Privacy Policy

SSL Fruitly AI GmbH & Co. KG
Inkustraße 1–7/Stiege 2/Haus C/1. OG/Top 2109
3400 Klosterneuburg, Austria
Phone: +43 650 37 50 530 · Email: info@fruitly.net

For any question about your data, or to exercise your rights, write to info@fruitly.net.

Fruitly – the app servers, the database and our AI model – runs on our own servers in Austria. When you use it, our servers process technically necessary data: time, requested address, status code and response time. We use your IP address briefly to fend off abuse such as mass sign-in attempts.

The purpose is a secure and stable service (legitimate interest, Art. 6(1)(f) GDPR). We keep logs for no more than 30 days.

For your account we process:

• your name, email address and password – the password only as a secure hash, never in plain text;
• with “Sign in with Apple” (in the app), the identifier Apple sends us and the email address you share;
• your signed-in devices: device name, when you signed in and last used it;
• sign-in codes (valid for 10 minutes) and confirmations of a sign-in on one of your other devices;
• your plan, time zone and settings.

The legal basis is our contract with you (Art. 6(1)(b) GDPR). We keep this data until you delete your account.

Unused accounts: If you don’t use your account for 24 months – on no device and not on the web – we email you and delete it 30 days later with everything in it. Signing in once before then keeps it. This also applies to accounts on the waitlist.

To answer you, we process what you write and upload and what Fruitly creates for you: messages and answers, attached files and images, documents and websites, notes in Memory, your Squeezes and their editions. Your custom instructions (“Personalization”) stay on your device or in your browser and are sent along with each message.

Answers are generated by our own model on our servers in Austria. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

How long we keep it: your content stays stored for as long as you keep it. When you delete a chat or messages, they disappear from the app and all your devices right away. We keep a separate copy, not visible to our support team, for 30 days so we can look into abuse (legitimate interest, Art. 6(1)(f) GDPR); after that it is deleted automatically and for good. If you delete your account, we delete all content right away – including these copies.

We only use your chats to train and improve our models if you turn on “Improve the Service” under Settings › Data Controls. It’s off by default. The legal basis is your consent (Art. 6(1)(a) GDPR); we record when you gave or withdrew it.

You can withdraw your consent at any time with the same switch. From then on we no longer use your chats for new training. This does not affect the lawfulness of processing before the withdrawal.

Without your consent, your chats are never used for training. To fix errors and improve the running service we then only use the technical logs (see “Hosting”), for no more than 30 days.

When Fruitly searches the web for an answer, we send the search query to our search provider Serper (serper.dev, USA). Only the query is sent – not your name, email address or chat. Transfers to the USA are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

When Fruitly opens a website to read it, our servers fetch it; the site’s operator sees our servers, not you. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

Websites Fruitly builds for you may use photos from Pexels (Pexels GmbH, Germany). When you view such a website, your device loads the photos directly from Pexels, which receives your IP address.

Pictures in Squeeze editions are preview images of the sources used. Our servers load them once, store them and deliver them to you themselves – your devices don’t contact the sources for them.

When you check a text at fruitly.ai/detector, we process it on our own servers in Austria to recognize Fruitly’s watermark. The text is neither stored nor logged and isn’t used for training; we only learn the result. Preferably don’t paste texts containing other people’s personal data.

So that the detector stays available to everyone, we limit the number of checks per internet connection and day (legitimate interest, Art. 6(1)(f) GDPR). For this we use your IP address only as a hash formed with a random value created anew each day. It exists only in memory and is forgotten at the end of the day; we don’t store the IP address itself for this, and checks on different days can’t be linked. You don’t need an account or a cookie.

For organisations with their own access, we store the organisation’s name, a contact address and how many checks were made per day – never the texts checked (contract, Art. 6(1)(b) GDPR).

We send sign-in codes, password reset links and replies to support requests by email, using Hostinger’s email service as our processor, with servers in the EU. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

If you allow notifications, we store your device’s notification token. Notifications – for example “Your answer is ready” with its first line, or an edition’s headline – are delivered through Apple’s Push Notification Service (Apple Distribution International Ltd., Ireland), and only while you aren’t using Fruitly. You can turn them off in your device’s settings at any time. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

When you write to us through the contact form, we process your name, email address, topic and messages to help you and reply by email (Art. 6(1)(b) GDPR). We delete a request automatically 12 months after its last message – even if you deleted your account before then.

We count how many answers, tokens and web searches you use – without any content – to apply limits and plans and to plan our capacity (Art. 6(1)(b) and (f) GDPR). We delete these numbers with your account.

To look after your account, our team only sees account and plan details, usage numbers and your support requests – never the content of your chats. Access is limited to a few people, every sign-in must be confirmed a second time and lasts at most 24 hours.

We only use technically necessary cookies:

• a session cookie that keeps you signed in (not readable by scripts);
• one for your appearance (light/dark) and one for the language of these pages;
• for members of our team, an additional cookie for the admin dashboard.

In your browser we also store your settings and a copy of your chats so Fruitly loads quickly. You can clear both in your browser settings. There are no advertising, tracking or analytics cookies, so no consent is needed (§ 165(3) Austrian Telecommunications Act 2021).

• Serper (USA) – search queries for web search
• Hostinger (EU) – sending emails
• Apple (Ireland) – notifications and Sign in with Apple
• Pexels (Germany) – photos in websites you view

We don’t sell data or share it for advertising.

Connections are encrypted, passwords are only stored as hashes, and access to our systems is strictly limited. Our model and your data live on our own servers in Austria.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and you can withdraw a consent at any time (Art. 7(3)). You can do much of this right in the app: under Settings › Data Controls, “Export Data” downloads all your data as a ZIP file (JSON and readable files); under Settings › Account you change your name and email address or delete your account; you can also delete chats and turn off training. For everything else, write to info@fruitly.net – we reply within one month.

You can also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

You must be at least 14 to use Fruitly (Art. 8 GDPR with Section 4(4) of the Austrian Data Protection Act); if you’re under 18, you need the consent of your parents or legal guardians. If we learn that an account belongs to a child under 14, we delete it.

We make no decisions about you that are based solely on automated processing and have legal effects on you (Art. 22 GDPR).

If the way we process data changes, we update this policy; we’ll let you know in the app about significant changes. How we implement the EU AI Act is described under EU AI Act.