--- title: "Fohrkast Privacy Policy" description: "How Fohrkast handles account, billing, support, scan, consent, and website-compliance data." canonical: "https://fohrkast.com/privacy" group: "Legal" updated: "2026-06-29" --- # Privacy Policy Fohrkast's privacy policy covers how it handles your account, billing, support, website scans, and consent records. Fohrkast acts as a controller for its own users and operations, and as a processor when you use Shield or compliance tools to manage end-user consent and hosted policy documents. ## Summary This page provides general information about Fohrkast's own operations. It is not legal advice. Fohrkast is a controller for its own users, account data, billing data, product telemetry, support requests, and public website scans that Fohrkast decides to run. Fohrkast is a processor when a customer uses Shield or related tools to handle end-user consent records and hosted compliance documents for that customer. ## Personal Data We Process - Account and organisation details such as name, business email, company name, role, and authentication identifiers. - Billing and tax metadata handled through Lemon Squeezy, our merchant of record, including customer identifiers, subscription status, invoices, VAT details, and payment status. Lemon Squeezy is the seller of record and processes payments; Fohrkast does not store full card numbers. - Support and DSAR details that a person gives us when asking for help or exercising a data protection right. - Shield consent records such as consent state, policy version, timestamp, domain, and technical proof fields needed to show consent history. - Website scan data about public websites, including URLs, detected compliance signals, public company identifiers, and non-personal technical evidence. ## Purposes and Lawful Bases - We process account, subscription, and product data to provide the service and perform our contract with customers. - We process billing, tax, fraud-prevention, security, and accounting data to comply with legal obligations and protect legitimate interests. - We process support, DSAR, and operational messages to respond to requests and run the service. - We process public website scan data for legitimate interests in providing a compliance scanning and claim workflow, subject to suppression and opt-out controls. ## AI Processing Fohrkast uses standard templates for generated legal documents. AI fills customer-specific details into those templates and stores template version and legal source citations. Before sending prompts to an AI provider, Fohrkast minimises and redacts personal data where it is not needed for the task. AI output is general information, not legal advice. Customers remain responsible for reviewing their own published materials. ## International Transfers Fohrkast keeps personal data in EU-hosted Supabase and Vercel regions where the product controls allow it. Some sub-processors may process limited data outside the EEA. Fohrkast documents data processing agreements, standard contractual clauses, and transfer safeguards for its AI and billing providers where relevant. ## Data Retention - Account, subscription, and audit records are kept while the account is active and then for the period needed for tax, security, dispute, and legal purposes. - Consent proof logs are kept for up to 12 months and then automatically deleted, unless deletion is required earlier. - DSAR requests are kept long enough to verify completion, prevent duplicate handling, and meet accountability duties, and completed or rejected requests are automatically deleted after 12 months. ## Your Rights People in the EEA and UK can ask for access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where applicable. Use the DSAR page to submit a data-subject request. We may need to verify identity before acting on a request. People can also complain to the Irish Data Protection Commission or their local supervisory authority. ## EU Representative (Article 27 GDPR) Fohrkast is established outside the European Union, so under Article 27 GDPR we have appointed Prighter EU Rep GmbH as our representative in the Union. Data subjects in the EEA and supervisory authorities can contact our EU representative on all matters related to the processing of personal data, in addition to or instead of contacting Fohrkast directly. EU representative: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. You can also reach the representative by email at support@prighter.com. ## Frequently Asked Questions **How long do you keep consent records?** Shield consent proof logs are kept for up to 12 months and then automatically deleted, unless deletion is required earlier. **Who processes payments?** Lemon Squeezy is the merchant of record and seller of record for subscriptions. Fohrkast does not store full card numbers. Lemon Squeezy handles checkout, subscriptions, invoices, customer portal, EU VAT, global tax, and payment processing. **Can I ask for my data?** Yes. People in the EEA and UK can submit a data-subject request via the DSAR page for access, rectification, erasure, restriction, portability, or objection to processing. Fohrkast may need to verify identity before acting on a request. **Where is my data stored?** Fohrkast keeps personal data in EU-hosted Supabase and Vercel regions where product controls allow it. Some sub-processors may process limited data outside the EEA under documented standard contractual clauses. **Is this legal advice?** No. This page provides general information about Fohrkast's own operations and is not legal advice. AI-generated documents are also general information, not legal advice, and customers remain responsible for reviewing their own published materials. ## About Fohrkast Fohrkast is a cookie-consent and website-compliance scanning tool built to help businesses handle consent and compliance records. Fohrkast is operated by Abhinv Das (sole trader) trading as Fohrkast, based in India, and provides Shield for consent management and automated readiness scans. --- Source: https://fohrkast.com/privacy This is automated readiness information, not legal advice or a guarantee of conformance. Last reviewed 2026-06-29.