Privacy

FactLatch is operated by an individual in the Republic of Serbia. It is not run by a company, and it is not a registered business of any kind (not a limited company, not a sole proprietorship). That individual is personally the controller of the personal information described on this page: the one who decides why and how it is used.

• Name: Bobi Bobic
• Country: Republic of Serbia
• Privacy contact: support@factlatch.com
• Postal address for legal notices: Not published. Please use the email address above.
• Representative in the European Union: None is appointed.
• Data protection officer: none is appointed.

Because FactLatch is operated from Serbia, the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, “Službeni glasnik RS”, no. 87/2018) applies. For people in the European Economic Area, the EU General Data Protection Regulation (GDPR) applies to the extent FactLatch offers its service to people there or monitors their behaviour; it does not apply to every visitor in every situation. This page is written to give everyone the same protections, whichever of the two applies.

Rules on cookies and similar storage in your browser (in Serbia, the rules on electronic communications) are why FactLatch asks for your permission before it sets any analytics cookie.

You can scan a site without an account. When you do, FactLatch handles:

• The address you type and the public pages and sitemap FactLatch reads from that site. It reads public pages only; it does not sign in anywhere.
• What it finds in the pages it reads: counts, and a few short example sentences with the page they came from.
• A salted, one-way hash of your network address, used only to limit abuse. The address itself is not stored by FactLatch.
• A saved copy of the source-linked findings, so you can continue after creating an account. It can be opened only from the browser that ran the scan, through a secure cookie, and stops working after 24 hours.

To create an account FactLatch needs an email address and a password. Sign-in is handled by Supabase Auth; your password is stored as a hash and FactLatch cannot read it. A personal workspace is created for you. If you reset your password, the link is sent by email and is valid for a short time.

When you track an item (a fact tied to a source, or a table, section, schedule, list of people, file or value), FactLatch stores:

• the page or file address, and for a fact the claim text and its value, as you published them; for any other item a label, where it sits and the text FactLatch compares between checks;
• the source address you attached or FactLatch read, and short extracts of what it says;
• the history of checks, detected changes and the review decisions you make.

This is visible only to your workspace; the database enforces that separation. An item you stop tracking is deactivated, not erased, so its history stays intact.

FactLatch can email your account address when a tracked item needs review, and send a weekly summary. Both are on until you turn them off in Account → Notifications. Emails are sent through Resend. They contain a link back to FactLatch, not the page you monitor.

The law requires a reason, called a legal basis, for each use. Each one below stands on its own: agreeing to one does not agree to another.

• Your account, workspace, scans you run, tracked items, checks, review history and alert emails are needed to give you the service you asked for. The basis is performance of a contract with you, or steps you take at your request before one.
• The free scanner reads the address you typed because you asked it to. The basis is the same: the service you requested.
• Preventing abuse and keeping the service secure (the one-way hash of your network address, rate limits, and the technical logs of the hosting providers) rests on FactLatch's legitimate interest in protecting the service and its users from abuse. These are kept to what that needs.
• Product usage events (PostHog) and error reports (Sentry) rest on FactLatch's legitimate interest in knowing whether the product works and in fixing faults. They are pseudonymous (an internal account id, never your email, claim text, URLs or page content) and are sent by the server, with one exception: unexpected errors can be reported by your browser to Sentry. You can object (see “Your rights”). They do not depend on, and are not covered by, your choice about Google Analytics.
• The weekly summary email rests on FactLatch's legitimate interest in keeping you informed about what you track; you can switch it off at any time in Account → Notifications.
• Google Analytics rests only on your consent, given in the cookie banner. Saying no changes nothing about what you can do in FactLatch. Strictly necessary cookies (below) need no consent because the service cannot work without them.

FactLatch does not sell personal information, does not run advertising and does not make decisions about you by automated means that have legal or similarly significant effects. No legal obligation to keep records applies today (see “What is not built yet”).

Only with your permission. FactLatch uses Google Analytics 4, a service of Google, to understand which pages of this website are visited and which steps people complete (scanning, creating an account, tracking an item, finishing a review), so the website and the product can be improved. It is off until you choose Accept analytics in the cookie banner. If you choose Reject analytics, or make no choice, no Google Analytics code is loaded, nothing is sent to Google and no analytics cookies are set.

When you accept, the following is sent to Google:

• the public pages you view (the page address and title, without anything that identifies you; only campaign labels such as utm_source from a link are kept), and the website you came from, as a site name only;
• a few events: a scan started or completed (only whether it was a site or a page, whether you were signed in, a result category and how many strong matches it showed), an account created, a first tracked item created (and whether it came from a scan or was added by hand), a review finished (resolved or dismissed);
• what any browser request reveals: your IP address and browser details reach Google's servers, from which Google Analytics derives approximate location and device type for its reports, and a random identifier is kept in the analytics cookies below.

Never sent to Google: your email address, name or account id, the websites you scan or their content, what you track, anything you type, or the addresses of signed-in pages. Advertising features are off: no Google signals, no ad personalisation, no advertising cookies.

