Privacy Policy

Draft - review with counsel

This policy is a working draft and has not been reviewed by a lawyer. It is not yet in force.

This policy explains how Fovea ("Fovea", "we", "us") handles personal data when you visit foveahq.com or use the Fovea app. Fovea is operated by Buildberg Pty Ltd.

Who is responsible

For this website and for account data (your name, email, billing details), Fovea is the controller.
For customer content you put into the app (creative files, product catalog, Meta ad data, team members' details), you are the controller and Fovea processes it on your behalf as a processor. Our Data Processing Addendum covers that processing.

What we collect

When you visit the website

Usage data: pages viewed, referrer, approximate location from IP, device and browser type. Collected through privacy-conscious analytics (see below) only where enabled.
What you send us: details you enter in the demo request or newsletter forms (name, work email, company, role, message).

When you use the app

Account data: name, email, profile image and authentication details, handled by our authentication provider.
Workspace data: workspace names, team members and their roles.
Billing data: plan, invoices and payment status. Card details are handled by our payment processor; we never see or store full card numbers.
Customer content: files you upload or import, AI-generated tags and transcripts, product catalog data, Meta ad account data you connect, collections and share links.
Product usage: actions taken in the app, used to improve the product and to support you.

How we use it

To provide, secure and support the service.
To analyse creative with AI so it can be tagged and searched. Customer content is sent to our AI provider only to produce these results for you.
To bill you and send service emails (receipts, trial reminders, security notices).
To reply to demo requests and, if you opted in, send our newsletter. You can unsubscribe at any time.
To understand how the website and app are used, so we can improve them.

We do not sell personal data, and we do not use customer content to train AI models.

If you choose Sign in with Google, Fovea asks Google only for the basic sign-in scopes (openid, email and profile). From Google we receive your name, email address, profile photo and a Google account identifier.

How we use it: only to create your Fovea account, sign you in, show your name and photo inside the app, and keep your account secure (for example, linking a Google sign-in to an existing account with the same verified email).
What we don't do: we do not access your Gmail, Google Drive, Calendar, contacts or any other Google data; we do not sell this data, use it for advertising, or use it to train AI models; and we do not share it with third parties except the service providers listed below that help us run Fovea.
Storage and deletion: it is stored with your account and deleted or anonymised when you delete your account (Settings > Account > Delete account) or ask us at privacy@foveahq.com. You can also remove Fovea's access at any time from your Google Account permissions page.

Fovea's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal bases (EEA and UK)

Contract (to provide the service), legitimate interests (security, product improvement, B2B marketing to work contacts), consent (newsletter, non-essential analytics where required) and legal obligation (tax and accounting records).

Service providers

We use carefully chosen providers to run Fovea. Depending on the features you use, these include: hosting and content delivery (Vercel, Cloudflare), authentication (Fovea's own sign-in, with optional Google Sign-In; Clerk while we complete our move off it), payments (Stripe), email delivery (Resend), product analytics (Mixpanel, Google Analytics via Google Tag Manager), AI analysis (Google Gemini models via OpenRouter), and data collection for the competitor ad archive from Meta's public Ad Library (Apify). A current list is available on request and will be published with the DPA.

International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Retention

We keep account data for as long as your account is active and for a reasonable period afterwards for legal and accounting purposes. Customer content is deleted after your subscription ends, following a grace period during which you can export it, unless you ask us to delete it sooner. Website form submissions are kept for as long as needed to respond and follow up.

Security

Workspaces are isolated from each other, Meta access tokens are encrypted at rest, all traffic uses HTTPS, and access to customer data inside Fovea is limited to what is needed to run and support the service.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent. If we process your data as a processor for one of our customers, we will pass your request to them. You can also complain to your local data protection authority.