Skip to content

Privacy policy

Last updated: October 13, 2026

This policy explains what data Foliot (usefoliot.com) collects, why we collect it, and what you can do about it. We keep it short and plain. If anything is unclear, email hello@usefoliot.com.

Who we are

Foliot is run by Vlad Poncea, an individual based in Romania, who is the controller of your account data. In this policy, “we” and “us” mean Vlad Poncea. Contact: hello@usefoliot.com.

The short version

  • We collect only what we need to run your account and your workflows.
  • No analytics, no advertising, no tracking cookies. We never sell your data.
  • Your data is stored in the EU (Germany and Ireland).
  • Connection secrets and Google tokens are encrypted.
  • Finished runs are deleted automatically after 30 days.

What we collect

Your account

  • Your name and email address.
  • Your password. It is stored hashed by our sign-in library (Better Auth). We never see or store it in plain text.
  • A session cookie that keeps you signed in. It is essential, set only for our own domain, and not used for anything else.
  • The IP address and browser (user agent) of each signed-in session, so we can keep your account secure. We also use IP addresses briefly to rate-limit sign-in and sign-up attempts.
  • Your light or dark theme choice. This stays in your browser’s local storage and is never sent to us.

Your workflows and runs

  • The workflows you build and their settings.
  • Run history: the data a trigger received (webhook payloads, form submissions, schedule details), plus each step’s input and output. This lets you see what happened and fix problems.
  • Finished runs are deleted automatically after 30 days.

Your connections

When you connect a service, we store what is needed to use it: Slack webhook URLs, HTTP sign-in credentials, and Google OAuth tokens. These are encrypted at rest with AES-256-GCM. We never show them back to you in full, and secret values are scrubbed from stored run data.

People who fill in your forms

If you share a Foliot form, the people who submit it give their data to you. For that data, you are the controller and we process it on your behalf, only to run your workflow. We also use the submitter’s IP address briefly to limit abuse (short-lived rate-limit counters). If you submitted someone’s form and have questions about your data, contact the person who owns the form.

Emails we send

  • Account emails: email verification, password resets, and a notice if someone tries to sign up with your email address.
  • Run-failure alerts, if you turn them on. At most one per workflow per hour.
  • Emails your workflows send through a “Send email” step. You choose the recipients and the content. They are sent from noreply@mail.usefoliot.com.

Data you send to other services

“HTTP request” and “Post to Slack” steps send the data you set up to the destinations you choose. Once it arrives there, that service’s own privacy policy applies.

Google user data

Foliot can add rows to a Google Sheets spreadsheet when your workflow runs. This only happens if you choose to connect your Google account.

What we ask for

  • openid and email: to show which Google account is connected.
  • https://www.googleapis.com/auth/spreadsheets: to work with the spreadsheet you choose.

How we use it

We use Google user data only to:

  • read the tabs and header row of a spreadsheet you choose, so you can map fields in the editor;
  • add rows to that spreadsheet when your workflow runs.

What we never do

  • We do not read other spreadsheets or any other Google data.
  • We do not use Google data for advertising.
  • We do not sell Google data.
  • We do not use Google data to train AI or machine learning models.
  • No person reads your Google data, except with your permission, to investigate security issues or abuse, or to comply with the law.

Storage and removal

We store:

  • the Google OAuth tokens, encrypted at rest;
  • the connected Google account’s email address, shown as the connection’s name;
  • the spreadsheet link, tab name and column headers you set up in a step;
  • the values of each row Foliot added, as part of that run’s history. Like all runs, this is deleted after 30 days.

Removing the connection on the Connections page in Foliot deletes the stored tokens and the account email, so Foliot can no longer reach your Google account. To also remove Foliot from your Google account’s list of connected apps, go to myaccount.google.com/permissions.

Foliot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where your data lives

We use a few providers to run Foliot:

  • Vercel: hosting. Our functions run in Frankfurt, Germany.
  • Neon: the PostgreSQL database, on AWS in Frankfurt, Germany.
  • Resend: email delivery, on AWS in Ireland.
  • Google: only the Google Sheets API, and only when you connect Google.

Vercel, Neon and Resend store and process your data in the EU. Rows you add to Google Sheets are stored by Google under your Google account’s terms, which may be outside the EU. Where a provider may process data outside the EU, it relies on the European Commission’s Standard Contractual Clauses.

Why we process your data (legal bases)

  • Contract: to provide Foliot to you, including your account, workflows, runs, and emails.
  • Legitimate interests: to keep Foliot secure, prevent abuse, and rate-limit requests.
  • Consent: to connect your Google account. You can withdraw it at any time by removing the connection in Foliot or at myaccount.google.com/permissions.

How long we keep it

  • Finished runs: 30 days, then deleted automatically.
  • Rate-limit counters: a short time, then they expire.
  • Account, workflows, and connections: until you delete them or ask us to delete your account.

Deleting your account

There is no delete button in the app yet. Email hello@usefoliot.com and we will delete your account and its data within 30 days. Backups held by our database provider are removed shortly after, on their own schedule.

Your rights

Under the GDPR, you can ask us to:

  • give you a copy of your data (access);
  • correct it (rectification);
  • delete it (erasure);
  • limit how we use it (restriction);
  • send it to you in a portable format (portability);
  • stop using it, where we rely on legitimate interests (objection).

Email hello@usefoliot.com to use any of these rights. You can also complain to the Romanian data protection authority (ANSPDCP) at dataprotection.ro, or to the authority in your own country.

Children

Foliot is not for anyone under 16. Please don’t sign up if you are under 16.

Changes to this policy

If we make a material change, we will tell you by email or on the site before it takes effect. The date at the top shows when this policy last changed. See also our Terms of service.

Contact

Questions or requests: hello@usefoliot.com.