This is an English translation provided for information only. The Slovak version of this Privacy Policy is the only legally binding version.
In short
This overview is for quick orientation only. The full information is below.
- Your personal data is processed by WCR Technologies s. r. o., based in Bratislava. Send any questions to studio@wcr.sk.
- We only process what we need to run your account, payments, support and the security of the Service. We do not sell your data or use it for advertising.
- Data is stored in the European Union (DigitalOcean, Amsterdam). Some providers, for example for AI features, may also process data in the US, always with legal safeguards.
- Data you store in frego about your clients and collaborators is processed only on your instructions, with us acting as processor. This is governed by the Data Processing Agreement.
- We use no analytics or advertising tools and no third-party tracking cookies.
- If you delete your account, your data is permanently erased after 30 days. We keep longer only what the law requires, such as accounting records.
- You have the right to access, rectify, erase, restrict and port your data and the right to object. You may lodge a complaint with the Slovak Office for Personal Data Protection.
Article 1 – Controller and contact
1.1 The controller of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") and Slovak Act No. 18/2018 Coll. on the protection of personal data is:
WCR Technologies s. r. o. Karpatské námestie 7770/10A, 831 06 Bratislava – Rača, Slovakia Company ID (IČO): 57261733 registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, file No. 192642/B e-mail: studio@wcr.sk
(the "Operator" or "we").
1.2 This policy applies to the frego web application and its public pages (the "Service"). Capitalised terms have the meaning given in the Terms of Service (the "Terms").
1.3 For any data protection matter, including exercising your rights, contact us by e-mail at studio@wcr.sk or by post at our registered address.
1.4 We have not appointed a data protection officer (DPO), as the GDPR does not require us to. Your requests are handled directly by the Operator at the contact above.
Article 2 – When we are controller and when processor
2.1 As controller we process personal data of Users and of people who communicate with us, in particular user account data, billing and payment data, support communication, security and technical records and data needed to send service e-mails. This policy applies to that processing.
2.2 As processor we process personal data that a User stores in the Service about other people, in particular about their clients, contacts and Project Members, contained in tasks, comments, notes, invoices, files and the Vault. The controller of that data is the User, who decides on its purpose and scope; we process it only on the User's instructions under the Data Processing Agreement. If you are a client or collaborator of a User and want to exercise your rights regarding that data, please contact that User first; on request we will help them handle your request.
Article 3 – What personal data we process and where we get it
3.1 Account data: name, e-mail address, password (stored only as a secure hash), profile photo if you upload one, language and other account settings, data about your Plan, Trial Period, AI credits and acceptance of the Terms (version and time of acceptance).
3.2 Data from Sign in with Google: if you register or sign in with a Google account, Google provides us with your e-mail address, basic profile data (name and possibly photo) and your Google account identifier. We may also receive security notifications from Google concerning your Google account (for example if it may have been compromised) so that we can protect your frego account.
3.3 Google Calendar data: if you turn on Google Calendar sync, we process the data needed for it to work, in particular access tokens (stored encrypted) and event data (title, description, start and end time).
3.4 Billing and payment data: when you order a Subscription or AI credits — billing name, e-mail, address, company ID, tax ID or VAT ID, and data about the Subscription, payments and invoices. You enter your card details directly with the payment service provider Stripe; we have no access to them.
3.5 Communication: the content of e-mails and requests you send us (support, complaints, withdrawal from the contract, exercising your rights) and questions you ask the Frego helper.
3.6 Withdrawal data: who withdrew, from what and when, and technical data about the submission (for example browser data).
3.7 AI usage data: records of AI actions (type of action, time, AI credits used and technical data about the request).
3.8 Technical and security data: sign-in and session data (for example IP address and browser type), application logs, error reports and the change history of tasks and projects, and records of administrator actions on the account (for example blocking, unblocking or closing the account, granting a Subscription).
3.9 Data from other Users: if another User invites you to their Project, they provide us with your e-mail address and your role in the Project so that we can send you the invitation.
3.10 We obtain the data under points 3.1 and 3.4 to 3.7 directly from you, the data under points 3.2 and 3.3 from Google, the data under point 3.9 from the inviting User and some payment data from Stripe. Technical data is generated automatically when you use the Service.
