Privacy Policy
Version 1.00
Updated On: 2026-08-26
In this Privacy Policy, Fostrom Ltd (hereinafter: 'we' or 'us'), a private limited company registered in Scotland under company number SC894279, whose registered office is at 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN, explains which personal data is collected when you use our website and services. This includes the website of our company and cloud platform Fostrom (fostrom.io and its subdomains) (hereinafter: the "Website") and our product Fostrom (hereinafter: the "Product"), (hereinafter jointly: the/our "Service(s)").
We value your privacy and the protection of your personal data. Personal data will therefore be processed carefully and in accordance with this Privacy Policy and applicable laws and regulations.
If you have any questions or wish to receive further information, please contact us at support@fostrom.io with the subject "Privacy Policy Concerns". We will respond to your request as soon as possible.
1. When does this Privacy Policy apply?
This Privacy Policy applies to visits to our Website and the use of the Product. If necessary, we make a distinction in this Privacy Policy between our Website and our Product. Also, this Privacy Policy only applies to processing of Personal Data by us as controller. If an organisation processes Personal Data of you through our Services, this organisation is the controller. We are then the processor. In that case, this Privacy Policy does not apply. This Privacy Policy does not apply to third-party websites that are linked to our Website. We cannot guarantee that these third parties will handle your Personal Data in a reliable or secure manner. We recommend that you also read the privacy policies of these parties/websites.
2. Personal data
When we use the term "Personal Data" in this Privacy Policy, we mean information relating to you, which may include identifiers such as your name, identification numbers, location data, social identity and other details.
3. Personal Data Processing and Cookies
When you fill a form on our website such as when signing up or logging in, we may collect personal data (such as your name and email address) and process it to facilitate providing services to you. We may also use GitHub login to authenticate you. In that case, we may collect your GitHub username, email address, name, and avatar. We may also collect your IP address and browser information to facilitate security and authentication measures.
If you sign up for an account, we may send you emails related to your account and the Services, as well as emails about the Product and its features. You can opt out of product and feature emails at any time by clicking the unsubscribe link in any such email. You may not be able to unsubscribe from important account-related emails for as long as you have an account with our Services. We may use an external email provider, currently Loops, to send you emails. In that case, we need to share your email address and name with the provider. We cannot make guarantees about their privacy policies and hence encourage you to read their privacy policies.
To understand how our Website is used, we use Plausible Analytics. Analytics requests are served through our own domain. Plausible receives your IP address, the page you visited, the referring website, and your device and browser type. Plausible uses your IP address only to generate a temporary identifier that cannot be reversed, does not store your IP address, does not set cookies, and does not track you across websites.
Our documentation search is provided by Algolia DocSearch. When you use the search box, Algolia receives your search query and your IP address in order to return results and to measure the quality of search results.
When you visit our Website as a visitor, we may store cookies in your browser. When you login or sign up to our Services, we may store cookies to identify your account. These cookies are set to facilitate security and authentication measures, and are strictly necessary in order to provide the Services you have asked for. Under the Privacy and Electronic Communications Regulations, cookies of this kind do not require your consent, which is why we do not ask you to accept cookies when you arrive. We do not set advertising cookies, and we do not use any third-party service that tracks you across other websites. If we ever introduce cookies that are not strictly necessary, we will ask for your consent before setting them.
4. Our legal bases for processing
Under the UK GDPR we must have a legal basis for each purpose for which we process your Personal Data. The purposes and the corresponding bases are set out below.
Creating and running your account. We process your name, email address, login credentials, and, if you use GitHub login, your GitHub username, name, and avatar, in order to create your account, authenticate you, and provide the Services to you. Legal basis: performance of a contract.
Account and service emails. We process your name and email address to tell you about your account, security matters, billing, and material changes to the Services. Legal basis: performance of a contract.
Keeping the Services secure. We process your IP address, browser information, and access logs to authenticate you, to protect accounts, and to detect and prevent abuse, fraud, and attacks against the Services. Legal basis: our legitimate interests in keeping the Services secure and available.
Payments and billing. We process the payment details described in the section on Payments in order to take payment and issue invoices. Legal basis: performance of a contract. Where we are required to retain invoices and accounting records, the basis is compliance with a legal obligation.
Emails about the Product and its features. Where you have signed up for an account, we process your name and email address to send you information about the Product you signed up for and about features of that Product. Legal basis: our legitimate interests in informing our users about the product they use, together with the "soft opt-in" rule in the Privacy and Electronic Communications Regulations. You can opt out at any time using the unsubscribe link in any such email.
Understanding how the Website is used. We process the analytics data described in the section on Personal Data Processing and Cookies to understand which pages are visited and how visitors reach us, so that we can improve the Website. Legal basis: our legitimate interests in understanding and improving the Website.
Documentation search. We process your search query and IP address to return search results and to measure the quality of those results. Legal basis: our legitimate interests in providing working documentation search.
