This Privacy Policy explains what personal data FoliMesh collects, why, how long we keep it, who we share it with and what rights you have. It applies to the website folimesh.com and its subdomains, the editor, the API, the MCP server and all related services (the "Service").
1. Data controller
The controller of your personal data is individual entrepreneur Voliansky Filipp Andriyovych (ФОП Волянський Філіпп Андрійович), 9 Boryspilska Street, Kyiv, 02099, Ukraine, ІПН 3346817571 ("we", "us").
For any privacy question or request, write to support@folimesh.com with the subject "Privacy".
We process personal data in accordance with the Law of Ukraine "On Personal Data Protection" and, where it applies to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR.
2. What data we collect
2.1. Data you give us
- Account data: your email address; optionally a display name.
- Content: text descriptions and other prompts you submit to AI features, generator parameters, uploaded reference images where this feature is offered, and messages you send to support.
- Order data: the Plans and Packs you buy, amounts, currency, dates and order status.
2.2. Data collected automatically
- Usage data: Downloads and AI Credits used, exported Assets and their parameters, API and MCP requests made with your keys.
- Technical data: IP address, browser type and version, device type, operating system, language, referring page, and timestamps, recorded in server logs of our hosting provider.
- Cookies: see section 8.
2.3. Data from payment providers
We receive from the payment provider the status of your payment, the amount, the currency, a payment identifier and, where provided, the masked card number (for example, the last four digits) and the card's country. We never receive or store your full card number, CVV or card expiry date.
3. Why we use your data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your Account, sign you in | Email, technical data | Performance of the contract |
| Provide the Service: generation, exports, AI features, API | Account, content, usage data | Performance of the contract |
| Process payments and deliver purchases | Order and payment data | Performance of the contract |
| Accounting, tax and legal obligations | Order and payment data | Legal obligation |
| Send service emails: sign-in links, receipts, subscription notices, changes to terms | Performance of the contract; legal obligation | |
| Prevent fraud and abuse, protect the Service | Technical and usage data | Legitimate interest |
| Improve the Service, fix errors, understand which features are used | Aggregated usage and technical data | Legitimate interest |
| Send news and offers | Consent (you can withdraw it at any time) |
We do not use your data for automated decisions that produce legal effects concerning you, and we do not sell your personal data.
4. AI features
When you use an AI feature, the text of your request and the generator parameters needed to answer it are sent through Vercel AI Gateway to an AI model provider (for example, OpenAI, Anthropic or Google). We send only what is needed for the request and do not send your email or payment data. Under the terms we use, providers do not use this data to train their models. Please do not include personal data in your prompts.
5. Who we share data with
We share personal data only with service providers who process it on our behalf under data processing agreements, and only to the extent necessary:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | European Union (Ireland) |
| Vercel Inc. | Website hosting, server functions, AI Gateway | European Union and United States |
| Resend (Plus Five Five, Inc.) | Sending emails | United States |
| JSC "Universal Bank" (monobank) | Payment processing | Ukraine |
| AI model providers via Vercel AI Gateway | Processing AI requests | United States and other countries |
| GitHub, Inc. | Source code hosting (no user data) | United States |
We may also disclose data where required by law, a court order or a request of a competent authority, or to protect our rights in a dispute.
6. International transfers
Some providers process data outside Ukraine and the European Economic Area, in particular in the United States. Such transfers are made on the basis of adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
7. How long we keep data
- Account data and content: while your Account exists, and up to 30 days after deletion (backups up to 90 days).
- Order and payment records: 3 years after the end of the year of the transaction, or longer if required by Ukrainian tax and accounting law.
- Download and licence history: while your Account exists, so that we can confirm your licence to Assets; after deletion we keep a minimal record (order identifier, Asset parameters, date) for 3 years to resolve licence questions.
- Server logs: up to 90 days.
- Support correspondence: up to 2 years after the last message.
8. Cookies and local storage
We use only cookies that are strictly necessary for the Service:
- authentication cookies set by Supabase to keep you signed in;
- security cookies of our hosting provider used to protect against attacks.
We do not use advertising or third-party tracking cookies. If in the future we add analytics or marketing cookies, we will ask for your consent first and update this Policy. You can delete cookies in your browser at any time; you will then be signed out.
9. Security
We protect data with encryption in transit (HTTPS/TLS), encryption at rest provided by our infrastructure providers, access restricted to authorised persons, row-level access rules in the database and separate administrator roles. No method of transmission or storage is completely secure; if a personal data breach occurs that is likely to result in a risk to you, we will notify you and the competent authority as required by law.
10. Your rights
Subject to applicable law, you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten"), except where we must keep it by law;
- restrict processing;
- object to processing based on legitimate interest;
- data portability — receive your data in a machine-readable format;
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua); in the EU — the data protection authority of your country of residence.
To exercise your rights, write to support@folimesh.com from your Account email. We respond within 30 days. We may ask you to confirm your identity.
11. Deleting your Account
You can request deletion of your Account at any time at support@folimesh.com. After deletion, unused Downloads, AI Credits and Subscriptions are forfeited, and you lose access to your download history. Licences to Assets you downloaded lawfully remain valid, as described in the License Agreement.
12. Children
The Service is not intended for children under 16. We do not knowingly collect personal data of children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to this Policy
We may update this Policy. The current version and its effective date are published at folimesh.com/privacy. We will notify registered users of material changes by email at least 14 days in advance.
14. Contact
ФОП Волянський Філіпп Андрійович 9 Boryspilska Street, Kyiv, 02099, Ukraine ІПН 3346817571 Email: support@folimesh.com