Privacy Policy
Last updated: 18 September 2026
FOVARO ("we", "us", "our") is a UK sole trader based in Boston, Lincolnshire. This policy explains what personal data we collect, why, and what rights you have.
1. Who we are
FOVARO, Boston, Lincolnshire, UK. Contact: hello@fovaro.co.uk
2. What we collect
Account data: your email address, used to create your account and give you access to the app. After your purchase, we send you a sign-in link by email so you can access your account and the FOVARO app.
Progress data: your quiz answers, scores, and study progress, so the app can save and restore your progress.
Payment data: payment is handled entirely by Stripe. We only receive confirmation that payment was made and the email address used at checkout — we never see or store your card details.
3. Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, giving you access to the app you paid for | Performance of a contract | |
| Saving and showing your own progress and results | Quiz/progress data | Performance of a contract |
| Processing your payment | Email, payment confirmation | Performance of a contract |
| Responding to support queries | Email, message content | Legitimate interests (providing customer support) |
4. Who we share it with
Supabase — hosts our database and handles account login. Supabase acts as a data processor, processing this data only on our instructions.
Stripe — processes payments. Stripe acts as a data processor when taking your payment on our instructions, but Stripe also independently acts as a data controller for its own purposes (such as fraud prevention and its own legal and regulatory obligations) — see Stripe's Privacy Policy for how Stripe uses data in that capacity.
We don't sell your data or share it with anyone else.
5. International transfers
Supabase: your account and progress data is hosted in Supabase's Frankfurt, Germany data centre (region eu-central-1). Germany is within the European Economic Area, which the UK recognises as offering an adequate level of data protection under UK GDPR — so this does not involve a restricted international transfer. Supabase's own documentation notes that routine service operations such as backups, logs, or underlying sub-processors could still involve limited processing outside the EEA; this is governed by Supabase's Data Processing Agreement and its standard safeguards.
Stripe: Stripe is a US-based company, and payment data may be processed outside the UK as part of Stripe's global infrastructure, under Stripe's own safeguards (see Stripe's Privacy Policy above for details).
6. How long we keep it
We keep your account and progress data for as long as your account remains active. If you ask us to delete your account, we will delete your account and associated personal data within 30 days of receiving a valid deletion request, unless we are legally required to retain particular information (for example, payment records for tax purposes), which we keep only for as long as the law requires.
7. Your rights
Under UK GDPR you have the right to access, correct, delete, restrict, or export your personal data, and to object to how it's used. To exercise any of these, email hello@fovaro.co.uk. We aim to respond within one calendar month.
8. How to complain
If you're unhappy with how we've handled your data, contact us first at hello@fovaro.co.uk. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or by calling 0303 123 1113.
9. Local storage
The app stores your progress on your device (local storage) as well as on our server, so your progress is saved immediately and reliably even if the connection to our server is briefly interrupted. This is strictly necessary for the app to work and isn't used for advertising or tracking.
10. Changes to this policy
We may update this policy from time to time. Changes will be posted on this page.