Frauger

1. Who we are

Frauger is a privacy-first online forms service operated by Aleksi Suoknuuti, based in Finland. You can reach us at info@aleksisuoknuuti.com. As the operator of this service we are the data controller for the personal data described in this policy.

2. What data we collect

We collect only the data that is necessary to provide the service:

Account data — your email address, used to send magic-link sign-in emails and to identify your account.
Session data — a session token stored in a cookie to keep you signed in. Sessions expire after 7 days of inactivity. We also record your IP address and browser user-agent string at sign-in for rate-limiting and security purposes; this data is retained only for the duration of the session.
Form data — the forms you create, including their fields and configuration.
Response data — answers submitted by respondents to your forms.
Billing data — your subscription plan. Payment is processed by Polar (see Section 5); we do not store payment card details.

3. Why we process your data (legal basis)

Contract performance — processing your email address and form/response data is necessary to deliver the service you signed up for (Article 6(1)(b) GDPR).
Legitimate interests — keeping session logs to prevent abuse and maintain security (Article 6(1)(f) GDPR).

4. Data storage and security

All data is stored on servers located within the European Union. We use encrypted connections (TLS) for all data in transit. Access to the database is restricted to the application and authorised personnel only.

5. Third-party processors

We share data with the following sub-processors solely to operate the service:

Email provider — your email address is passed to our Finnish email hosting provider to deliver magic-link sign-in emails. All email traffic remains within the EU.
Polar.sh — handles payment processing and subscription management. Your email address and an anonymised customer ID are shared with Polar when you subscribe to a paid plan.

We do not sell, rent, or share your data with any other third parties for advertising or marketing purposes.

6. Cookies

We use a single session cookie to keep you signed in. This cookie is strictly necessary for the service to function. We do not use tracking, analytics, or advertising cookies.

7. Data retention

We retain your account and form data for as long as your account is active. Inactive accounts with no forms may be deleted after 2 years. You can delete your data at any time by contacting us (see Section 9).

8. Your rights under GDPR

As a data subject in the EU/EEA you have the following rights:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure — request deletion of your account and all associated data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests.
Right to lodge a complaint — you have the right to lodge a complaint with your national supervisory authority. In Finland this is the Office of the Data Protection Ombudsman.

9. Contact & data requests

To exercise any of your rights, or if you have questions about this policy, please email us at info@aleksisuoknuuti.com. We will respond within 30 days.

10. Data collected via forms you fill in

If you fill in a form created by one of our users, your responses are stored on behalf of that user (the form creator). The form creator is the data controller for your submitted responses. To exercise your data rights regarding those responses — such as requesting access, correction, or deletion — please contact the form creator directly. We are not able to act on data subject requests relating to form responses on behalf of our users' respondents.

11. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify you by email. Continued use of the service after the effective date constitutes acceptance of the revised policy.