Privacy Policy

1. Who is responsible for your data

The controller for the personal data described here is Larksong sp. z o.o., ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland, registered under KRS 0001275290, NIP 7011337480, REGON 546037291. You can reach us at privacy@fenfill.com.

Where you use fenfill on behalf of an organisation and upload documents containing other people's personal data, that organisation is the controller of those documents and we act as its processor. In that case this policy describes how we process on your instructions, and our Data Processing Agreement applies.

2. The short version

• We store the blank document you upload and the field layout built from it. Documents are encrypted before they are stored, and the storage is in the EU.
• Pages you choose are sent to Google Gemini when you run field detection so the fields can be detected. Detection runs only when you choose to run it, on the pages you pick, and running it again sends those pages again. That is the only third party that sees the document.
• We never receive the answers. Filling a form and generating the finished PDF both happen in the browser of the person filling it. There is no upload path for form answers in the product, and an automated test in our build fails if anyone adds one.
• We do not run analytics, advertising or tracking scripts on our website or on the pages your recipients fill. The only cookies are the ones that keep you signed in.
• We never see your card details. Payments are handled by Stripe and our merchant of record, Link.

3. What we collect, and why

Account data

You sign in with Google or Microsoft. From that sign-in we receive your email address, your name and profile picture where the provider supplies them, and, for a Microsoft work account, your organization's name. We store your user id, your display preferences (such as the initials and colour on your avatar) and the time of your last sign-in. We use this to identify you, to secure the account and to contact you about the service. We never receive your password for those providers.

How you found us

If you reach fenfill from one of our ads, or from a link that names a campaign, we note the campaign tags in that link (the utm_ parameters), the first page you landed on and the name of the website you came from. When you create an account, we save these with it, once. We use them only to learn which of our own campaigns and pages work. We set no cookie for this, we don't store it in your browser, we don't record click identifiers, and we don't send it to any advertising platform, including the one that showed you the ad. It is deleted with your account.

Workspace and form data

For each form you create we store the blank PDF you uploaded (encrypted at rest), the field layout detected and edited for it, page preview images, the form's name, and technical metadata such as page count and file size. If you use custom branding, we store the logo you upload. Documents may contain personal data — whose, and why, is under your control, so please upload only what you are entitled to upload.

The API and the MCP server

If you use fenfill's API or the fenfill MCP server, we also store:

• API keys. For each key: its name, its first few characters (so you can recognise it), who created it, and when it was created, last used and revoked. We never store the key itself, only a cryptographic hash of it. We show you the key once, when you create it.
• Forms sent for analysis. The blank PDF you send (encrypted as soon as it reaches our servers), the analysis result (the fields found), and a job record: the file name, page count, page scans used, status (and the reason, if it failed), the API key that started it, timestamps, and technical and billing details of the job. Section 9 says how long we keep them.
• Template corrections saved through the MCP server. These are only the field layout and the form's own wording, never answers.

Sharing data

When you share a form we store the link's access grant: an identifier, the label you give the recipient, whether the link has been revoked, its expiry, and two content-free timestamps — when the link was first opened and when the recipient pressed the button that finishes the form. Those timestamps are how “who has finished” works. They record that something happened, never what was written. We also record that a form was filled, as a count against the form, so you can see which of your forms are in use.

Today fenfill does not email your recipients. You copy each link and deliver it yourself, so we hold no recipient email addresses. If we later add sending on your behalf, we will hold a recipient's email address only while a send is pending, delete it once the form is completed, update this policy and list the email provider below before the feature goes live.

Billing data

Paid plans are sold through Stripe Managed Payments, with Sold through Link, LLC (“Link”) as merchant of record. Stripe and Link collect and process your payment details as an independent controller, under their own privacy policies; we do not. From Stripe we receive and store your plan, its interval, its status, renewal and end dates, whether a cancellation is scheduled, and the customer and subscription identifiers that let us match a subscription to your workspace. Invoices and payment methods live in Stripe's billing portal, which we link to from Settings.

Reports of illegal content

If you report content through our report form, we receive the link, the reason you chose, your explanation and, if you give them, your name and email address. The form stores nothing on our servers: it emails the report to our abuse mailbox and, if you gave an email address, sends you a confirmation. We keep the report in that mailbox while we handle it and as long as we may need it to show how we handled it. We use it only for that.

