Privacy Notice

We receive data from you, your organization, your use of Foga, providers you connect, and the service providers described below. Where GDPR applies, we rely on the legal bases shown here.

• Account and business-contact data: contact details, organization, role, and settings used to create accounts and manage the relationship. The basis is contract performance for a Customer and our legitimate interests in serving its users and contacts otherwise.
• Service, usage, and security data: authentication, device, request, feature, audit, error, and diagnostic information used to provide, secure, and improve Foga. The bases are contract performance, our legitimate interests in reliable and secure operation, and legal obligations where applicable.
• Subscription and transaction data: plan, entitlement, renewal, payment status, invoice, billing-contact, and provider reference information used for access, payment, accounting, fraud prevention, and disputes. The bases are contract performance, legal obligations, and legitimate interests in financial administration. Foga does not receive full card details.
• Support and correspondence: messages, contact details, and information you choose to send, used to answer requests and keep necessary support or legal records. The bases are steps toward or performance of a contract and our legitimate interests in support and legal claims.
• Website and preference data: session, security, and requested settings used to provide functionality, preserve choices, and protect sessions. The bases are contract performance and our legitimate interests in a functioning, secure service.

Section 6 states the applicable retention periods. We delete or minimize each category when it is no longer needed, subject to legal obligations and claims.

We do not make decisions that produce legal or similarly significant effects about people solely by automated means. Extraction and matching suggestions support a user's review; the customer decides how to use them.

An email address, authentication and security information, and the applicable business or billing details are required to create and operate a paid or trial account. Without them, we cannot provide Foga. Connecting a mailbox, cloud-storage account, or bank is optional, but the related import or matching feature cannot work without the data and permissions shown when it is connected.

We disclose personal data only as needed for the purposes in this Notice, on instruction, or where law permits or requires. We do not sell personal data or share it for behavioral advertising.

• Service providers process data on Ordinal's instructions to operate Foga. The current register, purposes, broad locations, and change process are in Terms Section 13.
• Connected email and storage providers receive requests at the user's direction and separately control their own accounts, authentication, and platform operations.
• Enable Banking and connected banks independently provide regulated read-only account access. Polar and its payment partners independently handle checkout, tax, invoicing, fraud prevention, refunds, and payment.
• Advisers may receive necessary data under confidentiality; authorities may receive it where law requires; and a genuine buyer, investor, or successor may receive it subject to appropriate safeguards.

Foga's primary Customer Content and account data are hosted in the European Union. Limited support, service delivery, email, and automated processing may occur in the United States, United Kingdom, other EEA countries, or other documented provider locations.

For restricted transfers from the EEA, we use an adequacy decision where available or safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You may request information about the relevant mechanism from us.

We use organizational and technical measures designed for the risk, including access restrictions, data separation, encryption, monitoring, recovery, secure development, deletion controls, and incident response. No internet service is risk-free, so users must also protect their accounts, devices, and authentication methods. More detail appears in Terms Section 12.

We keep personal data only for the shortest period needed for the relevant purpose, including providing Foga, following customer instructions, maintaining security, meeting legal obligations, and resolving claims. The main operational periods are:

• Customer Content remains while the service is active. When trial or paid access ends, it is retained during the ordinary 30-day grace period for owner export and reactivation, then scheduled for deletion from active content stores. Ordinary document access and deletion are blocked during grace.
• A customer with active product access can delete selected documents sooner. Connected credentials are removed when the source is disconnected, the relevant workspace is deleted, or they are no longer needed, subject to short operational delay.
• Generated export files and links expire within 24 hours. A fresh export may be requested during an applicable retrieval period.
• Raw Polar webhook payloads and operational logs are kept for no more than 30 days. Logs are designed to avoid document content, access tokens, and unnecessary email addresses.
• Minimal billing and security audit records may be kept for up to 180 days, and pseudonymized proof that a content purge completed for up to 365 days.
• A minimal account and workspace shell may remain while the account stays open so the user can sign in, see status, and reactivate without restoring deleted content. Full account closure removes that shell, except records that law requires us to retain.
• Invoices, tax and transaction records, dispute records, and evidence of consent or legal notices are retained for the period required by applicable law or reasonably needed for legal claims.

Encrypted backup copies may remain isolated until overwritten through ordinary backup cycles. They are not returned to active use except for disaster recovery and remain subject to protection and deletion controls.

Foga currently uses only storage needed to provide or secure the service and remember settings a user requests. This includes authentication/session state, short-lived OAuth security state, and preferences such as theme or list view. Session and security items expire or are removed on sign-out or after their security window; preferences remain until reset, expired, or removed in the browser.

Foga does not currently use advertising cookies or third-party behavioral analytics. Because current storage is necessary for the service or requested functionality, we do not display a marketing-cookie consent banner. If we add optional analytics or advertising storage, we will update this Notice and request consent where required before using it.

Depending on the circumstances, GDPR gives you the right to request access, correction, deletion, restriction, and data portability; to object to processing based on legitimate interests; and to withdraw consent without affecting earlier processing. You may also complain to a supervisory authority. These rights can be limited where an exemption applies or where we must keep information by law.

For data Ordinal controls, contact us using Section 10. We may need to verify your identity and clarify the request. We ordinarily respond within one month and will tell you if a lawful extension is needed. For Customer Content, direct the request to the business that placed your data in Foga; Ordinal will assist that business as its processor.

Requests are normally free. We may charge a reasonable fee or refuse a request only where GDPR permits it, such as when a request is manifestly unfounded or excessive.

In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY). You can find complaint information at imy.se. You may instead contact the authority where you live or work, or where the alleged infringement occurred.

Foga is a business-only service and is not directed to children or offered for private, family, or household use. Users must be at least 18. If you believe a child has provided account data directly to Ordinal, contact us so we can investigate and remove it where appropriate. Personal data may still incidentally appear in Customer Content under the customer's control.

We may update this Notice when Foga, our providers, or legal requirements change. We will post the new version here and change the effective date. We will give account users advance email or in-product notice of a material change where appropriate.

Contact Ordinal with privacy questions or requests at: