Privacy Policy

Who we are

Fucini Consulting, Reg. No. 46062728, 04053 Kyiv, Nestorivskyi Lane, Building 10, Office 2/1, Ukraine, publishes its software as Fucini Software and is the controller for the data described here. Privacy questions: support@fucini.software. General enquiries: info@fucini.consulting.

The short version

• Reading this site costs you nothing in data. No advertising cookies, no tracking across other sites, no analytics service. A visitor who never signs in leaves no more than the ordinary web-server log.
• We keep an account for you only if you buy, or are invited to a seat in a team’s pool, so you can reach your licence, your downloads and your seats.
• We never see your card. Payments are handled by Paddle, who are the merchant of record.
• What a product sends is that product’s policy. For Fucini Coverage Studio: your source code never leaves your machine without your consent, the usage summary is off unless you turn it on, and every install sends one short licence message a day — the Coverage Studio privacy policy has it in full.

What this site collects, and when

1. If you buy a subscription

Paddle.com Market Limited acts as merchant of record for every purchase. They collect and process your payment details; we never receive or store your card number. Paddle tells us your email address, your name if you gave one, your country for tax purposes, and the status of your subscription. See Paddle’s privacy notice for what they do with it.

From that we create an account on this site, holding your email address, a hashed password once you set one, and the identifier that links you to your subscription. We use it to deliver your activation code, to let you manage seats, and to contact you about the service.

2. Your account, and keeping it safe

When you sign in, the site sets one session cookie (FUCINISW) that identifies your signed-in session and nothing else; it expires when the browser closes or the session times out. If you tick Trust this device when entering a two-factor code, a second cookie (FUCINISW_TRUST) lets that browser skip the code — never the password — for 7 days (up to 90 for the site’s own administrators). We keep only a one-way hash of it, with when it was set, last used and expires, and a name such as “Firefox on Windows” taken from your browser; your account page lists these and removes them. To slow down password guessing we record each sign-in and password-reset attempt — the email address tried, the address it came from and whether it succeeded — and delete those records after 30 days. If you set up two-factor authentication we store the secret that verifies your codes and hashes of your recovery codes.

Changes made through the portal — a seat freed, an email address changed, a licence issued — are written to an audit trail with who made them, when, and from which address, so that a disputed change can be traced. Every email the site sends you is kept in a mail log for 180 days, so that a message you say never arrived can be looked up and sent again.

3. Licensing, seats and telemetry

What a product records when you activate it, how team seats check in, and what telemetry sends if you enable it, is set out by the product. For Fucini Coverage Studio that is its privacy policy, sections 2 and 3. The products on the road ahead are not released; each gets its own policy when it is.

Four things Coverage Studio sends are worth knowing here as well. Every install sends one short message a day, even with telemetry switched off, with its version, its edition and its licence state — the days left and the expiry date where there is one — and no usage. For a licensed install, that daily message and, when telemetry is on, its usage are linked to the account that bought the licence and are visible to Fucini’s administrators beside that customer and subscription. And with telemetry on, the extension also sends which of its own settings were changed from their defaults: the values of switches, numbers and choices are sent, while paths, branch names, task names and headers are never sent — only that they were changed.

When something in Coverage Studio fails, the extension sends an error report, even with telemetry switched off — unless VS Code’s own telemetry level is set to crash or off. It carries no file content: the error code, the message with names, paths and addresses removed, which parsers looked at the file, and facts such as its extension, size range and encoding. You can also choose to send a diagnostic report, optionally with the first 4 KB of the file and an address for our reply; installs that unlocked all features in exchange for telemetry, or hold a student licence, and accepted the current terms send those first 4 KB automatically. Error reports are deleted within 90 days, and a file’s first 4 KB after 30 days.

4. Newsletter

If you subscribe we store your email address and your confirmation status, and nothing else. A subscription is confirmed from the email we send you first, so nobody can sign up an address that is not theirs. Every message carries an unsubscribe link, and unsubscribing removes you.

5. Language

The front page and the product site remember the language you chose. With your permission that is a functional cookie; without it, only your browser’s own storage, which never reaches us. With your permission the product site may also use your approximate location, derived from your IP address, to suggest the right country — that is the only thing its consent prompt asks for, and declining it costs you nothing but the suggestion.

6. The contact form

The form on our contact page, and the Fucini Software form on fucini.consulting’s contact page, which sends what you write to this site, store your name, email address and message, who you chose to reach (support, sales or licensing), the language and page you wrote from, and roughly where you wrote from — country, region and city — which our own server works out from your IP address without asking anybody else. The IP address itself is kept only as a one-way hash, to stop the form being flooded: at most 5 messages in 60 minutes from one address. We email your message to the people who answer it, and send you one confirmation that it arrived.

To tell a person from a program, the form uses Google reCAPTCHA, provided by Google Ireland Limited: Google may receive your IP address and how you use the page, may set a cookie, and may transfer that data to Google LLC in the USA. See Google’s privacy policy.

We keep your message, and our replies to it, for up to 2 years from when it arrived and then delete them; the nightly backups hold a copy for 30 days more.

7. Writing to us

If you email us we keep the correspondence for as long as the matter it concerns is open, and afterwards as a record of what was agreed.

Why we are allowed to hold it

• To perform our contract with you — your account, your licence, your seats, and the emails that deliver them.
• Your consent — the newsletter, the language cookie, and whatever a product asks your consent for. Withdrawable at any time.
• Our legitimate interests — keeping the site secure and working: the sign-in throttle, the audit trail, the mail log; and answering what you send us through the contact form, with the reCAPTCHA check and the throttle that keep the form usable.
• Legal obligation — Paddle and we must keep certain transaction records for tax purposes.

How long we keep it

• Account, licence and seat records — while your subscription is active and afterwards while you may return, because deleting a pool destroys the only record of what you were entitled to.
• Sign-in attempts — 30 days. Sent mail — 180 days. The audit trail — for as long as the account it concerns.
• Newsletter — until you unsubscribe.
• Contact form messages, and our replies to them — up to 2 years.
• Transaction records — as long as tax law requires.
• What a product collects — as its own policy states; Coverage Studio’s telemetry, for instance, is deleted within 90 days at the latest, and the part of a file sent with an error report within 30.

Ask us to delete something and we will, unless we are required to keep it.

Who else sees it

We do not sell your data and we do not share it for advertising. It reaches only: Paddle, as merchant of record for payments; Google, for the reCAPTCHA check on the contact form; our hosting provider, which stores the databases and delivers this site; email delivery, to get messages to you; and anyone we are legally required to disclose to.

Our servers are in the EU. We are established in both the Netherlands and Ukraine, and data reaches us in both — including in Ukraine, which is outside the EEA and has no EU adequacy decision, so that transfer rests on the standard contractual clauses.

Your rights

If you are in the EU, UK or another territory with comparable law, you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you can withdraw it at any time without affecting what we did before.

Write to support@fucini.software and we will answer within one month. If you think we have handled your data badly you may complain to your local supervisory authority.

Security

The site is served over HTTPS. Passwords are stored hashed, never in readable form, and accounts are protected by two-factor authentication. Licence keys are cryptographically signed. Databases are not reachable from the web and are backed up daily. No system is perfect, and we will tell you if something happens that affects you.

Children

These are developer tools sold to businesses and professionals. They are not directed at children and we do not knowingly collect their data.

Changes

If we change this policy we will update the date at the top, and tell you directly if the change is significant.