1. Controller
The controller is 160418 OÜ, registry code 17524983, Narva mnt 5, 10117 Tallinn, Estonia. Privacy: illia@160418.com. Support: hello@fabulica.com.
2. Data
- Account: name, email, user ID, language, role and settings.
- Brand workspace: descriptions, voice, materials, prompts, drafts and outputs.
- Social: requested public content, metadata and necessary integration tokens.
- Usage: IP, device, browser, timestamps, errors, sign-ins and feature events.
- Billing: plan, status, amount, currency, address, tax ID and Stripe IDs. Stripe stores full card details.
- Communications: support, analytics consent and service messages.
3. Purpose and legal basis
| Purpose | GDPR basis |
|---|---|
| Accounts, features, generation, subscriptions | Contract, Art. 6(1)(b) |
| Security, fraud prevention, diagnostics, legal protection | Legitimate interests, Art. 6(1)(f) |
| Accounting, tax, authorities | Legal obligation, Art. 6(1)(c) |
| Google Analytics and optional cookies | Consent, Art. 6(1)(a) |
| Marketing email if introduced | Consent or lawful interest with opt-out |
4. AI processing
We may send the prompt and needed context to the selected AI provider. Do not submit unnecessary personal data, special-category data, secrets, payment credentials or data you cannot lawfully process. Fabulica makes no solely automated decisions producing legal or similarly significant effects about you.
5. Recipients
Access is limited to needed staff and providers: Supabase, Vercel, Stripe, Resend, Google for consent-based analytics, AI providers and social integration providers. Categories appear in the DPA. Stripe may independently control payment/compliance data.
6. International transfers
Outside the EEA we use adequacy decisions, EU Standard Contractual Clauses and additional safeguards where required. Request the applicable mechanism by email.
7. Retention
- Account/workspace: while active, then normally up to 30 days.
- Backups: up to 90 days after live deletion.
- Security/diagnostic logs: normally up to 90 days.
- Support: up to 24 months after closure.
- Financial/tax records: up to 7 years or the legal period.
- Consent and acceptance: as long as needed to demonstrate compliance.
Longer retention may apply to disputes, incidents or mandatory duties.
8. Cookies
Necessary storage supports sessions, language, security and registration. Google Analytics loads only after consent. See the Cookie Policy.
9. Your rights
You may request access, correction, deletion, restriction and portability, object to legitimate-interest processing and withdraw consent. Email illia@160418.com. We may verify identity and normally respond within one month.
10. Complaints
Contact us or complain to the Estonian Data Protection Inspectorate or your local authority.
11. Security
We use access control, encryption in transit, logging, least privilege and provider reviews. No system is completely secure. We notify high-risk breaches as law requires.
12. Children
Fabulica is not directed to children. Only people able to contract may create an account. Contact us if a child submitted data.
13. Changes
We update this Policy with the product and law. We provide advance in-product or email notice of material changes where practical.