Article 4 – Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Registration, account management, sign-in (including with Google) and provision of the Service, including features you turn on (e.g. Google Calendar sync) | Art. 3.1–3.3, 3.8 | performance of a contract – Art. 6(1)(b) GDPR |
| Subscriptions, payments, AI credits, invoicing | Art. 3.4, 3.7 | performance of a contract – Art. 6(1)(b) GDPR |
| Bookkeeping and tax obligations | Art. 3.4 | legal obligation – Art. 6(1)(c) GDPR |
| Handling withdrawals and complaints, recording consents under consumer protection law | Art. 3.5, 3.6 | legal obligation – Art. 6(1)(c) GDPR |
| Service e-mails (e-mail verification, invitations, notifications, order confirmations, reminders about the end of the Trial Period and the renewal of a yearly Subscription, changes to the Terms) | Art. 3.1, 3.9 | performance of a contract – Art. 6(1)(b) GDPR; for invitations, the legitimate interest of the inviting User and ours – Art. 6(1)(f) GDPR |
| Support and answers to questions, the Frego helper | Art. 3.5 | performance of a contract – Art. 6(1)(b) GDPR |
| Security of the Service, account protection, abuse prevention, error monitoring and fixing | Art. 3.2, 3.7, 3.8 | legitimate interest in a secure and working Service – Art. 6(1)(f) GDPR |
| Establishing and defending legal claims | as needed | legitimate interest – Art. 6(1)(f) GDPR |
4.1 We do not send marketing e-mails or newsletters. Should we wish to send them in the future, we will do so only with your consent or to the extent permitted by law, and always with an easy way to opt out.
4.2 Providing account data is a contractual requirement; without it an account cannot be created. Billing data is needed to conclude a Subscription contract and to meet legal obligations. Any other data is provided voluntarily, depending on the features you use.
4.3 We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
Article 5 – AI features
5.1 When you use an AI feature (for example a task title suggestion, the AI command, task import, the project planner or the Frego helper), we pass the AI provider the data needed to carry out that action, in particular the task or specification text and your instruction or question. For voice transcription (voice notes, ideas, voice commands) we pass the audio recording.
5.2 Text AI features are provided by Anthropic (Claude model) and voice transcription by OpenAI (Whisper model). Both may process data in the US (Article 7).
5.3 Data is passed to AI providers only when you start an AI feature yourself. The Frego helper has no access to the content of your tasks, clients or invoices; it only receives the questions you ask it.
5.4 Do not enter into AI features data you do not need for the purpose, in particular sensitive data or passwords.
Article 6 – Recipients and processors
6.1 We do not sell personal data. We disclose it only to the following categories of recipients:
a) providers who run the Service for us and process data on our instructions (processors), listed in the table below, b) Project Members you work with – within the Projects you are invited to or share (for example name, e-mail, profile photo, comments and hours worked), c) public authorities where required by law, d) our professional advisers (for example an accountant or lawyer) who are bound by confidentiality.
| Provider | Purpose | Place of processing |
|---|---|---|
| DigitalOcean | hosting of the application, database and file storage (DigitalOcean Spaces), backups | EU – Amsterdam (AMS3) |
| Cloudflare | protecting the Service against attacks (DDoS, web application firewall, a check on sign-in and registration that the form is not submitted by a robot – Turnstile), DNS and faster loading; communication between your device and the Service, including your IP address, passes through its network | global network – usually the data centre closest to you (in the EU when you connect from the EU); operational data also in the US |
| Stripe | payments, Subscriptions, invoices; billing name, e-mail, address and tax identifiers | EU and US |
| Anthropic | text AI features (Claude API) – task titles, AI command, task import, project planner, Frego helper | US |
| OpenAI | transcription of audio recordings (Whisper) | US |
| Sign in with Google, Google Calendar sync (if you turn it on), security notifications about Google accounts | EU and US | |
| Mailgun | sending service e-mails | EU |
| Sentry | application error monitoring (sending of personal data is off by default) | US |
| Algolia | search within the Service – index of names and descriptions of clients, projects and tasks, comments and work-time notes | EU – France (index), Germany (search analytics); Algolia support may also access it from the US |
6.2 For card payments, Stripe also acts as an independent payment service provider that processes card data under its own privacy policy. For Sign in with Google and Google Calendar sync, Google processes your Google account data under its own terms, which you accepted as its user.
