Privacy Policy

Last updated: July 2025 — Falfesh.com / ProjectHub

1. Who we are

Falfesh.com ("Falfesh", "we", "us", "our") operates the website at falfesh.com and the ProjectHub workspace platform available at falfesh.com/projecthub. This policy explains how we collect, use, and protect information when you use our services.

2. What we collect

We collect information in two ways:

• Information you provide — your name, email address, and any content you create inside ProjectHub (projects, tasks, comments, timesheets, approvals, messages). For organisations using ProjectHub, their administrators control what users enter.
• Information collected automatically — when you use our services, we log standard server information including your IP address, browser type, and pages visited. This is used to maintain security and improve reliability.

We do not use advertising trackers, third-party analytics, or behavioural profiling tools.

3. How we use your information

• To create and manage your account and your organisation's workspace
• To send transactional emails (account verification, password reset, task notifications, deadline reminders) — each type can be turned off in your organisation's Settings
• To maintain security, investigate abuse, and comply with legal obligations
• To improve and develop the service based on aggregate usage patterns (not individual tracking)

We do not use your data to train AI models. We do not sell, rent, or share your data with third parties for marketing purposes.

4. Who can see your data

Within ProjectHub, your organisation's data is visible only to members of your organisation. The platform owner (Falfesh) can access your workspace for support and security purposes only. Access is logged in the audit trail.

We share data with third parties only in these limited cases:

• Hosting infrastructure — Hostinger hosts our servers and databases in data centres in Europe/US. They process data on our behalf under strict data protection agreements.
• Email delivery — transactional emails are sent via PHP mail on our hosting server. No third-party email marketing platform receives your data.
• Legal requirements — if required by law, court order, or to prevent imminent harm.

5. Data retention

We retain your data for as long as your account is active. When an organisation's subscription ends, data is retained for 30 days to allow export, then permanently deleted. You may request deletion at any time (see Section 8).

Audit logs are retained for 12 months to meet security and compliance requirements. Server access logs are retained for 90 days.

6. Security

We take security seriously and have implemented the following protections:

• All data is transmitted over HTTPS with TLS encryption
• Session cookies are HttpOnly, Secure, and SameSite=Lax
• Passwords are hashed with bcrypt and never stored in plaintext
• All actions within ProjectHub are logged in a tamper-evident audit trail
• Role-based access controls restrict what each user can see and do
• Sensitive directories are blocked from direct web access

No security system is perfect. In the event of a breach that affects your data, we will notify affected organisations within 72 hours of becoming aware.

7. Cookies

We use one session cookie to keep you logged in. It is deleted when you close your browser or log out. We do not use advertising cookies, tracking pixels, or any third-party cookies on our platform.

The "recently viewed" feature on falfesh.com uses browser localStorage — this data never leaves your device.

8. Your rights

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — update or correct inaccurate data (you can do this directly in your profile)
• Portability — export your organisation's data at any time from the Reports page (CSV) or by contacting us for a full backup
• Erasure — request deletion of your account and all associated data
• Objection — object to any processing of your data

To exercise any of these rights, contact us at admin@falfesh.com. We will respond within 30 days.

If you are in the European Union or European Economic Area, you also have the right to lodge a complaint with your local data protection authority.

9. Children

Our services are not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us immediately.

10. Changes to this policy

We will update this policy when our practices change. We will notify all active users by email at least 14 days before any material change takes effect. Continued use of the service after that date constitutes acceptance of the updated policy.