1. Who we are

Fowsi Mohamoud Dayib (Fomad)
Based in Africa
Email: info@fomad.net

2. What this policy covers

This policy explains how personal data is handled in:

• the fomad.net website, including the contact form and the security audit request form;
• Fomad Chatbots, the platform at fomad.net/chatbots where professionals and agencies ("users") create AI chatbots for the businesses they work with ("clients");
• chatbots built on Fomad Chatbots and shown on clients' websites or systems.

For Fomad Chatbots accounts, Fomad is the data controller. For conversations that website visitors have with a chatbot, Fomad processes data on behalf of the user and their client, as explained in section 5.

3. Contact and audit request forms

When you send the contact form we receive your name, email address, company (optional), purpose and message.

When you request a Web Privacy & Security Audit we receive the company name, contact person, email, phone (optional), business ID (optional), country, the domains to audit and the name and title of the person signing. We create the signed authorisation PDF from this information and email it to Fomad.

We use this data only to answer your enquiry and deliver the requested service. Legal basis: Article 6(1)(b) GDPR (steps at your request before a contract, and the contract itself) and Article 6(1)(f) GDPR (our legitimate interest in answering business enquiries). Enquiries are kept for up to 24 months from the last contact. Audit data is kept for up to 12 months from the audit, as stated in the audit agreement, unless a longer period is agreed or required by law.

4. Fomad Chatbots accounts

When you create and use an account we process:

• first name, last name, email address and, if you add it, phone number;
• your password, stored only as a one-way Argon2 hash; we can never see it. If you sign in with Google, we receive your name, email address and Google account ID, and nothing else from your Google account;
• when you accepted the Terms and whether your email address is confirmed;
• what you create in the dashboard: clients (business name, contact details, description and notes), chatbots and their settings, knowledge you enter, widget appearance, allowed websites, and the prices you choose to record;
• billing records: invoices, the chatbots they cover, and the payment references you submit;
• technical data needed to run and secure the service, such as session cookies and server logs.

Purpose: providing the platform, billing, security, support and keeping you informed about your account. Legal basis: Article 6(1)(b) GDPR (performance of the contract), Article 6(1)(c) GDPR (bookkeeping obligations under applicable accounting and tax law) and Article 6(1)(f) GDPR (security and abuse prevention). We do not sell your data or use it for advertising.

5. Chatbot conversations on clients' websites

When a visitor chats with a chatbot, we store the messages, the date and time, the website the chat was opened on, a random session ID and a one-way hash of the visitor's IP address. We do not store raw IP addresses, and the chat widget does not set cookies on the client's website.

Roles. The client business (and the user acting for it) decides why the chatbot is used and what it collects, so they act as the data controller for visitor data. Fomad processes that data only to run the chatbot, on their instructions. A data processing agreement is available on request.

Users and clients are responsible for the data they collect and use through their chatbots, including: having a lawful basis, telling visitors about the chatbot in the client's own privacy notice, not asking visitors for sensitive data the client has no right to process, and answering visitors' data protection requests. Users must not put personal data into a chatbot's knowledge unless they are entitled to share it with website visitors.

6. AI providers and international transfers

Chatbots answer using an AI provider chosen by the user: OpenAI or Google Gemini. Each chatbot uses the user's or client's own API key, so the provider processes the request under that key holder's agreement with the provider. To answer a question we send the provider the visitor's message, recent messages from the same conversation, the chatbot's instructions and the relevant business knowledge. When a chatbot's knowledge is large, parts of it are also sent to the provider to create search indexes (embeddings).

These providers may process data outside the European Economic Area, including in the United States, under their own data processing terms and transfer safeguards. Users should check that their chosen provider and plan meet their clients' requirements.

7. How we protect data

• All traffic is encrypted with HTTPS, and browsers are told to always use HTTPS.
• AI provider API keys are encrypted in our database with keys kept separately from it. A key is only decrypted on our server at the moment it is needed. It is never sent back to any browser (the dashboard only shows its last 4 characters), never included in the chat widget and never written to logs.
• Passwords are stored as one-way Argon2 hashes. Sign-in, registration and password reset are rate limited.
• Each account can only access its own clients, chatbots, keys, conversations and invoices. Administrator access is limited to Fomad staff and every administrator action is recorded.
• The chat runs in an isolated window on fomad.net, so the client's website cannot read the conversation. Visitor sessions are signed and expire after one hour, and each chatbot has rate limits, message size limits and usage caps. Users can restrict a chatbot to their client's own websites.
• Visitor IP addresses are stored only as one-way hashes.

No system is completely secure, but we design every part of the platform with security first.

8. Other service providers

• our hosting provider, which runs the servers and database;
• our email provider, used to send account, password reset and form emails;
• Google, for "Sign in with Google" when you choose to use it;
• Google Analytics and Google AdSense on the public website (see section 10);
• payment providers you choose to pay with, such as Stripe payment links, banks or crypto networks. We only store the payment reference you submit, never card details.

9. How long we keep data

• Account data: while your account is active.
• Chatbot data and conversations: while they belong to an active account. When an account is deleted, its clients, chatbots, knowledge, keys and conversations are deleted with it.
• Invoices and payment records: as long as applicable accounting and tax law requires. If an account has invoices, deleting it deactivates the account and keeps those records; you can ask us to delete the rest of its data.
• Server logs: rotated automatically and kept only for a short period for security and troubleshooting.
• Contact and audit data: as described in section 3.

10. Cookies and analytics

Fomad Chatbots uses two essential cookies while you are signed in: a session cookie and a security (CSRF) cookie. They are needed for the service to work and are not used for tracking. The chat widget on clients' websites does not use cookies.

The public fomad.net website uses Google Analytics to understand aggregate site usage and Google AdSense, which may set cookies as described in Google's own policies. "Sign in with Google" loads Google's sign-in service, which may also set Google cookies.

11. Your rights

Under the GDPR you have the right to:

• Access: get a copy of the personal data we hold about you
• Rectification: have inaccurate data corrected
• Erasure: have your data deleted where no legal obligation requires us to keep it
• Restriction: limit how your data is processed in certain cases
• Objection: object to processing based on legitimate interests
• Portability: receive your data in a structured, machine-readable format

Write to info@fomad.net and we will answer within 30 days. If you chatted with a chatbot on a business's website, please contact that business first, as it controls that data; we will help it answer your request.

12. Complaints

You can lodge a complaint with the data protection authority in the country where you live or work. In the European Union and the EEA, this is your national data protection supervisory authority. We would appreciate the chance to resolve your concern first, so please contact us at info@fomad.net before you do.

13. Changes to this policy

We may update this policy as the services change. The date at the top shows the latest version. If a change significantly affects Fomad Chatbots users, we will tell account holders by email. See also our Terms of Service.