6.3 Real-time updates (websockets) run on our own servers; apart from passing through the Cloudflare network (see the table above), this data is not passed to third parties. Fonts are served from our own server.
Article 7 – Transfers outside the EU
7.1 We store data in the European Union. Some providers listed in Article 6 (Cloudflare, Anthropic, OpenAI, Google, Stripe, Sentry and Algolia) may also process data in the US.
7.2 Such transfers take place only on the basis of an adequacy decision (EU–US Data Privacy Framework), where the provider is certified under it, or of standard contractual clauses approved by the European Commission, supplemented by further measures where needed. We will provide information about the safeguards used on request.
Article 8 – How long we keep data
8.1 We keep data only as long as necessary for the purpose:
| Data | Retention period |
|---|---|
| Account data and account content | while the account exists; after deletion the account is blocked immediately and the data is permanently erased after 30 days (including files, projects, invoices and the customer record at Stripe); your authorship in other Owners' Projects is anonymised |
| Accounting records (invoices we issue to you for the Service through Stripe) | 10 years under Slovak Act No. 431/2002 Coll. on Accounting and tax legislation |
| Records of withdrawals and of consents given when ordering | for as long as needed to prove compliance with our obligations and to defend legal claims |
| Change history of tasks and projects | 365 days |
| AI request records | 12 months |
| Verification codes sent by e-mail | 7 days |
| Session data | until the session expires |
| Read notifications | 12 months |
| Application logs | 14 days |
| Records of administrator actions on the account | 2 years |
| Support communication | while the account exists, or for as long as needed to handle the request and defend legal claims |
8.2 Backups are made daily in DigitalOcean's data centre in Amsterdam (AMS3) and kept for 7 days; data deleted from the application therefore disappears from backups within 7 days at the latest.
8.3 Providers such as Stripe may keep some data longer where their own legal obligations require it.
Article 9 – Data security
9.1 We protect data with appropriate technical and organisational measures, in particular:
a) all communication with the Service is encrypted with TLS (HTTPS), b) passwords are stored only as a secure hash, c) Vault content is end-to-end encrypted directly in your browser; we have no access to its unencrypted content, d) access tokens for Google services are stored encrypted, e) files in a Project's cloud are stored privately and served through temporary links; profile photos and task and comment attachments are stored at random, unguessable addresses, f) access to data is limited by roles and Projects; only authorised persons bound by confidentiality and using two-factor authentication have access to the infrastructure and the administration of the Service, and their actions on accounts are logged; we enter your account only at your request (for example when handling support) or when handling a security incident, g) data is hosted in the EU, backed up daily, and data no longer needed is deleted automatically under Article 8.
9.2 If a personal data breach is likely to result in a high risk to your rights, we will inform you without undue delay.
Article 10 – Your rights
10.1 Under the GDPR you have the right:
a) of access to your personal data and to a copy of it, b) to rectification of inaccurate or incomplete data (most of it you can correct yourself in Settings), c) to erasure (you can delete your account yourself at any time under Article 20 of the Terms), d) to restriction of processing, e) to data portability of the data you provided to us, in a structured, commonly used and machine-readable format; the Service does not yet offer a self-service export of all data, so please e-mail your portability request to studio@wcr.sk, f) to object to processing based on legitimate interest on grounds relating to your particular situation, g) to withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
10.2 Send your request by e-mail to studio@wcr.sk, ideally from your account e-mail address. If we have doubts about your identity, we may ask you to verify it. We handle requests free of charge without undue delay and at the latest within one month; in justified cases we may extend this by two further months and will let you know.
10.3 If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk, or with the supervisory authority in the state of your habitual residence or place of work. We recommend contacting us first – we will try to resolve the issue as quickly as possible.
Article 11 – Cookies
11.1 The Service uses only strictly necessary cookies and similar technologies (for example to keep you signed in and remember your language). We do not use analytics, marketing or advertising cookies. Details are in the Cookie Policy.
Article 12 – Changes to this policy
12.1 We may update this policy, in particular when the Service's features, providers or the law change. We will inform you of material changes in advance by e-mail or in the Service. The current version is always published on this page with its version and effective date.
12.2 This policy takes effect on 9 October 2026.