Privacy Policy
Last updated October 27, 2026
This policy explains what personal data fayvi handles, why, on what legal basis, and what you can do about it. fayvi is run by Loïc Berger EI, entrepreneur individuel (sole proprietor), SIREN 840 074 686 (contact: support@fayvi.co), the controller for the data of account holders, of visitors to fayvi's own site, and of what fayvi itself does on creators' pages (built-in analytics, protection against abuse, the AI chat). Full details are in the legal notice.
If you have an account
- Account data: your email address and a hashed password, your plan and trial dates, your language and email preferences, and your referral code. For security, our sign-in provider records the IP address and browser of each signed-in session, until it ends.
- Your pages: everything you add to your profiles (text, links, images, files, settings). Published pages are public by design.
- Billing: payments go through Stripe's Managed Payments service, where Stripe resells our plans and credit packs as merchant of record (shown as “Sold through Link”): it charges you, issues receipts and invoices, collects any tax and answers payment questions, under its own privacy policy. We keep your plan, billing interval, subscription dates, Stripe customer and subscription IDs and, if you withdraw, a record of your request, never your card details.
- Emails: we email you about your account (confirmation, sign-in links, password resets, receipts, the yearly renewal notice), about each form entry or new subscriber if you keep that setting on, and with tips, trial reminders and occasional offers about fayvi. You can refuse tips and offers when you sign up, in Account → Emails, or with the one-click link in each of them.
- AI features: when you use the editing assistant, your request and your page content are sent to Anthropic to produce the answer. Each request is logged with its credit cost.
- AI agents: if you create an agent key, we store its name, a hash of the key, its access level and when it was last used, and log each change it makes (with what's needed to undo it) for 90 days.
- Instagram: if you connect Instagram, we store an access token and copy your recent posts (image, caption, link) onto your page. Once a day we also read your account's statistics (followers, reach, views, interactions, likes and comments on recent posts, and the country, age and gender of your followers as percentages, never individual followers) for your media kit, which also shows your page's own visits and clicks. When you turn sharing on, anyone with its address (yourname/media-kit) can see it; it isn't listed in search engines. Disconnecting deletes the token and those statistics, and you can remove the copied posts too. See Data deletion.
- Referrals: if you sign up after following someone's referral link in the same visit, their referral code is stored on your account. Nothing is stored in your browser for this. The person who referred you sees how many people signed up with their link and how many of them pay, not who they are.
Why we use it, and on what basis
- Running your account and pages, AI features, Instagram and the media kit: our contract with you.
- Billing, invoices and accounting: our contract with you and our legal obligations (French commercial law keeps accounting records 10 years).
- Answering support messages: our contract with you if you have an account, otherwise our legitimate interest in answering people who write to us.
- Security, fraud and abuse prevention, and handling reports: our legitimate interest in keeping fayvi safe, and our obligations as a host.
- Product analytics in your browser (PostHog): your consent, given in the cookie banner.
- Key account events recorded by our servers and our business reporting: our legitimate interest in understanding how fayvi is used and how the business is doing. You can object (see Your rights).
- Tips, trial reminders and offers by email: our legitimate interest in telling our customers about fayvi's own services (French Postal and Electronic Communications Code, art. L.34-5). You can refuse them at sign-up and unsubscribe at any time.
If you visit a page
- Built-in analytics: for each view, click or QR scan we record the page or link, the time, the country (from our hosting provider), the referring website and the device type, and show the totals to the page's creator. We don't use cookies for this and don't store IP addresses. To stop fake visits and spam, we turn your IP address (and browser) into a scrambled code that changes every day; it's only used to count requests and is deleted after about a day. Our basis is our legitimate interest, and the creator's, in knowing how pages are used and keeping the numbers honest.
- Forms and mailing lists: what you submit goes to the page's creator, who decides what it is used for and is the controller of that data. We store it on their behalf and, if they set it up, forward it to their own tools or email them about it.
- AI chat: it's labelled as an AI assistant. Questions you ask are sent to Anthropic to write the answer, which comes only from the page's content; we don't keep the conversation. Don't share sensitive information there.
