Privacy Policy

This policy explains what Valvasor Capital Ltd does with personal data when you use Fuo.

Read the first section before anything else. Which parts of this policy apply to you depends on how you arrived.

1. Which of these are you

You run webinars on Fuo. You or your organisation opened a workspace. This policy covers the data we hold about you: your name, your email address, how you sign in, what you did in the product. For that data we are the controller, and this whole policy applies to you.

You registered for somebody's webinar. You gave your details to the organisation whose name and logo were on the page. They decide why your data is collected and what happens to it next — not us. We hold it on their instruction, as their processor. Sections 5 and 9 tell you what that means in practice and who to contact. The organiser's own privacy notice is the one that governs your data, and it should be linked from the page you registered on.

You came on stage as a guest. You were invited by an organiser, agreed to be recorded, and appeared in a broadcast. Section 6 is about you.

You joined our waitlist, or arrived from one of our ads. We are the controller for what you gave us. Section 7.

You are just visiting the website. Section 7.

2. Who we are

Valvasor Capital Ltd, a company registered in England and Wales.

"Fuo" is the product; Valvasor Capital Ltd is the company behind it. Where this policy says "we", it means the company.

We are established in the United Kingdom and we offer the service to people in the European Union, so both the UK GDPR and the EU GDPR apply to us and we have written this to satisfy both.

3. What we collect from people who run webinars

We are the controller for all of this.

Your account. Name, email address, and a hash of your password — never the password itself. If somebody invited you, the email address they used and who invited you.

Your workspace. Its name, postal address, logo, brand colour, and the sending domain you configured for email.

How you use the product. When you signed in and from what kind of browser; a record of administrative changes you made, which exists so that a change nobody remembers making can be traced; and errors the software reported while you were using it.

What you produced. Your webinars, their pages, your slides, your offers, your recorded broadcasts. This is your content and it is treated as yours.

Service metering. Minutes broadcast, minutes delivered to viewers, storage used. We need this to run the service and to bill for it.

We do not ask for payment card details in the product, and we do not store any.

Why, and on what legal basis

Do you have to give us this? An email address and a password are needed to open an account, and without them we cannot provide the service. Everything else in your workspace is yours to fill in or leave empty.

Where we rely on legitimate interests, the interest is running a service that works and can be accounted for, and we have weighed it against the fact that you are an identified business user who expects an application to keep records of its own operation.

4. What the Fuo app stores on your device

This section is about the app itself: the registration pages, the webinar room and the studio (live.fuo.app and studio.fuo.app). The website fuo.app, with the waitlist and our ads, is in section 7.

The app uses no advertising technology, no analytics network, no social plugin and no cross-site tracking. The one exception to "no pixel" is the open check in webinar emails, described in section 5.

It sets these cookies:

All of them are first-party and HttpOnly — no JavaScript on the page can read them, including ours — and none of them is shared with anybody.

If you arrived through somebody's invitation link, the registration page asks once whether we may remember that for 30 days, so they still get the credit if you come back later. Say no and vc_visitor stays a session cookie, gone when you close the browser; only the invitation you followed in this visit counts. Nobody who arrived without an invitation is asked, because there is nothing to remember.

The studio also keeps a few settings in your browser's own storage, for you and nobody else: light or dark, whether the sidebar is folded, how you like the leads list, the teleprompter's text size, that you have seen the studio tour, and which camera and microphone you picked. They never leave your browser.

IP addresses. Your address reaches our server the way it reaches any website, is used to route the response and to count requests from one place, and is kept in our web server's logs for 14 days. The one place our database keeps one is a failed sign-in to the studio: the address tried and the IP it came from, for 90 days, so that attempts to break into an account can be traced and stopped.

5. Webinar registrants: what we hold, and for whom

If you registered for a webinar, the organiser is the controller and we are their processor. We hold, on their instruction:

• The details their form asked for. Always an email address; and, depending on what that organiser chose to ask, a first name, a last name, a phone number and a country.
• Which webinar and which date you chose, and which invitation link brought you, if you followed one.
• How you took part: whether you came, what you wrote in the chat and the reactions you sent, whether you clicked the organiser's offer, and whether you opened their emails about the webinar.
• The organiser's own notes on following up with you, kept with your details and deleted with them.
• For an event in a room: the guests you bring, and when each of you was checked in.

If the organiser has switched it on, the person whose invitation link you followed sees these details too, so they can follow up with you; the registration page says so before you submit anything. If the organiser put a YouTube or Vimeo video on their page, your browser loads it from them, under their own policies.

We do not use any of this for our own purposes. We do not market to you, we do not sell anything to anyone, and we do not combine what one organiser holds with what another holds. The only thing we do with it on our own account is keep the platform secure and working.

Your rights are exercised against the organiser: their own privacy notice, linked from the page you registered on, says what they do with your details. Ask them and they can show you, correct, export or delete everything above. If you cannot reach them, write to privacy@fuo.app and we will help you find them — but we cannot decide on their behalf.

