Privacy
Who is responsible
Andreas Armanious, BSc., Graz, Austria, operates Foldbase as a private individual and is responsible for this website. Contact hello@foldbase.app for any privacy request. This notice covers the website and waitlist, wherever you visit from; the Mac app will have its own privacy information before release.
Website delivery and preferences
The website is hosted by Vercel Inc. (USA). Your browser sends connection information such as your IP address and request headers to Vercel to deliver the site and protect it from abuse. This serves our legitimate interest in operating a secure website (GDPR Article 6(1)(f)). We do not use this information to identify visitors for advertising.
Essential local storage remembers your theme choice (foldbase-theme) and privacy choices (foldbase-consent:v1). Privacy choices expire after 180 days. These preferences stay in your browser; changing or clearing browser storage resets them.
The email waitlist
When you explicitly agree to updates, we process your email address, chosen language, consent version, source, and request time through Brevo (Sendinblue SAS, France). Brevo sends a double opt-in email. You join the list after confirming that email. We use your address only for Foldbase early access and product updates, based on consent (GDPR Article 6(1)(a)).
Brevo provides contact storage, confirmation, and email delivery. Its delivery and security records may include connection information. Our API does not log submitted email addresses. We request that Brevo’s contact pixel tracking consent remains off. We check for existing subscriptions and opt-outs to avoid duplicates and unwanted resubscription. The same response is shown regardless of membership.
You can unsubscribe through any update email or contact us to withdraw consent or request deletion. We retain waitlist details while you remain subscribed and the waitlist serves its purpose. Minimal opt-out records may be retained to prevent further mail; consent evidence may be retained where necessary to establish or defend legal claims. Withdrawing consent does not affect earlier lawful processing.
Optional PostHog analytics
Only after your permission do we load PostHog for visits, page sections, signup steps, demo interactions, theme/language choices, and performance measurements. Analytics consent is separate from email consent. Declining analytics does not prevent joining the waitlist. We use PostHog’s EU cloud project. The legal basis is your consent (GDPR Article 6(1)(a)).
PostHog uses a pseudonymous browser identifier in local storage. We do not create identified person profiles or send email addresses, entered form text, file names, query strings, or full referrer URLs in our custom events. Automatic click capture, console capture, and server log export are disabled. We request that PostHog omit IP storage. Connection information still reaches its service to deliver requests.
Session replay is a separate optional category that requires analytics consent. If you allow it, PostHog records masked page interactions to help us understand usability. All inputs and text are masked; signup forms are blocked from replay. We do not enable console or network payload recording.
Change or withdraw your choice at any time through Cookie settings in the footer. Withdrawal stops capture and replay and clears the SDK’s browser persistence; it does not delete events already received. We also respect Global Privacy Control and Do Not Track by keeping optional tracking off. Contact us for deletion requests; without a browser identifier we may be unable to associate pseudonymous events with you.
Recipients, transfers, and retention
We use three service providers, each bound by a data processing agreement: Vercel Inc. (USA) for hosting, Brevo (Sendinblue SAS, France) for the waitlist, and PostHog for optional analytics in its EU cloud. We do not pass your data to anyone else.
Some processing by these providers or their subprocessors can take place outside the EU, for example in the USA. Such transfers rely on the EU-US Data Privacy Framework, under which Vercel and PostHog are certified, and otherwise on the European Commission’s Standard Contractual Clauses.
Vercel keeps request logs for at most 30 days, for operation and security. Waitlist details are kept as described above. PostHog deletes analytics events after 12 months and session recordings after at most 30 days; we delete them sooner on request.
Your choices and rights
Wherever you live, you can ask for access, correction, deletion, restriction or portability of your data, or object to processing based on legitimate interests. You may withdraw consent at any time. Contact hello@foldbase.app. We may need proportionate information to verify a request.
You can complain to the Austrian Data Protection Authority (dsb.gv.at) or the data protection authority where you live or work. We do not sell personal information or share it for cross-context advertising, use advertising cookies, or make decisions producing legal or similarly significant effects solely through automated processing. This service is not directed at children.