- Tracking added by the creator: some creators add Google Analytics or a Meta Pixel to their page. Each only loads if you allow it in the banner on that page, and you can change your mind with the “Cookies” button there. The creator decides to use them and what for; fayvi asks your consent and loads them. For that, the creator and fayvi act as joint controllers: fayvi answers for the consent banner, the creator for the use of the tools, and you can contact either of us. Google and Meta then use the data under their own policies.
- Embedded content: videos, music, maps and booking calendars from other services (YouTube, Spotify, Calendly…) only load when you tap “Load”. From then on, that service receives your IP address and its own privacy policy applies.
- Fonts: pages' fonts are served from our own servers; your browser doesn't contact Google for them.
- Reporting a page: if you report a page, we receive what you write in the form and, if you give them, your name and email to reply to you. Your report reaches us by email, and our email provider keeps a log of the receipt we send you.
If you use fayvi's own site and app
If you accept cookies, we use PostHog (in the EU) to understand how people use fayvi's website and app (never creators' pages): pages viewed, clicks and errors. PostHog then recognizes your browser across visits and, when you're signed in, links these events to your account and email. Until you choose, and if you decline, nothing is measured in your browser. Sessions are never recorded.
If you write to us through the support form, we receive your message, your email and name and, when you're signed in, which account it's about. It reaches us by email and is only used to answer you.
Our servers also record a few key account events in PostHog, whatever your cookie choice and without storing anything in your browser: signing up and in, creating, publishing and deleting a page, subscription changes and AI credit purchases. They're linked to your account.
For business reporting, we also copy part of our database into PostHog: account records (including email address, plan and dates), pages, tabs, blocks and QR codes, the built-in analytics of creators' pages (described above), AI credit use and AI agents' change log; and, from our email provider, the emails we sent (recipient, subject, delivery status) and its contact lists. From our database we never copy form entries, access tokens, agent keys or IP addresses. These copies follow our database: what's deleted here is removed from them within 30 days.
Who receives data
- Vercel (hosting; our servers run in Dublin, EU; US company)
- Supabase (database, sign-in and file storage, in Ireland, EU)
- Stripe (payments, as reseller and merchant of record; EU and US)
- Resend (sending emails; US)
- Anthropic (AI chat and editing assistant; US)
- PostHog (product and business analytics, in the EU)
- Meta, only if you connect Instagram: it acts on its own account, under its own policy.
Our providers process data only on our instructions, except Stripe for payments and Meta for Instagram, which act on their own account. Where they handle it outside the EU (mainly in the US), the transfer relies on the EU-US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses.
How long we keep it
- Account data and pages: while your account exists. If your subscription or trial ends, your account is kept (pages offline) so you can come back; you can delete it at any time.
- Analytics: while the page exists. Form entries: while the page exists, unless its creator deletes them sooner.
- Scrambled codes used against abuse: about 24 hours. AI agents' change log: 90 days. Sign-in session records: until the session ends.
- Invoices and payment records: kept by Stripe for as long as accounting law requires (10 years in France).
- Withdrawal requests and their confirmations: 5 years, as proof in case of a dispute, even if you delete your account. Support messages, page reports and our answers: 1 year after we've handled them.
When you delete your account, your profiles, analytics, form entries, QR codes, uploaded files and Stripe customer record are deleted right away, and your data in PostHog within 30 days. Our hosting providers' technical logs expire on their own within a few weeks. What the law makes us keep (invoices, withdrawal records) stays for the periods above.
Your rights
You can access, correct, export or delete your data, restrict or object to how we use it (including the server events, business reporting and offers based on our legitimate interest), withdraw your consent at any time (Cookie settings), and give instructions about your data after your death. Most of it can be edited in the app; Account lets you download a copy of your data and delete your account and its data. For anything else, write to support@fayvi.co; we answer within one month.
You can also complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of the EU country where you live.
Children
fayvi accounts are for people aged 16 and over. We don't knowingly collect data from younger children; if you think a child has given us data, write to us and we'll delete it.
Changes
We'll update this page when what we do changes, and tell account holders by email before important changes apply.