Privacy Policy

1Controller

FAMMRO e.U., owner Fabian Marocico, Am Golfplatz 45, 4225 Luftenberg an der Donau, AustriaEmail: support@fammro.com

We have not appointed a data protection officer because the legal requirements for doing so are not met.We answer requests at this address.

2Our roles

FAMMRO as controller: for data of visitors to this website, for the accounts of our customers and their team members, for billing, support and the security of our services.

FAMMRO as processor: for the data of our customers' end customers.When a merchant connects their chat widget, messengers, inbox, shop or marketplace to FAMMRO, we process the resulting messages and contact data only on the merchant's behalf and instructions, based on our Data Processing Agreement.The merchant is then the controller.End customers please direct requests about their data to the merchant concerned, we support the merchant in answering them.

3Visiting this website

When you open fammro.com, the service provider that delivers our website (see section 10) processes technically necessary access data: IP address, time, requested address, browser and operating system.This serves the delivery and security of the website (Art. 6(1)(f) GDPR, legitimate interest in secure operation).Only the country is derived from the IP address to show the right language, nothing is stored for this.

  • The website sets no cookies and uses no services for analytics, advertising or tracking.
  • Fonts are hosted on our own servers, no requests go to Google Fonts or other third parties.
  • If you choose a color scheme, we store this choice only in your browser (local storage) so the site looks the same on your next visit.

4Demo chat on the website

If you try the demo chat, we send your input (text, and an image where used) to our AI service for an answer (see section 9).We do not store the input in our database.Please do not enter personal data in the demo chat.The legal basis is Art. 6(1)(f) GDPR (demonstrating our product at your request).

5Customer account and console

For an account we process name, email, company, a password only as a secure hash, and optionally phone number, passkeys and second factor details.In the console, your team's settings, content and logs are added (Art. 6(1)(b) GDPR, contract).

  • Sign in: We set session cookies (see Cookies and Storage).To protect your account we store the IP address and browser for each session, encrypted, for as long as the session exists.We limit repeated failed attempts based on IP address and email (Art. 6(1)(f) GDPR, protection against abuse).
  • Protection against automated sign ups: For registration, sign in by link and "Forgot password", a bot detection service checks whether a person is using the form.For this, the IP address, browser details and characteristics of the interaction are sent to this service, including to the USA (see section 12).We use the result only for this check (Art. 6(1)(f) GDPR, protection against abuse).
  • Registration: When you register, we store the time, your email and the versions of the Terms of Service and the Data Processing Agreement you agreed to, as evidence of the conclusion of the contract (Art. 6(1)(b) and (f) GDPR).
  • Single sign on (Business license): If you set up sign in through your own identity provider (OpenID Connect), we receive your email, name and the ID of your account with that provider at every sign in.We store your company's credentials for this provider encrypted (Art. 6(1)(b) GDPR).
  • Usage analysis: We analyse your account data and your usage, such as company, contact person, license, term, team size and aggregated usage figures, to improve our service, support you and bill you (Art. 6(1)(b) and (f) GDPR).Contents of your end customers' conversations are not included.
  • Change log: Changes in the console are recorded with person and time so your team can trace and revert them.
  • Error monitoring: For technical errors we receive an error report via our error monitoring service (stored in the EU) without your name and without content.In the console only, every session with an error and a small sample of other sessions are also recorded as a screen replay, with all text masked and images hidden (Art. 6(1)(f) GDPR, stable software).

6Payment

You pay for licenses via our payment service provider based in the EU.You enter your payment method there, card or SEPA direct debit.We only receive your email, the chosen license, the payment status and the invoices, never full card or bank details (Art. 6(1)(b) and (c) GDPR).If you install FAMMRO through the Shopify App Store, Shopify handles billing.We keep invoice data for seven years (§ 132 Austrian Federal Fiscal Code).

7Email and SMS

We send emails for sign in links, codes, invitations, billing and system notices and notifications to your team via a service provider based in the EU.If this service fails, a fallback service in the EU or the USA takes over.Notifications may contain a short preview of a customer message.If you set it up, we also send notices by SMS via a service provider in the USA or to your contact on Telegram or WhatsApp (Art. 6(1)(b) GDPR).

8Data of your end customers (processing on your behalf)

When you connect FAMMRO to your channels, we process messages, names, contact details, order references and files of your end customers on your behalf, and in the widget a random visitor ID and session ID.Our Data Processing Agreement applies.We store the content of chats, contacts and leads encrypted.Your connections decide what goes to which platform: messages to WhatsApp go via Meta, emails via your inbox, order lookups to your shop.

