Privacy policy.

What we collect

We may process name, email address, phone number, company details, project information, usage data and technical security logs.

Why we use it

We use this data to respond to requests, deliver services, secure accounts, improve the website and meet legal obligations.

Analytics and cookies

On public website pages we use Google Analytics with Google Consent Mode: until you give consent no analytics cookies are set and measurement stays anonymous, without recognising or tracking you. Analytics cookies are only placed after your consent. Admin, portal and webmail environments do not show the public cookie banner.

We also use Umami, a self-hosted analytics service. Umami sets no cookies, needs no consent and processes no personal data: it only measures anonymously which pages are viewed and which campaign visitors come from.

Only after you accept cookies do we also use Umami to see anonymously where visitors click and how they move through the site; input in form fields is masked.

The FSVoip app

FSVoip lets you make and receive calls through a FullStack Studio phone system. For the phone system data (calls, voicemail, recordings and the business address book) the organisation that uses the phone system is the controller; FullStack Studio processes that data on its behalf.

When you pair the app we store a device key, an installation ID, the extension the app is paired with, the app version and a device name. For incoming calls we use an Apple push token (PushKit/APNs) so the app can ring while closed; a push contains only the caller's number and name, never a password. We keep a log of sent pushes for 30 days.

The app shows calls, voicemail, recordings and contacts of your phone system according to the permissions your administrator set. Calls are encrypted (TLS and SRTP) through the phone system.

The app only asks for permissions when a feature needs them: the microphone for calls and for recording sounds for your phone system, the camera only to scan the pairing QR code (no photos are stored), and the contacts on your phone to show names; those contacts stay on your phone and are not sent to us. Face ID or your passcode is handled by iOS; we receive no biometric data.

Notifications for incoming calls go through the push services of the operating systems: Apple Push Notification service (iPhone) and Firebase Cloud Messaging by Google (Android). Only a technical push token and the call data needed to wake the app (caller number and name, extension) are sent, never the content of a conversation. When you unpair the app, the push token is removed. Want data from the app removed? Unpair the app in the portal or email [email protected].

The app contains no ads, no trackers and no third-party analytics. When you unpair the app or your administrator removes the pairing, the device key and push token are invalidated.

The FullStack Studio app

The FullStack Studio app opens your customer portal on your iPhone and sends you notifications about invoices and support questions. FullStack Studio remains the controller of the data in your customer portal; the app is an extra way to reach it.

When you sign in and turn on notifications we store your email address and name (from your portal account), a device ID, the model and the iOS and app version, the Apple push token (APNs), your notification preferences and the IP address the device registered from. A push notification contains only a title, a short text and a reference to the right page in the portal, never a password or access token. Amounts only appear in a notification if you turn that on yourself.

Notifications we send you are kept for 180 days in the app's inbox and then deleted. The app contains no ads, no trackers and no third-party analytics. Your sign-in credentials are kept in your phone's secure storage (Keychain). The app only asks for permission to show notifications.

Signing out in the app revokes that device's access and removes the push token. You can also delete your account in the app: your login account is then removed immediately and we receive a request to handle the remaining data. Data we are required to keep, such as invoices and the customer file, remains.

Suppliers

Our websites, mailboxes, phone systems and client portal run on our own systems on servers in data centres in Europe. We use suppliers for some parts, including Moneybird (accounting), Mollie (payments), Cloudflare (security and DNS), Hetzner (encrypted backups), Maxitel, EK Media and Twilio (telephony), BulkGate (SMS), Openprovider (domain names), Anthropic (AI features), Mistral or OpenAI (voicemail to text, if enabled), ElevenLabs (computer voice, if used), Google (Analytics with consent, reCAPTCHA), Apple (push notifications) and Slack (internal notifications). Suppliers outside the European Economic Area are only used with appropriate safeguards.

Call recordings are kept for 90 days and voicemail for 30 days. Accounting records and signed documents are kept for 7 years.

Your rights

You can request access, correction, deletion or restriction of your personal data by contacting [email protected].