Privacy policy
Last updated 2026-11-10. This page explains what personal data Folii handles, why, for how long, and what rights you have. Folii is an ad-booking service for publishers.
Who is responsible
Folii is run by Rita Nordström, a private individual in Sweden ("Folii", "we"). There is no company behind it. Privacy contact: privacy@folii.co.
Folii has two roles:
- Controller for account data. For the people who sign in to Folii (name, email, role, organisation, sign-in, sessions, security and audit logs) we decide why and how the data is used.
- Processor for publishers' data. Each publisher that uses Folii puts in its own bookings, customers (company details and contact names and email addresses), products and invoicing data. The publisher is the controller of that data and decides how it is used; Folii only handles it on the publisher's behalf and on its instructions. If you are a publisher's customer and want to use your rights over that data, contact the publisher.
What we collect and why
| Data | Why |
|---|---|
| Account: name, email address, role, the organisation(s) you belong to, whether the account is active. | To let the people a publisher has invited use Folii, show who made a booking, and name the salesperson on invoices. |
| Sign-in by email code: a six-digit code sent to your email address. Folii stores only a scrambled (hashed) form of the code, for at most an hour. | To check that you control the email address. Folii stores no passwords. |
Sign-in with Google, if you choose it: we ask only for the standard openid, email and profile scopes and store Google's identifier for your account. | To recognise you when you return. We get no access to your mailbox, files, calendar or contacts, and do not use Google data for anything else. |
| Sessions and cookies: see below. | To keep you signed in and to complete a sign-in. |
| IP address and browser: your IP address reaches Folii with every request. We use it only briefly to limit repeated sign-in attempts, and keep only a scrambled form of it in the server's memory for up to an hour. We do not store it in our database or in the audit log, and we do not store your browser's user-agent text. Our hosting provider (Cloudflare) processes IP addresses to deliver the service and to protect it against abuse, under its own terms. | Security and abuse prevention. |
| Audit log: who changed what and when (for example a booking, an invoice, an invitation or a role change), including the account that made the change. | Accountability, security and bookkeeping records for the publisher. |
| Emails we send: sign-in codes and invitations to you; on behalf of publishers, booking confirmations and date-change notices to their customers. The email log keeps the recipients, subject and send time. | To provide the service. |
The legal grounds are our contract with you or your publisher and our legitimate interest in running a secure service (GDPR Article 6(1)(b) and (f)). Where we need to keep records by law, such as bookkeeping records, Article 6(1)(c) applies.
Cookies
Folii uses only strictly necessary cookies, so no consent banner is needed. There is no analytics, advertising or tracking of any kind.
__Host-folii_session: keeps you signed in. It holds a random identifier only. It is removed when you sign out, and a sign-in ends after 12 hours without activity or 14 days at most.session: a signed cookie used while you sign in (or connect an account), which expires 15 minutes after it was last used.
The pages load a font from Google Fonts (fonts.googleapis.com) and a script library from unpkg (unpkg.com). Your browser therefore contacts those services, which receive your IP address and browser details, as with any web font or script host.
How long we keep data
- Sign-in codes: valid for 10 minutes; the stored record is deleted after an hour.
- Sessions: end after 12 hours without activity or 14 days at most; the record is deleted when you sign out or when the expired session is next seen.
- Invitations: valid for 7 days, and deleted when accepted or revoked.
- Audit log: records about bookings, invoices and customers' identity for 7 years, other audit records for 24 months. Automatic deletion is being built and is not yet running.
- Email log: 24 months (automatic deletion likewise not yet running).
- Account data (name, email, role): while the account exists. People are not deleted outright, because bookings and the audit log refer to them; ask us to erase or anonymise an account (see your rights below).
- Publishers' booking and customer data: as the publisher decides; we delete it when the publisher leaves, on the terms agreed with them.
Who else handles data, and where
| Service | What for | Where |
|---|---|---|
| Cloudflare | Hosting and delivery of Folii | Folii runs in Cloudflare's EU locations; its network handles requests worldwide |
| Neon | The database (everything above except cookies) | Frankfurt, Germany (EU) |
| Brevo | Sending email | EU |
| Sign-in, only if you choose it. Google also serves the font mentioned above | Global | |
| Fortnox | A publisher's own bookkeeping. The publisher connects its Fortnox account to Folii, and Folii sends and reads customers and invoices there | Sweden (EU) |
| European Commission (VIES) and the Riksbank | Checking customers' EU VAT numbers (only company VAT numbers are sent) and fetching public exchange rates (nothing is sent) | EU |
We do not sell personal data, and we do not use it for advertising.
Transfers outside the EU/EEA
Our database and email provider are in the EU. Cloudflare and Google are US companies, so some data can be handled in the US. Both rely on the EU–US Data Privacy Framework and on the EU's standard contractual clauses for such transfers.
Your rights
Under the GDPR you may ask for access to your data, correction, deletion, restriction of processing, and a copy in a portable format, and you may object to processing based on our legitimate interest. Write to privacy@folii.co. We answer within one month. If the data is a publisher's booking or customer data, we will pass your request to the publisher, which decides it.
You may also complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the authority in your own country.
No profiling or automated decisions
We do not profile you, and no decision about you is made automatically.
Changes
If this policy changes in a way that matters, we will update the date at the top and, for signed-in users, tell them. The current version is always at this address.