In the console you can export and delete the data of individual end customers, for example to answer a request for access or erasure.The following applies to deletions:

  • They do not apply retroactively to encrypted backups.These are overwritten after 30 days at the latest.
  • Data you have transferred to your own systems, for example to a CRM system or through an export, you delete there yourself.
  • Change log entries about a deleted person remain as events, and we replace any personal content in them with “deleted”.This serves accountability and security (Art. 5(2) and Art. 17(3) GDPR).
  • If a person has unsubscribed from messages, for example with STOP on X, a suppression entry remains so that they receive no further messages.

From this data we create anonymized, aggregated statistics without any personal reference, for example the number of messages per day and channel, the share of conversations resolved by the bot, waiting times, languages and topic categories.They contain no names, texts or identifiers.We use them for your reports in the console, also after the retention period of the chats has expired, and, aggregated across all customers, to improve and bill our service (section 3.4 of the Data Processing Agreement).

9AI processing

FAMMRO creates answers, summaries, translations, image recognition and the knowledge base search with language models from external AI providers.Requests go through a routing service based in the USA to these providers.The search vectors FAMMRO uses to find matching content in the knowledge base are also computed by external providers in the same way.Data is therefore also processed outside the EU.

  • Before every transfer we replace typical personal details in the text with placeholders: email addresses, phone numbers, IBAN, card numbers, tax numbers, addresses, postcodes, dates of birth, order numbers, tracking numbers, IP addresses and the name and contact details of the customer concerned.Images and voice recordings cannot be masked this way.
  • We do not use your content to train models.Under the terms of the routing service, the model providers may not use it for this either.
  • Voice input in the chat widget uses your browser's speech recognition.Depending on the browser, its provider processes the recording, for example Google for Chrome, while Firefox recognizes speech on your device.If your browser has no speech recognition of its own, we send the recording to a speech recognition service in the USA to convert it to text.This service does not use the recording to train models.FAMMRO does not store the recording, only the recognized text as a message.
  • When FAMMRO reads a website for your knowledge base, it fetches the pages via a service for retrieving public pages based in Germany and, for blocked pages, via a public web archive in the USA.
  • Text recognition in images and scanned PDF files for the knowledge base is performed by the language model described in this section.

The legal basis is Art. 6(1)(b) GDPR for your account and the merchant's instruction under Art. 28 GDPR for your end customers.

10Hosting and infrastructure

We use service providers that process data only on our behalf (Art. 28 GDPR):

  • Delivery of the website and the console: worldwide server network
  • Server: data center in Frankfurt
  • Database and file storage: data center in Paris
  • Queues, caches and session protection: data center in Frankfurt
  • Protection and delivery of the API at ormmaf.fammro.com: worldwide server network
  • Desktop app updates: the app regularly checks for updates with a service in the USA, sending IP address and app version.
  • Database backup: an encrypted backup every night on FAMMRO's own devices in the EU, without a service provider, deleted after 30 days.Only FAMMRO holds the key.

We will tell you the names of the service providers we use on request to support@fammro.com.

11Connected platforms

When you connect channels, inboxes, shops or CRM systems, we exchange the data required for this with these providers, using the permissions you grant when connecting.Depending on your choice these are: Meta (WhatsApp, Instagram, Messenger, Threads), Telegram, X, LinkedIn, Google (Gmail), Microsoft (Outlook), Zoho, your shop system or marketplace (for example Shopify, WooCommerce, Shopware, Amazon, eBay, Etsy) and CRM systems.These providers also process the data under their own privacy policies.You can disconnect every connection in the console, which ends fetching and sending.

Meta: For WhatsApp, Instagram and Messenger we use Meta's official interfaces.We store access credentials encrypted.You revoke permissions in the console or in the settings of your Meta account.How to have data deleted is explained under Data Deletion.

12Recipients outside the EU

Some of the service providers named are based in the USA or process data outside the EU.Service providers that store data in the EU may also belong to a company in the USA.We base such transfers on the EU US Data Privacy Framework where the recipient is certified, otherwise on the European Commission's standard contractual clauses (Art. 46 GDPR).You can request a copy.

13Retention

  • Chat histories are deleted automatically according to the license: trial and Starter 90 days, Pro 365 days, Business when you delete them or your account.
  • Change log: trial and Starter 7 days, Pro 30 days, Business 365 days.
  • Sessions: 7 days after the last sign in, sign in links 15 minutes.
  • Exports and protected media: 7 days.
  • Database backups: up to 30 days, then they are overwritten.
  • Anonymous statistics: values relating to your company until the end of the contract, values aggregated across all customers without reference to any company indefinitely.
  • Account data: until the account is deleted, afterwards only as far as legal obligations require, in particular invoices for seven years.

14Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15 to 21 GDPR).You can withdraw consent at any time with effect for the future.Write to support@fammro.com.

You can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40 to 42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

15No automated decisions

We do not make decisions with legal effect based solely on automated processing (Art. 22 GDPR).The bot answers on behalf of the merchant, whose team can take over at any time.

16Changes

We update this policy when our services or the law change.The version published on this page applies.

This English version is provided for convenience.The German version is legally binding.