses. We make a copy of the safeguards available on request.

8. Logs and security

Cloudflare and our proxy server record the IP address, the request address and the technical data sent with the request. On our proxy server we keep an access entry for about 4 days, and less under heavy traffic. The proxy server's error entries go to its shared log, limited in size and overwritten. We keep entries in the log of our application, including those with an IP address, for at most 14 days.
We keep backups for at most 6 months.

9. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing, data portability and to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). Send requests to privacy@featureloom.com; we reply within one month. We delete an account on request within 30 days; the deletion of an Organization is ordered by its Organization Administrator. We delete an Organization in read-only mode automatically under the Terms (§ 14(1)).

Right to object. You may object to processing based on our legitimate interests (point (f) in the table in point 3) on grounds relating to your particular situation.

10. Cookies and browser storage in the application

The application uses only the cookies and the browser and tab storage entries necessary for it to work.
Cookies: sign-in session (up to 14 days, no longer than the session), the code step of two-step sign-in (5 minutes), signing in with Google (10 minutes), an agent's connection through OAuth (30 minutes).
Browser storage (localStorage) and tab storage (sessionStorage): entries that remember your settings and the state of the application.
Cloudflare may store its own cookies necessary for bot protection, including __cf_bm (up to 30 minutes without activity) and cf_clearance after a challenge is passed (30 minutes).

11. Changes to the policy

We inform every person with an account of a change by email at least 14 days before it takes effect; a change required by law may take effect earlier.