Privacy Policy
Last updated: 4 August 2026
This Privacy Policy explains how Fresko ("Fresko", "we", "us") collects, uses, shares and protects personal data when you visit fresko.ai, use the Fresko application at app.fresko.ai, or otherwise interact with us (together, the "Service").
1. Who we are
Fresko is the data controller for the personal data described in this policy. You can reach us about anything in this document at [email protected].
Registered entity name, registered address and, where applicable, EU representative and Data Protection Officer details are available on request and will be published here once confirmed by our legal team.
2. What we collect
2.1 Data you give us
- Account data — email address, name (if provided), authentication identifiers, and, where you sign in with Google, the basic profile data Google returns to us.
- Business data — the website URL you submit, social handles, brand assets you upload (logos, fonts, images), and any text you write into the product (briefs, edits to your Business DNA, campaign copy, feedback).
- Billing data — plan, subscription status and invoicing details. Card details are handled by our payment provider and are never stored on our systems.
- Support and beta data — messages, invite codes and feedback you send us.
2.2 Data we collect automatically
- Usage data — pages and screens viewed, features used, actions taken, timestamps, and referring pages.
- Device and connection data — IP address, browser type and version, operating system, device type, language settings.
- Cookies and similar technologies — see section 7.
2.3 Data we collect from third parties
- Public web content — when you submit a website URL, we fetch and analyse publicly available pages, images and metadata from that site in order to build your Business DNA.
- Connected platforms — if you connect a social account (for example Facebook or Instagram), we receive the account, page and publishing data those platforms make available under the permissions you grant. You can disconnect at any time.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service: analysing your site, generating strategy, ideas, copy and visuals, publishing posts you approve | Performance of a contract |
| Creating and securing your account, authentication, fraud and abuse prevention | Performance of a contract; legitimate interests |
| Billing, invoicing and tax records | Performance of a contract; legal obligation |
| Product analytics, debugging, quality monitoring and improving output quality | Legitimate interests |
| Service emails (transactional, security, account notices) | Performance of a contract |
| Marketing emails and non-essential cookies | Consent (withdrawable at any time) |
| Responding to legal requests and defending legal claims | Legal obligation; legitimate interests |
4. AI processing
Fresko uses large language models and generative image models to produce marketing strategy, copy and visuals. Content you submit — your website content, brand inputs and briefs — is sent to our model providers to generate that output.
- We contract with providers on terms that prohibit them from using your content to train their models.
- Generated output is stored in your workspace and is visible only to you and to authorised Fresko staff for support and quality purposes.
- AI output can be inaccurate. You are responsible for reviewing anything before publishing it.
- We do not use AI to make decisions producing legal or similarly significant effects about you.
5. Who we share it with
We do not sell personal data. We share it only with:
- Infrastructure and hosting — Google Cloud Platform, Cloudflare, Neon (PostgreSQL).
- AI model and prompt providers — the model providers that power generation, and Langfuse for prompt management and telemetry.
- Analytics — Amplitude and Google Tag Manager.
- Email delivery — Brevo.
- Payments — our payment provider, for subscriptions and invoicing.
- Social platforms — Meta (Facebook, Instagram) and any other platform you choose to connect, strictly to publish content you have approved.
- Professional advisers, acquirers and authorities — where necessary for legal, accounting or corporate-transaction reasons, or where we are legally required to disclose.
All processors act on our documented instructions under a data processing agreement. An up-to-date list of subprocessors is available at [email protected].
6. International transfers
Some of our providers are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism, together with additional technical safeguards such as encryption in transit and at rest.
7. Cookies
We use:
- Strictly necessary cookies — session, authentication and security. These cannot be switched off.
- Analytics cookies — to understand how the Service is used and to improve it.
- Marketing cookies — to measure campaign performance.
Non-essential cookies are set only with your consent, which you can change or withdraw at any time via your browser settings or the cookie controls on our site.
8. How long we keep it
- Account and business data — for as long as your account is active.
- After account deletion — deleted within 30 days, except where we must retain data for legal reasons.
- Billing and tax records — retained for the period required by applicable law (typically up to 10 years).
- Analytics and logs — retained in aggregated or pseudonymised form, typically up to 24 months.
- Scraped source material — retained only as long as needed to produce and refresh your Business DNA, then purged on a rolling schedule.
9. Your rights
If you are in the EEA or the UK, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing based on legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing carried out before withdrawal;
- lodge a complaint with your local data protection authority.
To exercise any of these, email [email protected]. We respond within one month. Depending on where you live, other local privacy rights may also apply to you.
10. Security
We protect personal data with encryption in transit and at rest, row-level access controls in our database, short-lived access tokens, least-privilege access for staff, and regular dependency and infrastructure review. No system is perfectly secure, but we will notify you and the relevant authority of a personal data breach where the law requires it.
11. Children
The Service is intended for business use and is not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will update the "Last updated" date above and, for material changes, notify you by email or in the Service before the change takes effect.
13. Contact
Privacy questions and requests: [email protected]
General enquiries: [email protected]