Your organisation
Your organisation is typically the controller for personal data its users add to a company account. It chooses the purpose, lawful basis, connected sources, members, permissions and retention needs.
Trust · Privacy & GDPR
This notice explains what CEO Dashboard processes, why it is needed, who can access it, which services receive it, and how to exercise your rights or raise a complaint. It distinguishes current safeguards from work still planned.
Responsibility
The role depends on why the information is processed.
Your organisation is typically the controller for personal data its users add to a company account. It chooses the purpose, lawful basis, connected sources, members, permissions and retention needs.
Fotando Solutions Sp. z o.o. typically acts as processor for data handled to provide the service, following the customer’s instructions and the product configuration.
Fotando acts as controller for account administration, prospects and demo requests, billing contacts, service security, support, and its own legal obligations.
Authorised members can see company information according to membership and role. Shared Addy conversations and decisions are visible to members of that company, not only their author.
Data and purposes
Email address, account identifier, sign-in data, trial status and account preferences.
Create and secure the account, authenticate users, provide support and administer the service.
Company name, members, invitations, roles, names, work emails, departments, locations and reporting lines when entered.
Provide company collaboration, access control, organisation views and accountable work allocation.
KPIs, plans, financial entries, tasks, RACI assignments, calendars, hypotheses, decisions, proposals and activity summaries.
Operate the dashboard, calculate views, coordinate work and retain decision context.
Documents, page text, search chunks and embeddings, Addy prompts and replies, uploaded text, selected passages and AI-generated proposals.
Provide knowledge search, grounded answers, drafting, analysis and shared Addy history.
Connector configuration, mappings, synchronisation status, credentials or access headers, and the business values fetched from a source chosen by the customer.
Refresh selected company metrics and diagnose connection failures.
Audio submitted when a user chooses voice input and the resulting transcript.
Convert speech to text for the requested interaction. The application does not save the raw recording in its own database.
Waitlist email; or demo name, work email, company, role, team size, revenue band and stated challenges.
Respond to interest, qualify and arrange a requested product conversation.
Payment customer and subscription identifiers, status and period; recipient, invite and notification content.
Administer subscriptions, access and expected service emails.
We rely on performance of a contract to provide requested account features; legitimate interests for service security, improvement, support and requested business contact; consent where a feature or applicable law requires it; and legal obligations for records we must keep. The appropriate basis depends on the purpose and relationship.
Storage, access and sharing
Data is not made public by default.
Account and company content is stored in the application’s managed database. Access rules scope company records to authenticated members and reserve administrative or decision actions for authorised roles.
When an AI feature runs, the prompt and relevant company context, documents, search passages, attachments, public-site research or audio may be sent through Lovable’s managed AI service to selected model providers.
We use managed services for database and authentication, AI processing, app email and payment processing. Customer-configured connectors also exchange data with the systems the customer chooses.
Processing location can vary by managed service, model provider and customer-selected connector. We do not claim that every processing operation remains in the EU; transfer safeguards must reflect the actual service chain.
A customer-facing subprocessor register, completed contractual documentation and verified regional hosting options are planned and are not represented as currently available here.
Retention and rights
Company content, conversations and account records remain while needed to provide the account unless removed through an available product action or a verified request. Some billing, security or legal records may need to be kept longer.
When a knowledge page is removed and the index synchronises, its derived search chunks are removed. Copies in conversation history or other records are separate and are not implied to be deleted by that action.
Workspace- and connector-level retention schedules are planned; customers cannot currently configure an automatic expiry period in the product.
A single self-service flow for account export, access and erasure is planned. Until then, send a verified request to trust@fotando.global.
Depending on the law and our role, you may request access, correction, deletion, restriction, portability, or object to processing. Include your account email, organisation, the right you wish to exercise and enough detail to locate the information. We may ask for identity or authority verification. If Fotando processes the data only for your organisation, we may refer the request to that organisation as controller.
Safeguards
Private product areas require an authenticated account. Sensitive server actions validate that identity again.
Database access rules check company membership before workspace data is read or changed.
Administrative, editing and decision rights are separated. Read-only members cannot update company data.
Server operations validate their inputs; payment callbacks verify signatures; public website research blocks private-network destinations.
No system can promise absolute security. Please do not place passwords, private keys, unnecessary special-category data or unrelated personal information in prompts, documents or connectors. Report a suspected incident to trust@fotando.global.
Requests and complaints
There is no fixed service-response promise in this notice.
Email trust@fotando.global with the account, organisation and issue.
We may confirm identity, authority, scope and the responsible controller.
We review relevant records, services and people and may ask focused questions.
We explain the outcome and any correction, deletion, restriction or other action available.
We respond within the time required by applicable law. You may also complain to the data-protection authority where you live or work, or where you believe an infringement occurred. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).
Official sources
Privacy and AI contact
Fotando Solutions Sp. z o.o. · Uladzimir Ausianikau, CEO. Contact us about personal data, AI behavior, safeguards, or your deployment.
This page is product information, not legal advice or a certification. Your obligations depend on your organisation, data, integrations, and use case.