Meeting our legal obligations. We process and retain Personal Data where we are required to do so by law, including for tax and accounting purposes. Legal basis: compliance with a legal obligation.
Where we rely on our legitimate interests, we have considered whether those interests are outweighed by your interests, rights, and freedoms. You have the right to object to processing that is based on our legitimate interests, and an absolute right to object to the use of your Personal Data for direct marketing. You can object by contacting us at support@fostrom.io, or, in the case of product and feature emails, by using the unsubscribe link in any such email.
5. Payments
It may be possible to purchase subscriptions or enter into billing agreements to our Product for a fee. To arrange payment for our Product, we may use a third-party payments processor to facilitate the payments. We may need additional Personal Data to process payments such as the details of the credit/debit card, or details required by other payment methods.
6. Security
We protect your Personal Data by taking technical and organisational measures against unauthorised, unlawful or accidental access, loss, destruction or damage to Personal Data. We are constantly taking steps to improve data security. We use TLS (Transport Layer Security) to encrypt communications between you and our services. When we store passwords or secrets, we hash them using a strong one-way hashing algorithm and store them in a secure database, unless otherwise mentioned. We use encryption-in-transit and we also employ encryption-at-rest wherever possible. We ensure only the necessary persons have access to your Personal Data. Our security measures are regularly checked and evaluated.
7. Retention period
We do not keep your Personal Data longer than necessary for the purposes for which it was collected or used. The periods we apply are set out below.
Account data. We keep the Personal Data associated with your account for as long as your account is open. If you delete your account, we delete that data immediately and permanently, other than records we are required to keep by law. Deleted account data cannot be recovered.
Billing and accounting records. We keep invoices and accounting records for six years after the end of the financial year to which they relate, in order to meet our tax and company law obligations.
Security and access logs. We keep logs containing IP addresses and browser information for no longer than 12 months, so that we can investigate security incidents and abuse.
Email records. We keep your email address for product and feature emails for as long as you have an account. If you unsubscribe, we keep a minimal record of your address so that we can honour that choice and avoid emailing you again.
Analytics. Our analytics provider does not store IP addresses and does not retain data that identifies you.
Support correspondence. We keep correspondence with you for as long as we need it to deal with your query, to handle any follow-up, and to keep a record of the support we have provided.
8. Third parties and international transfers
We do not sell your data to third parties. We may, however, engage third parties who process certain Personal Data under our responsibility. These fall into the following categories: hosting and infrastructure providers, our email provider, our analytics provider, our documentation search provider, and our payments processor.
Some of these providers are located outside the United Kingdom. We transfer Personal Data outside the United Kingdom only where a lawful transfer mechanism applies: where the destination country is covered by UK adequacy regulations, where the provider is certified under the UK Extension to the EU-U.S. Data Privacy Framework, or where we have Standard Contractual Clauses in place together with the International Data Transfer Addendum issued by the Information Commissioner.
You can ask us which providers we currently use, and which safeguards apply to them, by contacting us at support@fostrom.io.
9. Your rights
You have the following rights in relation to the Personal Data we hold about you. You can exercise any of them by contacting us at support@fostrom.io.
Access. You can ask us to confirm whether we process Personal Data about you and, if we do, to give you a copy of it together with information about how we use it.
Rectification. You can ask us to correct Personal Data that is inaccurate, and to complete Personal Data that is incomplete.
Erasure. You can delete your account at any time from your dashboard. You can also ask us to delete Personal Data we hold about you. This right is not absolute. Where we are required to keep certain records by law, such as invoices and accounting records, we will retain those records and delete the rest.
Restriction. You can ask us to limit how we use your Personal Data, for example while we are verifying the accuracy of data whose accuracy you have contested.
Portability. Where we process Personal Data that you provided to us, by automated means, on the basis of a contract, you can ask us to provide it to you in a structured, commonly used, machine-readable format, or to transmit it to another controller where this is technically feasible.
Objection. You can object to processing that is based on our legitimate interests, as described in the section on our legal bases for processing. You have an absolute right to object to the use of your Personal Data for direct marketing.
We will respond to any request within one month. If your request is complex, or if you have made a number of requests, we may extend that period by up to two further months, and we will tell you within one month if we do. We do not charge a fee for handling a request, unless the request is manifestly unfounded or excessive.
We may need to verify your identity before acting on a request, so that we do not disclose your Personal Data to someone else.
We do not use your Personal Data to make decisions about you solely by automated means that produce legal effects concerning you or that similarly significantly affect you.
Complaints. If you are unhappy with how we have handled your Personal Data, or how we have handled a request you have made, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. We would appreciate the opportunity to address your concerns first, so please do contact us before you approach the ICO.
10. Updates or changes to this Privacy Policy
The way in which we process Personal Data, and the composition of the data we process, may change over time. Fostrom Ltd reserves the right to change this Privacy Policy at any time. For that reason, we encourage you to check the Privacy Policy regularly to stay informed of such changes. We make commercially reasonable efforts to inform you of major changes. In this way we ensure that you are aware of recent changes.