6. Guests who appear in a broadcast

If an organiser invited you on stage, you were asked to agree to be recorded before you joined, and we recorded the date and time you agreed.

When you join you are backstage. Your camera and microphone are connected, and the host can see and hear you — that is how they check you before bringing you on. We do not put you into the broadcast until the host puts you on stage. Your picture and your voice are added to what the audience sees and hears at that moment, and not before.

Once you are on stage, your camera and microphone are part of what the audience sees and part of the recording kept afterwards. Your screen says which of the two you are in, and the host can mute you or take you back off stage at any time.

The name and title shown under your picture are the ones the organiser typed when they invited you, not ones you chose.

The recording belongs to the organiser and is kept under their workspace. If you want it removed or want to withdraw from it, ask them; if you cannot reach them, write to us and we will pass it on.

7. The website, the waitlist and our ads

For everything in this section we are the controller.

Visiting fuo.app. Our web server keeps ordinary request logs, including IP addresses, for 14 days, to keep the site running and to investigate abuse. They are not written to the database and are not linked to any account or registration. The film on the homepage is delivered by Cloudflare, so Cloudflare sees your IP address when the page shows its first picture.

If an ad brought you, its campaign tags and Meta's click identifier (fbclid) stay in the address as you move around the site, so that if you join the waitlist we can see which ad worked. Nothing is stored in your browser for that.

Website analytics. We use Umami, an open-source analytics tool that we host ourselves on our server in Frankfurt, to understand and improve how the website and our advertising perform. Our basis is our legitimate interests (GDPR Article 6(1)(f)). It records page addresses (including campaign tags), referrers, screen size, language, browser and device information, country, region and city, and interactions with the site: clicks, scrolling, time in view, loading performance, and progress or validation failures in the waitlist form, never what you type. Your IP address is used to derive the location and a hashed visitor identifier that changes every month, and is not stored in the analytics. Analytics records are not linked to waitlist entries or accounts, are not shared with anyone and are not used for advertising. The tool sets no cookies and stores nothing on your device. Records are deleted after 24 months. We honour your browser's Do Not Track signal; you can also switch analytics off under Analytics opt-out at the foot of every page, or object by writing to privacy@fuo.app.

The waitlist. If you join, we keep what you give us, as you give it: your email address, which starts your entry; then your name, the size of your team and how you present today, which we need to finish it; and, if you add them, your WhatsApp number and the company you build with. We also keep which ad or link brought you (as above) and the contact notice you accepted, word for word, with the time you accepted it. If you stop part way, we keep what you entered up to then. While you fill it in, your browser holds your answers for that tab so a reload does not lose them (see the table below).

We use it to contact you about early access to Fuo — to tell you when your spot opens and to talk with you about joining — by email and, if you gave us your number, on WhatsApp or by text message, as the notice on the waitlist's first screen says. Our basis for contacting you is your consent (GDPR Article 6(1)(a)); our basis for keeping which ad brought you is our legitimate interest in knowing which of our ads work (Article 6(1)(f)). Each entry is emailed to the founders' mailbox when you finish or stop, and if we message you on WhatsApp, WhatsApp (part of Meta) carries the message and sees your number.

The playbook. If you ask for our playbook, at fuo.app/playbook or in the offer our website may show before you leave it, the email address you give starts a waitlist entry, kept as described above, with the notice beside that form in place of the waitlist's. We use it to give you the playbook and to contact you about Fuo and early access, by email and, if you later add a number, on WhatsApp or by text message. Our basis is your consent. If you go on to join the waitlist, the same entry is completed rather than a second one started.

The Inviter Method video. If you ask to watch our video at fuo.app/discover, the name and email address you give start a waitlist entry, kept as described above, with the notice in that form in place of the waitlist's, and the phone number you give next is added to it. We use them to contact you about the video and about Fuo, by email and, if you gave your number, on WhatsApp or by text message. Our basis is your consent. Your browser keeps a note that you filled in the form (fuo-inviter, on your device only), so that the video opens for you next time without asking again.

Booking a call. If you book a call from the page the video plays on, the booking is made in Cal.com's calendar (Cal.com, Inc., which processes it in the United States under the EU's standard contractual clauses). So that you do not type them twice, the calendar opens with the name, email address and phone number you gave in the form already filled in; they reach Cal.com only when you open it, and the booking is made only if you complete it. Your browser keeps those details for that tab while you watch (fuo-inviter-me), and forgets them when the tab is closed.

You can stop it at any time. Reply "stop" to any message, or write to privacy@fuo.app, and we stop contacting you and delete your entry. Otherwise an entry is deleted automatically 12 months after you joined or after we last updated it (for example after we spoke); if you become a customer, what you need from it becomes part of your account.

If you leave your details in one of our forms on Facebook or Instagram (Meta's instant forms), Meta passes them to us and we keep them as a waitlist entry, as above, with the name of the ad and campaign it came from, the notice that form showed you, and the boxes you ticked on it.