Refund requests

When you use Cancel and request refund, we record who asked, when, and the identifiers of the subscription and payment concerned, and we email you a confirmation. The time of the request is what matters legally, so we keep that record with the billing records.

Support correspondence

If you email us, we keep the message and our reply so we can help you and keep a record of what was agreed.

Technical logs and error reports

Our servers keep operational logs — request timing, job outcomes, error codes and the internal identifiers of the workspace and job involved. When something crashes, the backend reports the error to our monitoring tool. That reporting is configured to leave personal data out: user emails, IP addresses and request headers are disabled, request bodies are never attached, and every URL is truncated before it leaves the server so that signed download links cannot travel with an error report.

4. What we never receive

The answers typed into a form never leave the device they are typed on. They live in the memory of the browser tab, they are turned into a finished PDF by code running in that same browser, and the file is saved locally by whoever filled it. There is no server that receives them, no database column that holds them, and no backup that contains them — so we cannot read them, hand them over, or lose them.

The only two messages a fill page ever sends back to us are deliberately content-free: one says “this form was opened” and carries a form identifier, and one says “this recipient opened / finished” and carries a link token and the word “opened” or “completed”. Nothing else.

This is enforced in our codebase, not just promised in this document: an automated test scans the fill code and fails the build if any form value is passed into a network call.

The same is true of the API and the fenfill MCP server. The MCP server fills forms on your computer: the answers your agent writes are stamped into the PDF there and are never sent to us or anywhere else. No part of our API accepts form answers. Only the blank form comes to us, to be analyzed, and the MCP server refuses to upload a PDF whose form fields already hold answers. It can't recognise answers handwritten or typed onto the page of a flat document, though, so please send only blank forms.

5. What stays on your device

• Draft recovery. While you fill a form, fenfill may save your progress to your own browser's storage so a reload or a crash does not lose it. The draft is encrypted with a key that exists only on that device and cannot be extracted from it, expires after a period of inactivity, is deleted when you export the finished PDF, and is never transmitted anywhere.
• Your signature. If you reuse a signature, the image is kept in your browser's local storage on that device only, so it is there next time. It is not uploaded.
• The MCP server's cache. If you use the fenfill MCP server, it keeps form layouts, blank forms, your workspace logo and the fonts it needs on your computer (blank forms and the logo are removed after an hour), never your answers. It writes filled PDFs where your agent asks, readable only by your user account. None of this is sent to us.
• You can clear both at any time by clearing site data for fenfill in your browser.

6. Legal bases for processing

Under the GDPR we rely on:

• Performance of a contract — running your account and workspace, storing and processing your documents to build forms, sharing links, and providing the plan you bought.
• Legal obligation — tax and accounting records for purchases, and responding to lawful requests.
• Legitimate interests — keeping the service secure and available, debugging failures, preventing abuse, and contacting you about material changes to the service. We limit these to what is necessary and keep the data minimal.
• Campaign attribution (how you found us) — our legitimate interest in knowing which of our own marketing works (Art. 6(1)(f) GDPR). You can object at any time; we will then delete the record.
• Consent — where we ever ask for it, for example marketing email you have opted into. You can withdraw consent at any time.

We do not make decisions about you based solely on automated processing.

Providing account data is necessary to use fenfill; without an email address we cannot create an account.

7. Who else processes data for us

We keep this list short on purpose. Each provider is bound by a data processing agreement and processes data only on our instructions.

Independent controllers. Link (Sold through Link, LLC, through Stripe Managed Payments) sells paid plans as merchant of record and processes your purchase data as an independent controller under its own privacy notice; it is based in the United States (see “Billing data” in section 3). Google and Microsoft act as independent controllers for the sign-in you use.

We do not use analytics, advertising, session-recording or A/B-testing services, and we do not sell or share personal data with anyone for their own purposes.

8. Where your data is, and transfers

Your documents and database records are stored in the European Union, and our processing servers are in the EU. Some of the providers above are based outside the EU or operate globally. Where data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, together with the technical measures described in section 10. You can ask us for details of a specific transfer.

