This policy covers the fingerly.io website, the people who use the Fingerly console, and the data we process for our customers. Fingerly is a product of Badele LLC, a Wyoming limited liability company.
We hold some personal data for our own purposes, and process some on our customers’ behalf. Which role applies decides who you should ask.
The company behind Fingerly.
Fingerly is a product of Badele LLC, a Wyoming limited liability company. In this policy, “we”, “us” and “our” mean Badele LLC. Write to support@fingerly.io with any question about this policy or your personal data.
Our website, and our customers’ accounts.
We decide how and why personal data is used for the fingerly.io website and its visitors, for the people who use the Fingerly console (account owners, team members and billing contacts), and for correspondence with us. This policy is the notice for that data.
Our customers’ visitors.
When a business uses Fingerly on its own website or app, the people who visit it are that business’s end users. For their data, the business is the controller and we act as its processor, or service provider, processing the data only on its instructions and to provide the service. The business decides what is collected and is responsible for telling its visitors and for any consent.
If you are such a visitor, the business’s own privacy notice applies, and it is the right place to send your requests. A data processing agreement can be requested at support@fingerly.io.
Everything visiting this website involves. There are no analytics, tracking pixels or advertising scripts, and no forms that send what you type.
Kept in your browser’s local storage, never sent.
Your cookie choice is kept so the cookie card is not shown again. A light or dark theme you pick with the switch is kept only if you allow preferences; otherwise the site follows your device’s setting, which is read in your browser and never sent anywhere. Change your choice at any time from Cookie settings in the footer.
Delivered by our hosting provider.
Requests for pages and files reach our hosting provider, Cloudflare, which delivers the site and protects it from abuse.
Only when you press identify.
The Fingerly SDK is loaded only after you press identify in the session inspector; visiting or opening the demo does not run it. When you press it, your browser is identified for real by Fingerly’s API, and the answer is kept in your browser’s local storage for 30 minutes so it can be shown again.
Your IP address is placed and checked for a VPN, proxy or Tor in our own IP database, so the demo can answer. It is not sent to anyone else for this, and the demo stores nothing about you on our side.
If your address is placed, the location map loads its tiles from OpenFreeMap, an open map service drawing OpenStreetMap data, so that service sees your IP address and the area shown.
Runs in your browser and sends nothing.
The policy sandbox, pricing calculator and illustrative examples run in your browser and send nothing. Anything you copy goes to your own clipboard, only when you press a copy button. Signing up happens in the console, a separate application covered by this policy below.
The personal data of the people who use the console, why we keep it, and for how long. We do not sell personal data, and we do not use it for advertising.
Your email, name and profile photo.
Your email address, and the name and profile photo your sign-in method provides, are used to sign you in with an emailed link and to show your team who did what. They are kept while you have an account; ask us to delete them at any time.
Members, roles and invitations.
Your organisation’s name, its members, their roles and the invitations you send are used to run the account and decide what each member can do. They are kept while the organisation is open, then for 30 days after it is closed.
What it takes to charge correctly.
Your billing name and email, and a tax ID or address if you give them, are used to take payment and to issue receipts and invoices. For a saved card we keep only its brand, last four digits, expiry and country: the full card number is entered with our payment processor and never reaches us.
Top-ups, auto top-up settings, charges, refunds and daily usage are kept to charge correctly, answer billing questions and meet accounting duties: usage records for about 3 years, payment records as long as tax and accounting law requires.
Kept only as long as they are needed.
Email recipients and chat webhook addresses you add for notifications are kept until you remove them or the organisation is closed. Messages you send us and our replies, and technical records of requests to the console and API (including IP addresses), are kept as long as needed to help you and to run, secure and troubleshoot the service.
We send account emails as part of the service: sign-in links, invitations, receipts, billing notices and the notifications you choose.
Where the GDPR or the UK GDPR applies.