If you used the Request access form we had on fuo.app before October 2026, we keep what you typed (your email address and, if you added them, your name, WhatsApp number, company, team size and the plan you looked at) so one of the founders can reply, on the basis of steps you asked for before a possible contract (Article 6(1)(b)). It is deleted 12 months after it came in, or sooner if you ask.

Our ads and Meta's pixel. Our ads run on Meta (Facebook and Instagram). If you allow it in the banner on fuo.app, the site loads Meta's pixel, which tells Meta that you visited, whether you played the film or read most of a page, and whether you joined the waitlist or booked a call, so we can see which ads work. If you join, it also sends your email address, phone number and name, and the number of your entry, each hashed in your browser first, so Meta can match the visit to a Facebook or Instagram account; this is what Meta calls advanced matching, and it happens only with your consent. Our basis is your consent (Article 6(1)(a)), asked before anything loads. For collecting and sending that information, Meta Platforms Ireland Ltd and we are joint controllers, under the terms Meta publishes for it (Meta's Controller Addendum); you can exercise your rights with either of us, and Meta is solely responsible for what it does with the information afterwards, under its own privacy policy. Meta may transfer it to the United States, relying on the EU–US Data Privacy Framework and Standard Contractual Clauses. With your consent Meta sets its own cookies, _fbp and, if you came from an ad, _fbc, each kept for up to 90 days.

If you decline, or never answer, the pixel is not loaded and nothing is sent to Meta. Your answer is kept in your browser (fuo-consent) and asked again after 12 months. You can change it at any time under Cookie settings at the foot of every page, the waitlist included; taking it back removes Meta's cookies.

What fuo.app stores in your browser

Meta's own use of its cookies is described in its privacy policy at facebook.com/privacy.

8. Who else sees the data

We use a small number of specialist suppliers. Each one gets only what it needs to do its job, each is bound by a written contract, and none of them may use anything for their own purposes.

Some of these are outside the UK and the EEA. For data we hold as a processor for our customers, the DPA says which transfer safeguard applies to which supplier. For data we hold as the controller (your account, the waitlist), transfers rely on an adequacy decision — including the EU–US Data Privacy Framework and its UK extension, where the supplier is certified — or on the Standard Contractual Clauses with the UK addendum. Write to privacy@fuo.app for a copy of the safeguard that applies.

The list of suppliers that handle our customers' registrants is a term of the contract with our customers and cannot be changed silently; it is maintained in the DPA.

Beyond our suppliers, data reaches others only where it has to: our professional advisers, such as lawyers and accountants, under duties of confidentiality; authorities, where the law requires us to disclose it; and a buyer of the business, if Fuo is ever sold, who would take it on under this policy.

We have never sold personal data and we will not.

9. How long we keep things

The 24-month and 12-month periods are enforced by a job that runs every day, not by policy alone. They run from the date of the webinar the person registered for — so someone who registered for a screening of a long-running webinar is removed 24 months after their screening, whatever the webinar itself goes on to do.

10. Your rights

If we are the controller of your data — you run webinars on Fuo, you joined our waitlist, or you wrote to us — you can ask us to show you what we hold, correct it, delete it, restrict what we do with it, give you a portable copy, or object to processing we base on legitimate interests. Write to privacy@fuo.app. We will answer within one month.

You can object to direct marketing at any time, and we will stop. Where we rely on your consent — to contact you from the waitlist, or for Meta's pixel — you can withdraw it at any time, as easily as you gave it: reply "stop", write to privacy@fuo.app, or use Cookie settings on fuo.app. Withdrawing does not make what we did before it unlawful.

We may ask you to confirm who you are before we act on a request, so that nobody else can make it in your name.

We make no decision about you by automated means alone that has a legal or similarly significant effect on you.

We have not appointed a data protection officer; privacy@fuo.app reaches the person at the company who is responsible for this policy.

If you registered for somebody's webinar, the same rights apply but the organiser is who you ask. See section 5.

You can complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office, at ico.org.uk. In Slovenia it is the Informacijski pooblaščenec, at ip-rs.si. You may also complain to the authority where you live.

11. Security

Passwords are stored as scrypt hashes and never in a form we could read. Sessions expire. Everything between your browser and us travels over TLS. Personal data is confined to the workspace it belongs to, and that isolation is enforced in the database queries themselves rather than by hiding things in the interface. Our staff can look into a workspace only with a recorded reason, for 30 minutes at a time, and cannot change anything while they do.

If personal data is ever exposed, we will tell the relevant authority within 72 hours of becoming aware, and we will tell the affected customers without undue delay so that they can tell the people affected.

12. Children

Fuo is a business tool and is not directed at children. We do not knowingly collect data about anyone under 16. If you believe we have, write to privacy@fuo.app and we will delete it.

13. Changes

We will post any change here and update the version at the top. If a change materially affects how we handle your data, we will tell customers by email before it takes effect.

Contact: privacy@fuo.app · Valvasor Capital Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom