Privacy Notice

This Privacy Notice explains how Cladeworks LLC ("we", "us"), trading as Fosterling, collects, uses, and shares personal data when you use our websites and services (the "Service"). For personal data we collect about you as our customer (the account holder), we act as the data controller. For personal data your organization uploads into the Service about your own clients, patients, donors, adopters, or animals, we act as a data processor on your behalf.

1. Categories of personal data we collect

• Account data — name, email, password hash, organization name, role.
• Profile and team data — display name, photo, time zone, notification preferences, team membership.
• Support messages — content of emails, chats, or feedback you send us.
• Usage and telemetry — pages visited, features used, error reports, approximate location derived from IP.
• Device and log data — IP address, browser/device identifiers, timestamps.
• Content you upload — records about animals, fosters, adopters, donors, volunteers, and lost/found reports. You are responsible for the legal basis on which you collect and upload this content.
• Payment-related identifiers — your Stripe customer ID, subscription ID, and billing metadata returned by Stripe. We do not see or store your full card or bank details; those are tokenized and held by Stripe, our payment processor.

2. Purposes and legal bases

• Provide the Service (contract): create your account, host your data, deliver features, send service emails.
• Security and fraud prevention (legitimate interests / legal obligation): authentication, abuse detection, audit logging.
• Customer support (contract / legitimate interests): respond to your requests.
• Product improvement and analytics (legitimate interests): aggregated usage metrics, performance monitoring.
• AI features (contract): processing your inputs to generate outputs (e.g. SOAP drafts, application screening, lost/found matches). We do not use your content to train third-party foundation models without your explicit instruction.
• Billing (contract / legal obligation): payments are processed by Stripe on our behalf; we receive only the metadata needed to provision and entitle your plan.
• Marketing (consent): only when you've opted in. You can withdraw consent any time.

3. Who we share data with

• Stripe (payment processor) — processes card payments, stores tokenized payment methods, and issues invoices on our behalf. Stripe is an independent controller for the payment data it collects directly from you at checkout. See Stripe's privacy notice.
• Infrastructure subprocessors — Supabase / Lovable Cloud (hosting, database, auth, storage), Cloudflare (CDN and edge runtime), OpenAI and Google (AI model inference for Fosterling AI features). These providers process data on our documented instructions only.
• Email delivery — Lovable Emails / Mailgun for transactional emails.
• Professional advisers — accountants and lawyers, where strictly necessary.
• Authorities — where required by law, court order, or to protect rights, safety, and security.

We do not sell your personal data or share it for cross-context behavioral advertising.

4. International transfers

We are based in the United States and many of our subprocessors operate globally. Where data is transferred out of the UK/EEA, we rely on appropriate safeguards (Standard Contractual Clauses or equivalent) provided by our subprocessors.

5. Retention

We keep account data for as long as your account is active and for a reasonable period afterwards to satisfy legal, accounting, and dispute-resolution obligations (typically up to 7 years for billing records). Content you upload is retained until you delete it or close your account; on account closure you may export your data for 30 days, after which we delete or anonymise it within 90 days. Backups are rotated and deleted within a further 35 days.

6. Your rights

Depending on where you live, you have the right to: access your personal data; correct inaccurate data; request deletion; restrict or object to certain processing; portability; withdraw consent; and lodge a complaint with your local data protection authority. Most of these can be exercised directly from your account settings. For anything else, email privacy@fosterling.io. We aim to respond within one month.

7. Security

We use appropriate technical and organisational measures, including TLS in transit, encryption at rest, row-level security in our database, scoped access controls, audit logging, principle-of-least-privilege for staff, and regular security reviews.

8. Cookies

We use a small number of strictly-necessary cookies for authentication and session management, and optional analytics cookies (only if you accept them) to understand product usage. You can clear or block cookies from your browser settings; doing so may break parts of the Service.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them.

10. Changes

We may update this notice; material changes will be announced through the Service or by email.

11. Contact

Data controller: Cladeworks LLC · privacy@fosterling.io.