This policy explains what personal data Famoka holds, why, who sees it, how long we keep it and what you can do about it. We have tried to write it in plain words. Some features described here are not live yet; we will only handle data in the ways described once they are.
1. Who is responsible for your data
The controller of your personal data is Douglas Anthony Silkstone, company number (IČO) 10911243, with registered office at Nademlejnská 600/1, Hloubětín, 198 00 Prague 9, Czechia, which runs Famoka (famoka.com). We are established in Czechia.
You can write to us about your data at [email protected].
2. What we collect, and why
- Your account. Your email address, your name (if you give one), your language, country, time zone and display currency, and your sign-in sessions (when, and the browser and device type). If you turn on two-factor authentication, we hold the secret and backup codes needed for it. We use this to run your account, which is the contract between us. If you sign in with Google, Google tells us your email address and name.
- Your creator profile. Your handle, the country where you live, the languages you use, the platforms and handles you say you have and the topics you cover. Your handle is public. Your profile starts unlisted and publishing it is your choice. We don't ask for special categories of data (such as ethnicity, religion, health or sexuality), and you shouldn't add them.
- Your brand workspace. Your company name, website, country, the platform you sell on, your goals, whether your website is verified, and your team's email addresses and roles.
- What you agreed to. Each time you accept terms or give or withdraw a consent, we record which document or wording, which version, the exact words shown, when, and a keyed hash of your internet address. We keep these as proof of what was agreed, which is in our legitimate interest and, for terms, part of the contract.
- Money. We keep a record of earnings, fees, charges and payouts: amounts, dates, statuses and the brand or workspace they belong to. Stripe collects and holds your identity checks, bank details and tax forms; we don't see or keep your full bank details. We use this to carry out the contract and to meet tax and accounting law.
- Clicks and sales on tracked links. When someone follows a creator's tracked link we record the click (time, the link, the brand, the type of browser, a keyed hash of the internet address and an identifier for the click). When a sale is reported we match it to the click. We pass the creator's identifier, which isn't their name or email, to the network or brand so the sale can be credited. This is how creators are paid, so it is part of the contract with creators and our legitimate interest in running the service.
- Email. We email you sign-in codes and notices about your account and money. These are part of the service. We email product news, tips and offers only if you tick the box, and you can untick it at any time in your account. We keep the email address you give the country waitlist, with the country, only to tell you when payouts reach your country and for nothing else. We delete it if you ask.
- Visits to our site. We count visits with our own analytics. It records the page, the website you came from (the host only, such as example.com), the campaign source in the link you followed (if any), and the day. It stores no internet address, no account, no cookie, nothing in your browser and no fingerprint, and skips known bots, so it can't tell visitors apart or follow anyone. We don't use third-party analytics, advertising or social-media trackers. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, our site doesn't send the count at all.
- Keeping the service safe. Forms that email you ask your browser to solve a small puzzle from our own servers, to tell people from bots; nothing about it goes to anyone else. We keep keyed hashes of internet addresses in short-lived rate-limit and audit records so we can slow abuse and see who did what to an account. Sensitive actions on accounts are written to an audit log. This is our legitimate interest.
- Messages to us. What you write to us, and our replies.
3. Who we share it with
We don't sell your personal data. We use these companies to run Famoka. Each acts on our instructions.
| Company | What it does for us | What it sees |
|---|---|---|
| Stripe | Pays creators, collects brand fees, checks identity and tax details | Your identity, bank and tax details, amounts and payout records |
| Cloudflare | Our domain, our network edge and sending our email | Internet addresses and browser signals of visitors, as any network edge does; the address, subject and text of each email we send you |
| Sign-in with Google, only if you choose it | That you signed in, your email address and name | |
| Railway | Hosts our servers and our database | All data we hold, stored with it |
We also share some data with others as the service needs:
- Brands and networks. A brand sees your public profile and what your tracked links brought them. It doesn't see more about you unless you choose to share it. A network or brand receives your creator identifier, not your name or email, so sales can be credited.
- Advisers and authorities. Accountants, lawyers and insurers under confidentiality, and tax authorities, courts and regulators when the law requires.
- A buyer. If we sell the business or its assets, your data may transfer to the buyer, who must keep to this policy.
4. Transfers outside your country
Some of these companies are in the United States or elsewhere outside the European Economic Area and the United Kingdom. Where that happens we rely on an adequacy decision (such as the EU–US Data Privacy Framework for a company that has joined it) or on the European Commission's standard contractual clauses.
5. How long we keep it
- Account data for as long as your account is open.
- If you delete your account, sign-in is switched off at once and your personal data is erased 30 days later. We can't erase the account while you have pending earnings or an unpaid balance, or if you are the only owner of a workspace that has other members; we tell you what is in the way.
- What stays after an erase. A stub of the account stays because other records point at it, with the name "Deleted user" and no usable email. Audit entries keep what happened and when, without your handle, country, workspace name or address hash. Records of terms and consents stay as proof of what was agreed, with the address hash removed. Financial records are kept for as long as tax and accounting law requires.
- Sign-in codes work for 10 minutes. Data export files are available for 7 days. Short-lived rate-limit records are cleared within days.
- Visit counts hold no personal data and are kept.
6. Your rights
Under the GDPR (and the UK GDPR where it applies) you can:
- see the data we hold about you and get a copy (request an export from your account page; we aim to have it ready within 24 hours);
- have wrong data corrected;
- have your data erased (delete your account from your account page);
- ask us to restrict how we use it, or object to our use of it where we rely on our legitimate interest;
- receive the data you gave us in a machine-readable form, and have it passed to someone else where that is possible;
- withdraw a consent at any time (switches in your account page), without affecting what happened before;
- not be subject to a decision made only by a computer that has legal or similarly significant effects on you. Fraud signals can pause earnings, but a person decides whether to withhold money, and you can appeal.
To use a right, use your account page or write to [email protected]. We may need to check that it is you.
You can complain to a data protection authority. Ours is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOU), Pplk. Sochora 27, 170 00 Prague 7, Czechia, www.uoou.gov.cz. You can also complain to the authority in the country where you live or work. In the UK that is the Information Commissioner's Office.
California. If you live in California you can ask what personal information we hold, ask us to correct or delete it, and opt out of its sale or sharing for advertising. We don't sell or share personal information for advertising, and we won't treat you worse for using your rights.
7. Cookies and similar technology
We set only the cookies and storage that make the site work, and none for analytics or advertising, so we don't show a cookie banner. The Cookie notice lists exactly what we set.
8. Security
We protect data in transit, store internet addresses and email addresses used for abuse checks only as keyed hashes, offer two-factor authentication, and log sensitive actions. No system is perfectly secure. If a breach affects you we will tell you and the authorities as the law requires.
9. Children
Famoka is for people aged 18 and over. We don't knowingly collect data from anyone younger.
10. Changes
When we change this policy we publish a new version with its date, keep the old one available and tell you. A change to this policy doesn't stop you using Famoka.