Privacy Policy
Documents submitted only for analysis are processed temporarily: analysis history keeps results and possible quotations, not the original file or its full text. Documents saved in Files remain in your workspace until you delete them. Here we explain what data we handle, who receives it and how to exercise your rights.
Privacy at a glance
Encryption in transit and at rest
HTTPS (TLS 1.2+) in transit and AES-256 at rest in the database. Documents saved in Files are retained in the workspace.
AI processing
Content submitted for analysis is processed by an external AI provider. See the provider register and applicable terms below.
Your GDPR rights
Access, rectification, erasure and portability: email us and we will respond within the applicable GDPR timeframe.
EU-region database
The database is hosted in AWS Frankfurt via Supabase. Some providers may process data outside the EEA; see the Security Center and current contractual terms.
1. Who we are
Fencia helps organize documentation and evidence for EU AI Act readiness, partial GDPR review and ISO/IEC 42001 mapping. We operate online at fencia.co.
Fencia is the controller of account and contact data. The contracting entity's registered identity and address require confirmation in the current contractual documents. You can contact us at contact@fencia.co.
2. Data we collect
Account data
- Full name
- Email address
- Company name (optional)
- Credentials managed by Supabase Auth
Documents submitted for analysis
- PDF, DOCX, TXT files uploaded for analysis
- URLs submitted for scanning
- Documents retrieved from integrations (Google Drive, Dropbox, OneDrive)
Fencia sends the content needed for analysis to the AI provider named in the register. It does not retain the original file or full text after analysis; results can include quotations. The provider's use and retention depend on the applicable terms.
Evidence requests
- Request and participant details
- Attachment metadata, notes and links
When responding to an evidence request, the attachment passes temporarily through the Fencia server and is forwarded through the email provider to the requester. Fencia does not retain the file: it stores its name, size, type and SHA-256 fingerprint, together with submitted notes and links. Before sending, the person receiving the request should check who the requester is and whether sharing the information is appropriate. The email provider and the requester’s mailbox may retain the attachment under their terms and settings.
Spending import
- Aggregates for selected tools
During spending import, the bank or card statement is read in your browser. When you confirm your selection, the server receives only aggregates for the selected tools: catalog identifier, charge and month counts, first and last detected dates, and totals by currency. These summaries are saved in the inventory; the statement file and its full transaction rows are not sent.
Documents saved in Files
- Documents created, edited or saved from the agent
- Title, Markdown content and links to findings or systems
This content is stored in the workspace for review, sharing or deletion. PDF and DOCX downloads are generated from the saved content.
Signals from connected sources
- Recent messages in Slack channels accessible to the integration
- Repository names and supported dependency manifests from GitHub
- Source name, detected tool and short excerpts that may be kept as evidence for review
These reads occur when the available Shadow AI checks run for each source. GitHub does not import documents or patrol repositories on a schedule.
Usage and metrics data
- Number of analyses performed
- Readiness indicator and findings generated
- Dashboard activity history
- Technical access logs held by the hosting provider
Billing data
- Subscription and plan history
- Payment data processed by Paddle, our reseller (Fencia never receives card numbers)
- Invoices and transaction confirmations
Paddle acts as reseller and merchant of record for our sales: it processes the payment, calculates taxes and issues the invoice. For payment data it is an independent controller under its own privacy policy.
3. How we use your data
Provide the service
Analyze your documents, prepare reports with findings for review and keep your dashboard updated.
Manage your account
Authentication, quota management, scan history and profile settings.
Billing and payments
Manage subscriptions and plan changes with Paddle, which processes payments and issues invoices.
Customer support
Answer your queries, resolve incidents and improve service quality.
Security and fraud prevention
Rate-limit sign-in attempts, protect platform integrity and meet legal obligations.
Product improvement
Analyze aggregated usage metrics (no personal data) to improve features.
4. Legal basis for processing
Performance of contract (Art. 6.1.b GDPR)
Processing necessary to provide the service you subscribed to.
Legitimate interest (Art. 6.1.f GDPR)
Platform security, fraud prevention and service improvement via aggregated metrics.
Legal obligation (Art. 6.1.c GDPR)
Retention of invoices and accounting records under applicable tax law.
Consent (Art. 6.1.a GDPR)
Marketing communications and newsletters, when you have given explicit consent.
5. Sub-processors and third parties
We use hosting, authentication, payment and AI analysis services. Some may process data outside the EEA. You can inspect the provider register, purposes and listed locations below.
View providers and locations
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (AWS Frankfurt) (EU region) |
| Vercel | Application hosting | EU / USA (SCCs) |
| Microsoft (Azure AI Foundry · modelo DeepSeek) | AI document analysis (text only; images are read first by our own OCR; partial identifier pseudonymisation before sending, not anonymisation) | EU (EU Data Zone) (EU-only processing · Microsoft DPA) |
| Paddle | Payments, taxes and invoices as reseller | UK (headquarters) (Independent controller; see its policy) |
| Resend | Transactional email | USA (SCCs) |
| Cloudflare (Turnstile) | Bot protection on forms | Global (SCCs) |
| Vercel Analytics | Aggregated usage metrics, no cookies | USA (SCCs) |
| GitHub Actions (backups) | When backups are enabled: temporary dump processing on the runner and encrypted artifact retention for up to 30 days; first backup and restore verification still pending | Runner and storage locations to be confirmed (Artifact encrypted with age; agreement and transfers to be confirmed) |
The register describes safeguards listed for each provider. The existence and scope of each transfer agreement must be confirmed in the current contractual documents.
6. Data retention
7. Your GDPR rights
Access (Art. 15)
Request a copy of all your personal data we process.
Rectification (Art. 16)
Correct inaccurate or incomplete data in your profile.
Erasure (Art. 17)
Request deletion of your data ('right to be forgotten').
Restriction (Art. 18)
Restrict processing of your data in certain circumstances.
Portability (Art. 20)
Receive your data in a structured, machine-readable format.
Objection (Art. 21)
Object to processing based on legitimate interest or for marketing.
To exercise any of these rights, send an email to contact@fencia.co stating the right you wish to exercise and your registered email address. We will respond within the applicable GDPR period, generally one month. If you believe processing is not compliant, you may lodge a complaint with a data protection authority in the EEA.
8. Data security
These are the technical measures we apply today:
9. Changes to this policy
We may update this Privacy Policy when the service or its data processing changes. We will publish the updated version and show its review date at the top of this document.
Questions about your privacy?
We are available to answer any questions about the processing of your personal data.