9. How long we keep things

• Account and workspace data — while your account exists.
• Documents and form layouts — until you delete the form, or until your account is deleted.
• Frozen forms — when a form sits above your plan's limit it is frozen rather than deleted, and is then permanently deleted 60 days later if you have not upgraded. The deletion date is shown on the form.
• Sharing grants and their opened/finished timestamps — until you revoke or delete the link, or delete the form.
• Forms sent through the API that you don't save as a template. The blank PDF is deleted as soon as its analysis finishes. The analysis result is kept for at most 24 hours, or 1 hour after it is first fetched, whichever comes first. After 24 hours the file name is also removed from the job record. The rest of the record (when the job ran, its status, the page scans used and returned, which API key started it and which template it produced) stays as your workspace's usage history. It is deleted with your workspace, and in any case 6 years after the end of the year the job ran. Forms you save as templates through the API are kept like any other document and form layout.
• API keys. While your workspace exists. A revoked key stops working at once; its record (name, first characters, dates) stays in your key list.
• How you found us — kept with your account and deleted when the account is deleted.
• Billing records — for as long as tax and accounting law requires, typically several years, held largely by our merchant of record.
• Operational logs — kept for up to 30 days for debugging and security, then deleted.
• Error reports — kept by our error-monitoring provider for up to 90 days, then deleted automatically.
• Support email — kept while it is useful for supporting you, then deleted.
• Content reports — kept in our abuse mailbox while we handle the report and for as long as we may need to show how we handled it.
• Refund requests — kept with the billing records.

Deleting your account removes your workspace and the documents, layouts and sharing grants in it. Copies may persist briefly in routine backups before they age out. Records we are legally obliged to keep, such as invoices, are retained for the required period.

10. How we protect it

• Uploaded documents are encrypted in your browser before upload and the stored file is never readable without a key that is held separately from it. The storage bucket is private; every read is mediated by our servers.
• Forms sent through the API are encrypted on our servers as soon as they arrive, in the same way as files uploaded from the app. API keys are stored only as hashes, and accepted only in the Authorization header.
• Access to your forms is enforced in the database itself through row-level security, so a request can only ever reach the workspaces you belong to.
• Share links carry signed, revocable tokens, and every request re-checks revocation and expiry.
• The app sets a strict content security policy to limit what code can run on our pages.
• Everything is served over TLS.

No service can promise perfect security. If a breach affects your personal data and the law requires it, we will notify you and the competent supervisory authority without undue delay.

11. Your rights, and how to use them

If the GDPR applies to you, you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent where we relied on it. You also have the right to complain to a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), or the authority where you live.

Much of this you can do yourself: your documents and forms are downloadable from the dashboard, and Settings lets you delete your account outright. For anything else, write to privacy@fenfill.com from the address on your account and we will respond within one month.

One limit worth restating: we cannot give you a copy of the answers anyone typed into your forms, because we never had them.

12. Cookies and browser storage

fenfill uses strictly necessary cookies only — the session cookies that keep you signed in and protect the sign-in flow. We set no analytics, advertising or tracking cookies, and there are no third-party tracking scripts on our website or on the pages your recipients fill. That is why you are not greeted by a consent banner.

We also use your browser's own local storage for the on-device items in section 5, and for small conveniences such as remembering a view preference. Those stay on your device. If you choose to create a template before signing in, the PDF you picked is kept encrypted in your browser's storage while you sign in, and is deleted as soon as it's uploaded, when you discard it, or after 30 minutes.

Checkout opens on Stripe's own site (checkout.stripe.com), not inside our pages, and the billing portal opens on billing.stripe.com. Any cookies there are set by Stripe under its own privacy policy.

13. Children

fenfill is designed for professional use; anyone aged 16 or older may use it, and it is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, tell us and we will delete it.

14. Changes to this policy

We will update this policy when what we do changes — in particular, before enabling any new processing such as sending email to your recipients, or adding a provider to the list in section 7. The “last updated” date above always reflects the current version, and material changes are announced by email or in the app before they take effect.

15. Contact

Larksong sp. z o.o.
ul. Stefana Batorego 18/108, 02-591 Warszawa
Poland
KRS 0001275290, NIP 7011337480, REGON 546037291
Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy KRS
Share capital: PLN 5,000.00
privacy@fenfill.com