For the data we hold as a controller we rely on:
• contract: to provide the service you signed up for, take payment and support you;
• legitimate interests: to secure the service, prevent abuse of it, and keep it working well;
• legal obligation: to keep tax and accounting records, and to answer lawful requests;
• consent: for preferences the website stores only if you allow them, which you can withdraw in Cookie settings.
What happens when a business adds a Fingerly SDK to its website or app. We use this data only to provide the service to the customer who collected it.
Only after consent is granted.
Every SDK’s consent setting starts as pending, so nothing is collected until the customer’s integration grants it. Then the SDK reads characteristics of the device and browser or app: for example its type, screen, hardware capabilities, language and time zone settings, and signs of automation, emulation or tampering. In apps, the SDK keeps one random install ID on the device, which the app can delete.
Looked up in our own IP database.
From the request we add the IP address, an approximate location and a network classification (such as VPN, proxy or Tor) read from our own IP database, held on our own servers. IP addresses are not sent to any third party for this. We then add a visitor ID that belongs to that one customer, and a risk score with the signals behind it.
Outside what a device check needs.
The SDKs never collect:
• page content, form fields or keystrokes;
• mouse movement or session recordings;
• clipboard, contacts, photos or location services;
• cookies set by the browser SDK.
No identity is shared across customers, visitor data is never sold, and it is never used for advertising. The documentation lists every source each SDK reads, for customers’ own privacy notices.
SDK documentationData processed for customers is deleted on a fixed schedule, without anyone having to ask.
Fixed periods, applied automatically.
Each kind of record is deleted when its period ends:
• events, including IP address and approximate location: 30 days;
• IP address per day, aggregated: 90 days;
• the full record of each submission, kept to rebuild events: 90 days;
• per-visitor daily totals, keyed by visitor ID: 400 days;
• device identity, for recognising a returning visitor: until 180 days after the device was last seen;
• short-term activity counters, hashed: 8 days;
• aggregate analytics: 45 to 100 days in detail, 800 days as daily totals;
• usage and billing records: about 3 years.
Sooner, on request.
A customer can erase a visitor at any time from the console or through the API, or ask us at support@fingerly.io. When an organisation is closed, its data is kept for 30 days and then deleted, except billing records the law requires us to keep.
The measures in place today. No privacy or security certification is claimed.
HTTPS only.
The website, console and API are served over HTTPS only.
Nothing reusable to steal.
SDK key secrets are stored as keyed hashes and shown once. The console signs people in by emailed link, so there is no password to steal.
Each member sees what their work needs.
Owners, admins, developers and billing members each see only what their role needs.
Told without undue delay.
If a security incident affects personal data, we tell the customers affected without undue delay, and the authorities where the law requires.
Every request goes to one address: support@fingerly.io.
Access, correction, deletion and more.
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable form, to restrict or object to how we use it, and to withdraw consent you gave. We do not treat anyone differently for using these rights.
One email, from the right address.
Write to support@fingerly.io, from the email address on your account if you have one. We may ask you to confirm your identity before acting, and we answer within the time the law allows.
Ask the business you visited.
If a website or app you used runs Fingerly, the business behind it controls that data. Send your request to that business; it can access or erase your data with us. If you write to us instead, we will help you reach it and assist it in answering you.
No selling, no sharing for advertising.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. Residents of states with privacy laws can use the rights above, including to know, delete and correct, through the same address.
You can also go to a regulator.
If you are in the European Economic Area or the United Kingdom, you can complain to your data protection authority. We would rather hear from you first, so we can try to put it right.
Not for children.
The website and the service are not directed at children, and we do not knowingly collect personal data from children for our own purposes. Customers must not use the SDKs in apps or services directed at children.
Dated, and announced when they matter.
When this policy changes, the date at the top of the page changes with it. If a change materially affects customers, we will tell them by email or in the console before it takes effect.
Start with the signals, keep your own decisions, and pay only for what you identify. No credit card needed.