Privacy Policy

1. Who we are

Falen is operated by Kingspoint OÜ (organisation ID 12538207), a company registered in Estonia and trading as Falen, based in Tallinn, Estonia.

• Registered address: Jahu 1 - 95, Tallinn 10115, Estonia
• Organisation ID (registrikood): 12538207
• Privacy contact: privacy@falen.io

For data you enter about your organisation and its goals, your organisation is the controller and Kingspoint OÜ acts as processor. For account, billing and website data we are the controller in our own right. We have not appointed a Data Protection Officer, as we are not required to.

2. What personal data we collect

• Account data. Your email address (used for passwordless sign-in) and your name. Falen stores no passwords.
• Organisation data. Your organisation name and logo, departments and teams, and each member's role (member, lead, head or admin).
• Content you enter. Goal titles, metrics, target and current values, units, statuses, and the notes you write in check-ins. This content may contain personal data if you choose to put it there.
• Invited people. The email addresses (and names, where you provide them) of people you invite, held until they join or the invitation is removed.
• Billing data. Handled by Stripe. Falen stores only Stripe customer and subscription identifiers, plan status and billing email. We never see or store card numbers.
• Technical and error data. Standard server logs from our hosting provider, and client-side crash reports (error message, stack trace, page path) sent to our hosting provider's error reporting so we can fix faults.

We do not run product analytics, advertising or behavioural tracking, and we do not sell or share personal data. Falen has no AI features, so nothing you enter is sent to a model provider or used to train a model.

3. Why we process it, and our lawful basis

• Providing the service (accounts, sign-in codes, goals, check-ins, reminders) — performance of a contract, Art. 6(1)(b).
• Billing and subscription management — performance of a contract and compliance with accounting law, Art. 6(1)(b) and 6(1)(c).
• Security, fault diagnosis and abuse prevention — legitimate interests, Art. 6(1)(f), in keeping Falen available and secure.
• Service email to invited people — legitimate interests of the inviting organisation and of Falen in delivering the invitation, Art. 6(1)(f).
• Responding to your support or legal requests — Art. 6(1)(b) and 6(1)(c).

Where we process customer content on your behalf, we do so only on your documented instructions as processor.

4. Sub-processors and where data is processed

This is the complete list of third parties that process personal data for Falen.

Email from Falen is sent from noreply@falen.io via the verified subdomain notify.falen.io.

5. International transfers

Your application data is stored in the EU (AWS eu-west-2, London). Payments involve Stripe, and transactional email and error reporting involve providers whose processing may take place outside the EEA. Before any personal data is transferred outside the EEA, we intend to have a signed data processing agreement in place with the relevant provider and to rely on Standard Contractual Clauses (SCCs) for the transfer, plus the EU–US Data Privacy Framework certification or another adequacy mechanism where the provider has one. [REVIEW: confirm signed DPA + specific SCCs/transfer mechanism for each provider]

6. Retention

We keep account and organisation data for as long as your organisation has an active Falen account. After an account is closed we delete or anonymise customer content within 90 days of termination. Invitations that are never accepted are deleted when removed or when the account closes. Billing records are retained for as long as Estonian accounting law requires (currently seven years). Audit-log entries inside the app are currently kept for the life of the account with no automatic purge, and we make no retention guarantee. Server logs and client-side error reports are retained for 30 days. [REVIEW: confirm 30-day retention aligns with operational needs and provider defaults]

7. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable format. Where processing relies on consent, you may withdraw it at any time.

Falen does not yet have self-serve export or account-deletion tools, so these requests are handled manually. Email privacy@falen.io and we will respond within 30 days. If Falen is processing data on behalf of your employer, we will normally refer your request to them as controller.

You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

8. Security

Data is encrypted in transit with TLS and at rest by the underlying AWS/Supabase storage layer. Access is scoped per organisation by row-level security in the database. Sign-in is passwordless, using one-time codes sent by email, so no passwords exist to be stolen. Falen holds no SOC 2 or ISO 27001 certification of its own and has not had an independent penetration test. Our Trust & security page sets out the full picture, including what we don't have yet.

9. Cookies

Falen uses only strictly necessary storage: a session token that keeps you signed in, plus local storage used by the application to remember interface preferences. There are no analytics, advertising or third-party tracking cookies, which is why you see no cookie consent banner. Stripe may set its own cookies on its hosted checkout and billing pages, governed by Stripe's privacy policy.

10. Children

Falen is a business tool and is not intended for anyone under 16.

11. Changes to this policy

If we change this policy we will update the date at the top of the page, and for material changes we will notify account admins by email before the change takes effect.