Withdrawing. You can change or withdraw your consent at any time with Cookie settings in the footer; rejecting deletes the analytics cookies, and withdrawing does not affect what was processed before. Your choice is remembered for six months, then asked again.

How long Google keeps it. Event-level data (the individual events linked to the analytics cookie identifier) is kept for 14 months from collection and then deleted; coming back to the site does not extend that period. Aggregated reports (totals and counts that cannot identify you) are not covered by that period and may be kept longer.

Who and where. The provider is Google, through the Google company that supplies Analytics to FactLatch under Google's terms (Google Ireland Limited or Google LLC). Google may process data in the United States and other countries. Google's data processing terms for Analytics provide safeguards for such transfers, including standard contractual clauses.

FactLatch relies on service providers (“processors”) that handle information on its behalf, under their own terms. Depending on how it is deployed they include:

• Supabase, for the database and sign-in;
• Vercel, for hosting;
• Inngest, for scheduled monitoring;
• Resend, for email;
• PostHog, for product usage events, and Sentry, for error reports, where enabled;
• Google, for analytics, only if you accept (above).

Some of these providers process information outside Serbia and the European Economic Area, including in the United States. Each provider's own terms describe the safeguards it uses for such transfers.

Strictly necessary, always (they need no consent):

• sb-…-auth-token: keeps you signed in. Up to 400 days, renewed while you use FactLatch; not readable by scripts, secure.
• fl_scan_handoff: holds a saved scan so you can continue after creating an account. 24 hours.
• fl_pw_reset: a short-lived marker during a password reset. 15 minutes.
• fl_scan_dismissed: remembers the discoveries you marked “Not relevant” on the import page. 24 hours.
• fl_consent: remembers your analytics choice. 180 days (six months), not renewed.
• fl-theme and fl-motion in your browser's own storage: your appearance choices, saved only if you change them; they stay until you clear them and are never sent to FactLatch.

Only if you accept analytics:

• _ga and _ga_<id> (Google Analytics): a random visitor and session identifier, to count visits. 180 days, renewed when you come back.
• fl_ev: names the step you just completed (for example “account created”) so it is counted once. 10 minutes, deleted as soon as it is used; it contains no personal information.

There are no advertising cookies.

• Account and workspace, tracked items, checks, detected changes and review decisions: while your account exists. Monitoring history is append-only by design, and an item you stop tracking is deactivated, not erased.
• Free-scanner records (the address typed, counts, the one-way hash, example sentences): FactLatch plans to remove them after about 90 days. This is only a plan and may not be met: automatic deletion is not built yet and no regular removal is running yet, so for now they are kept until they are removed, and they can be removed earlier on request (see “What is not built yet”).
• Email logs, backups, hosting logs, PostHog and Sentry data: kept by those providers for the periods their plans and settings allow.
• Google Analytics: event-level data 14 months from collection (see above); aggregated reports may be kept longer.

Under the Serbian law and, where it applies, the GDPR, you have the right to:

• know whether FactLatch handles information about you, and get a copy (access);
• have wrong information corrected (rectification);
• ask for your information to be erased, in the cases the law provides (erasure);
• ask FactLatch to restrict how it uses your information while a question is settled (restriction);
• receive the information you gave FactLatch in a common format, and ask to have it passed on (portability);
• object to uses based on FactLatch's legitimate interest, including product usage events and error reports, and to the weekly summary (objection);
• withdraw consent at any time, for example with Cookie settings, without affecting what happened before;
• not be subject to a decision based solely on automated processing with legal or similarly significant effects. FactLatch makes no such decisions.

How to ask. Email support@factlatch.com from the address of your account (or tell us which account it is), and say which right you want to use. FactLatch may ask you to confirm that the account is yours, and asks for nothing more than it needs to do that. There is no charge. FactLatch aims to answer within 30 days; if a request is complex or there are many, it can take longer, and you are told why. If FactLatch refuses a request, it says why and how you can complain.

What can be done today. Access, correction, erasure and portability requests are handled by the person who operates FactLatch, by hand. You can already stop tracking any item yourself, change your email preferences yourself, change or withdraw your cookie choice yourself, and, on plans that include it, export your tracked facts as a CSV from the app. Erasing an account removes the account and its workspace; some information can remain for a limited time in provider backups, and information the law requires FactLatch to keep for legal claims or obligations is kept only as long as that requires.

If you think FactLatch has handled your information unlawfully, please write to support@factlatch.com first so it can be put right. You also always have the right to complain to a supervisory authority.

• In Serbia: the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs, office@poverenik.rs.
• In the EU/EEA, where the GDPR applies: the data protection authority of the country where you live or work or where you think the problem happened.

These are things this page does not promise because FactLatch does not do them yet:

• Self-service deletion of an account and its data, and a one-click export of everything. Today these are handled by hand on request (above).
• Automatic deletion of free-scanner records. The 90-day period above is only a plan and may not be met; no automatic or regular removal is running yet.
• Paid plans and payments. There is no billing today; when it exists, invoices and payment records will have their own legal retention rules and this page will say so.

If this page changes in a way that matters, the date above changes with it.