Privacy Policy

Last updated 4 October 2026

This policy explains what personal data Fairpage collects, why, how long we keep it, who else handles it, and your rights.

1. Who is responsible

Aleksandar Stevanovic PR, Milana Rakica 12, Belgrade, Serbia, tax number (PIB) 107446371, runs Fairpage and is the controller of the data this policy describes. Write to [email protected] about anything in it.

Visitors of our customers' sites. When you visit or fill in a form on a site built with Fairpage, the site's owner decides what happens with your data and is its controller; we process it for them under our Data Processing Agreement. Section 5 describes what Fairpage itself does with it. For anything else, contact the site's owner.

2. What we collect and why

The waitlist

• What: your email address and when you joined. To stop automated sign-ups we check the request with Cloudflare Turnstile, which receives your IP address, and we count sign-ups per IP address for an hour without storing it.
• Why: to send you one invitation to create an account. We do not send marketing.
• Legal basis: your request to join (steps before a contract).
• How long: until your account is deleted if you create one; otherwise 12 months.

Your account

• What: your name, email address and password (stored only as a bcrypt hash); your sessions; your command-line tool sign-ins (with the device's name); password reset requests; recent sign-in attempts with the IP address they came from.
• Why: to give you an account, keep it secure and stop password guessing.
• Legal basis: our contract with you; for security, our legitimate interest in protecting accounts.
• How long: sessions 7 days; command-line sign-ins until revoked or 90 days unused, then removed the next night; password reset links 1 hour, removed the night after they are used or expire; how often an address and IP address asked for a reset link, 1 day; sign-in attempts 30 days; the account until it is deleted.

Your sites and your work

• What: the sites you build and their content, your membership and role on each site, invitations you send and receive (with an optional note), the history of changes with who made them, connections you set up (their API keys are stored encrypted), and your conversations with the AI assistant, including what it read and changed.
• Why: to provide the service.
• Legal basis: our contract with you.
• How long: until the site or your account is deleted. Change history keeps the last 50 changes per site.

Payments

Polar (polar.sh) sells our plans as merchant of record and is the controller of the payment details you give it. We receive your email address, what you bought and its status, and keep that while the site exists and as long as tax and accounting law requires.

Emails we send

Invitations, welcome messages, password resets, notices about your site's plan, form entries from your sites, and notices about your site's connections. We send them through Cloudflare's email service. Like our pages, they load their typeface from Bunny Fonts, which receives the IP address of the device that opens them. These are part of the service; we send no newsletters or marketing.

Error reports

• What: when something fails in Fairpage, a report of the error: where in the code it happened, the kind of request, your browser's user agent, and the ids of your account and the site. Its message can include other data from the request. We send it to Sentry, which stores it in the EU without IP addresses.
• Why: to find and fix faults.
• Legal basis: our legitimate interest in a working, secure service.
• How long: at most 90 days.

Visiting fairpage.co

• We set one cookie, effortless_session, and only when you sign in, to keep you signed in. Fairpage's operators get a second, effortless_impersonator, while they view the service as a user to help them. Your browser also stores your light or dark theme choice and the state of the assistant panel in local storage. Both are strictly necessary or set at your request, so we do not ask for consent.
• We count visits to fairpage.co with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not identify you; it records the page, where you came from, your country, and your browser, operating system and device type. Our legal basis is our legitimate interest in knowing how the site is used. We use no advertising or tracking.
• Our pages load their typeface from Bunny Fonts (BunnyWay d.o.o., Slovenia), which receives your IP address to deliver it and does not log it.
• Every request passes through Cloudflare, which handles traffic and security for us and receives your IP address.

3. AI processing

When you use the AI assistant, we send your request and the parts of your site it needs (files, content rows, the page you are on, images you attach) to Cloudflare Workers AI, which runs the AI models on Cloudflare's servers and neither stores what it is sent nor trains on it. The reply comes back to us and is stored with your site's conversation. We do not use your content or prompts to train AI models. Do not put sensitive personal data into your requests.

4. Who else handles the data

We use the providers on our sub-processor page to host, deliver, email, bill, run AI and report errors for Fairpage. Each receives only what it needs and is bound by a data processing agreement. We do not sell personal data and do not share it for advertising.

We disclose data to authorities only when the law requires it.

5. Data of our customers' site visitors

For the sites our customers build, Fairpage processes:

• Form entries: what a visitor types into a site's form, stored in that site's database and emailed to its owner or sent to the services the owner connects. We use the visitor's IP address to limit repeated posts and, when the site has the check on, send it to Cloudflare Turnstile; we do not store it.
• Analytics: for each page view, the page, where the visitor came from, their country (from Cloudflare), and their device type, browser and operating system. To count unique visitors without cookies, we combine the IP address and browser with a random value that changes every day and keep only a short hash of the result; the IP address itself is not stored, and the daily value is deleted, so the hash cannot be traced back. Views are combined into daily counts every night; the counts are kept 1 to 5 years depending on the site's plan.
• Cookies: Fairpage sets no cookies on customers' sites.

6. Where the data is

We are in Serbia. Fairpage's servers and databases are hosted in the European Union. Some providers, including Cloudflare and Polar, are in the United States or work worldwide. For transfers out of the EU and Serbia we rely on adequacy decisions, the EU–US Data Privacy Framework where the provider is certified, or the European Commission's standard contractual clauses.

7. Security

Connections are encrypted with TLS. Passwords are hashed, sign-in and reset tokens are stored only as hashes, and API keys you give us are encrypted. Each site's content has its own database. Only the operator can access production systems.

8. Backups

We keep backups of our servers to recover from failures. Deleted data stays in them until they expire, at most 90 days later.

9. Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable form. To use them, email [email protected] from your account's address; we answer within 30 days. To delete your account or a site, email us the same way.

You can complain to Serbia's Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) or, in the EU, to the data protection authority where you live.

10. Children

Fairpage is for people 18 and over. We do not knowingly collect data from children; if you think we have, tell us and we will delete it.

11. Changes

We may update this policy. For changes that matter, we email account holders before they take effect. The date at the top shows the latest version.