Privacy notice
Last updated 27 October 2026
Controller: Fulta Technologies Kft. · Zrínyi Miklós utca 86. 1. ajtó, 5540 Szarvas, Hungary · company registration number: 04-09-018292 · tax number: 33148302-2-04 · privacy contact: [email protected]
This notice covers fulta.ai, app.fulta.ai and Fulta accounts. The data of visitors to applications published with Fulta is handled by the operator of that application; there Fulta is only a processor (Data Processing Terms).
What we handle, why, and for how long
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Account: name, email address, language, plan, sign-in events | the account and the service | performance of the contract | until the account is deleted |
| Projects: prompts, chat, uploaded files, generated code, logs of AI runs | providing the service, troubleshooting | performance of the contract | until the project or the account is deleted; removed for good within 10 days of deletion |
| Billing: billing name, address, tax ID, payments, invoices | payment, invoicing, tax | legal obligation | accounting records for 8 years (Hungarian Accounting Act, s. 169) |
| Credits and usage: credits added, charges, runs | accounting, handling disputed charges | performance of the contract | until the account is deleted |
| Security: IP address, browser, sign-ins, log of admin actions | preventing abuse, security | legitimate interest | until the session ends (120 minutes); the audit log for 12 months |
| Legal records: acceptance of the Terms (version, time, IP), withdrawals, illegal content reports | proving the contract and your rights, legal obligation | legal obligation, legitimate interest | 5 years after the contract ends |
| Complaints and correspondence | support, complaint handling | legal obligation | complaints for 3 years (Hungarian Consumer Protection Act, s. 17/A) |
| Project emails: your projects' state (a finished build, publishing, that a first submission or order arrived), their visitor counts and content, when you last signed in, a log of the emails sent and their delivery, your browser's time zone | emails about your own projects (ready, not yet published, first submission, visitors, monthly report, tips), sent at a sensible hour | performance of the contract; where an email is advice, legitimate interest | until the account is deleted; turn them off any time from the bottom of the email or under Emails in the app |
| Early access sign-up: email address and what you told us | sending the invite | consent | until you sign up, at most 6 months after public launch |
| Marketing measurement: which campaign brought you (UTM, ad click IDs, partner code) | measuring campaigns, partner commissions | consent (cookie bar) | the cookie for 90 days; IP address and browser removed after 30 days, click IDs after 90 |
Please do not put passwords, card numbers or other people's sensitive data into prompts.
Artificial intelligence
Your prompts, your project's code and the files you upload are sent to the Anthropic and OpenAI APIs to generate your app. Fulta does not train AI models on your data. Under these providers' business API terms, data sent through the API is not used to train models and is kept only for a limited time, for abuse monitoring.
Uploaded images and documents are checked automatically, and those with prohibited content are not stored. At sign-up, Cloudflare Turnstile checks that a person is filling in the form. These are automated checks, not decisions with legal effect under GDPR Article 22; if one wrongly affects you, write to us and a person will look at it.
Who receives your data
Only the providers needed for the service, under data processing agreements:
| Provider | For | Where |
|---|---|---|
| Laravel Cloud | the platform's servers and database | USA |
| Cloudflare | running published applications and their databases, file storage, previews, DNS, bot checks | global network |
| Anthropic, OpenAI | AI generation | USA |
| Stripe | payments | EU (Ireland) and USA |
| Billingo | invoicing (invoices are also reported to the Hungarian tax authority) | Hungary |
| Resend | sending email | USA |
| Openprovider | domain registration, only when you buy a domain | EU (Netherlands) |
| Meta, Google | measuring ad conversions, only if you consented in the cookie bar | EU and USA |
| TikTok | measuring ad conversions, only if you consented in the cookie bar | EU (Ireland) and countries outside the EEA, under SCCs |
Transfers to the USA rely on the EU–US Data Privacy Framework (where the provider is certified) or on the European Commission's standard contractual clauses. The provider list is also in the DPA. We disclose data to authorities only when the law requires it. We do not sell data.
Cookies
Without consent we use only the cookies the service needs to work.
| Cookie | For | How long |
|---|---|---|
fulta-session, XSRF-TOKEN |
signing in, form protection | until the session ends |
remember_web_… |
staying signed in on this browser | 400 days or until sign-out |
fulta_locale |
the language you chose (fulta.ai) | 1 year |
fulta_consent |
your cookie choice | 180 days |
__cf_bm |
bot checks (Cloudflare) | 30 minutes |
fulta_touch |
only with consent: which campaign brought you here | 90 days |
Theme, language and unsent prompts stay in your browser's local storage and never reach us. You can change your choice at any time with the "Cookie settings" button in the footer.
Your rights
You may ask for access to your data, its correction or deletion, restriction of its handling, and a copy in a portable form. You may object to handling based on legitimate interest, and withdraw consent at any time. Write to [email protected]; we answer within one month.
You can complain to the Hungarian data protection authority (NAIH, Falk Miksa utca 9–11, 1055 Budapest, www.naih.hu) or to the authority where you live, or go to court.
Security
We use HTTPS, sign-in is passwordless (an emailed link and code), application secrets are stored encrypted, and the platform, previews and published applications run on separate domains. In a personal data breach we notify the authority as the law requires, and you too where needed.
Changes
We tell you about material changes by email.