Privacy Policy

This policy explains what personal data Faylee collects, why, who helps us process it and the choices you have. Faylee is made by UpTech doo Beograd-Čukarica (“UpTech”, “we”, “us”), Nedeljka Čabrinovića 33, 11030 Belgrade, Serbia, registration number 21629499, tax ID 112220768. You can reach us at hello@faylee.app.

1. Who is responsible for your data

Faylee is used by teams, which we call workspaces. Two roles apply, depending on whose data it is.

• Account data, such as the name and email of people who sign up, and how they use Faylee: we decide how it is used, so we are the controller.
• Recording data, meaning everything a workspace captures or receives through Faylee: the workspace decides what to record and keep, so the workspace is the controller and we are its processor. We handle it only to run Faylee for that workspace and as this policy and our Terms of Service describe.

If you sent a recording to a company through a Faylee recording link or a widget on its website, that company is responsible for your recording. Please contact it about your data. We will help it answer you.

2. What we collect

Account and workspace data

• Name, email address and password (stored only as a secure hash), or your Google profile name and email if you sign in with Google.
• Your workspace, its members, roles, invitations, settings and connected tools.
• What you tell us during onboarding, such as the kind of work you do.
• Security records, such as two-factor settings, API tokens (stored as hashes) and an audit log of important changes in your workspace.

Recording data

A recording is made only when a person chooses to make one, or when a workspace's visitor sends one through a recording link or the site widget. Depending on how it was made, a recording can include:

• Video of the screen, window or tab the person chose to share, and audio from the microphone if they turned it on.
• A replay of the web page itself (its structure and changes, recorded with rrweb) and screenshots.
• The page's console output and errors.
• The network requests the page made, with their addresses, headers and bodies.
• The steps taken, such as clicks, typing, navigation and scrolling.
• Device details: browser and version, operating system, screen size, language, time zone and connection quality.
• Anything the person adds: a title, a description, drawings, comments and attachments, and for a recording link or widget, the name and email they chose to give.

Before anything leaves the browser, Faylee hides secrets it can recognize: authorization headers, cookies, tokens and passwords in headers, bodies and addresses, and password and payment fields on the page. Workspaces can add their own rules, and websites can mark private parts of a page with the data-faylee-mask attribute so they are never recorded. Automatic redaction cannot recognize every piece of personal data, so please record only what you need.

Data made from recordings

If the workspace's plan includes it, we transcribe spoken narration and our assistant writes a title, a summary and the likely cause of a bug. We also make thumbnails and previews.

Billing data

Paid plans are sold through Polar, our Merchant of Record. Polar collects card and billing details directly. We receive only what we need to manage your plan, such as the subscription status, number of seats and billing period. We never see full card numbers.

Usage and technical data

Our servers log requests (IP address, browser, time and the page or API endpoint used) to keep Faylee secure and working. If you allow it, the Faylee extension and command line tool send us reports of errors they hit, which we keep for 30 days. We do not use advertising trackers or sell your data.

Cookies on our website

On faylee.app we use Google Analytics to count visits and see which pages people read, but only if you accept it in the cookie banner. It then sets cookies named _ga and _ga_ followed by an ID, which last up to two years, and Google receives your IP address, browser details and the pages you visit. If you decline, no analytics cookies are set. Your choice is kept in your browser's local storage, and you can change it at any time with Cookie settings at the bottom of the page.

3. Why we use it, and our legal basis

Purpose	Legal basis (GDPR)
Providing Faylee: accounts, workspaces, recordings, sharing, integrations and the assistant	Performance of our contract with you or your workspace
Billing, invoices and tax records	Contract and legal obligation
Security, fraud and abuse prevention, debugging	Our legitimate interest in keeping Faylee safe and working
Service emails, such as invitations, notifications and plan changes	Contract
Product news, if you subscribed	Consent, which you can withdraw at any time
Website analytics with Google Analytics, if you accepted it	Consent, which you can withdraw at any time

We do not use recording data to train AI models, and the AI providers we use do not train on it under our agreements with them.

4. Who processes data for us

We use service providers to run Faylee: hosting and database providers, cloud storage for recordings (unless a workspace connects its own storage bucket), email delivery, payment processing through our Merchant of Record, AI providers for the assistant's summaries and answers, a speech to text provider for narration, and Google for Sign in with Google and, if you accept it, for analytics on our website. Each processes data only to provide its service to us, under a data processing agreement.

The companies we use, what each does and where, are listed on our subprocessors page. We update it before adding or replacing one.

When a workspace connects tools such as Linear, Jira, GitHub, Slack or Sentry, Faylee sends recording details to them when its members ask it to. Those tools are chosen by the workspace and handle the data under their own terms.

We may also disclose data when the law requires it, to protect people's safety or our rights, or to a buyer if UpTech's business is sold, under this policy.

5. International transfers

Faylee's servers are in the United States, so data is transferred outside Serbia and the European Economic Area. We rely on the EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where a provider is certified, and equivalent safeguards under Serbian law.

6. How long we keep data

• Recordings on the Free plan are deleted 14 days after they are made. On Team and Enterprise, the workspace chooses how long to keep them, and by default they are kept until someone deletes them.
• Deleted recordings stay in the workspace's trash for 30 days, then are removed for good.
• Account data is kept while the account exists. When an account or workspace is deleted, we remove its data within 30 days, except where the law requires us to keep records, such as invoices.
• Server logs and error reports are kept for up to 30 days.
• Backups are overwritten on a rolling basis, so deleted data can remain in them for a limited time.

7. The Chrome extension

The Faylee extension for Chrome lets you record bugs on any website you choose. Here is what it does with data.

• What it collects: on pages where it runs, it can capture the page's content and changes, console output, network requests, your clicks and typing as steps, device details, and, when you ask it to, screenshots, screen video and microphone audio. These are the recording data described in section 2.
• Instant replay: if you turn it on, the extension keeps the last few minutes of a page in your browser's memory, so you can save a bug that just happened. It stays on your device and is thrown away unless you save it.
• When data leaves your device: only when you save and share a capture to your workspace. Captures are redacted in your browser before they are uploaded, as section 2 describes. You can block sites the extension should never record, and your workspace can block them for everyone.
• What it does not do: it does not record in the background without your instruction, does not sell data, does not use data for advertising or credit decisions, and does not let people read your data except as needed to run Faylee, for security, or when the law requires it.

The use of information received from Google APIs and Chrome by Faylee adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

8. Security

Data is encrypted in transit with TLS and at rest by our providers. Access inside workspaces follows members' roles, sharing links can expire and require sign-in, and workspaces can turn on two-factor authentication, single sign-on and audit logs. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent you gave. Write to hello@faylee.app and we will answer within 30 days. For recording data a workspace controls, we will pass your request to that workspace. You can also complain to the Commissioner for Information of Public Importance and Personal Data Protection of Serbia, or to the data protection authority where you live in the EU.

10. Children

Faylee is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect data from children.

11. Changes

We may update this policy as Faylee changes. We will post the new version here with a new date, and tell workspace owners by email about important changes before they apply.

12. Contact

UpTech doo Beograd-Čukarica, Nedeljka Čabrinovića 33, 11030 Belgrade, Serbia. Email: hello@faylee.app.