Privacy

Last updated: 13 October 2026

This page explains what personal data fuentio.com handles, why, and what you can ask us. It is written for the service as it is today: the website, the Fuentio API and MCP server, and paid plans sold through Creem.

Who we are

The site is run by Mouad Jaoucha, an individual founder (Casablanca, Morocco). Fuentio is not yet a registered business. Contact: hello@fuentio.com. Because the site is aimed at people in the European Union, we apply the EU General Data Protection Regulation (GDPR).

What we collect, and why

When you write to us. When you send the waitlist and contact form, your email address and what you wrote (name, company, topic, message) are stored in a database that Cloudflare runs for us (Cloudflare D1). We use them only to reply to you and to tell you when access opens. To keep out spam, a Cloudflare Turnstile check runs when you send (it sets no cookies), and a scrambled (hashed) form of your IP address is kept for 24 hours so that one connection can send at most 5 messages an hour. Legal basis: your request (GDPR art. 6(1)(b)), your consent for the opening announcement (which you can withdraw at any time), and our legitimate interest in stopping spam (art. 6(1)(f)).

When you visit. Our host, Cloudflare, processes technical data needed to deliver the site and protect it from attacks, such as your IP address and browser details, in its logs. Legal basis: our legitimate interest in running a secure site (art. 6(1)(f)).

Cookies and visit statistics. The site sets no cookies and loads no advertising scripts. To count visits, it uses Cloudflare Web Analytics, which uses no cookies or other storage on your device and, in Cloudflare's words, doesn't “fingerprint” individuals via their IP address or browser details. It tells us which pages are visited, from which websites and countries, and how fast pages load. Legal basis: our legitimate interest in knowing which pages are useful (art. 6(1)(f)). If you close the language note, your browser remembers that choice on your device; it is never sent to us.

When you buy a plan. Paid plans are sold through Creem, our reseller and merchant of record, which handles payment and VAT. Creem collects your payment details and billing address as the seller, under its own privacy notice; we never see your card number. Creem tells us what we need to run your plan, such as your name, email address, the plan you bought and whether payments went through. Legal basis: our contract with you (art. 6(1)(b)), and the law, for the billing records we must keep (art. 6(1)(c)).

The demo. Searches in the demo box run in your browser, on a saved snapshot of public records. Nothing you type there is sent to us.

The free check page. What you type on the check page is sent to our server, which asks our API with our own key and returns the answer; it isn't stored. To allow 3 free checks a day, we count checks per visitor with a scrambled (hashed) form of the IP address, deleted after 24 hours. Legal basis: our legitimate interest in keeping the free check available to everyone (art. 6(1)(f)). We also count anonymous page actions (for example a check run, a copied setup line or a plan button click) by day, page and language, with the ?ref= tag the visit came with. No IP address, cookie or identifier is kept for this.

The free list check. The companies you paste on the list check page are sent to our server, which checks them with our API and returns the results to your browser; the list itself isn't stored. We keep your email address, the number of lines and the date, so that we can follow up on your check and allow one free list per email per day, and a scrambled (hashed) form of your IP address for 24 hours (at most 3 lists per connection a day). A Cloudflare Turnstile check runs when you send (it sets no cookies). Legal basis: your request (art. 6(1)(b)) and our legitimate interest in following up and stopping abuse (art. 6(1)(f)).

Country requests. When you ask for a new country on the coverage page, we keep the country, the use case you chose and, only if you give it, your email address, to tell you when that country is ready. A Turnstile check and a hashed form of your IP address, kept 24 hours, stop spam. Legal basis: your request (art. 6(1)(b)) and our legitimate interest in stopping spam (art. 6(1)(f)).

When you use the API or the MCP server

The Fuentio API (api.fuentio.com) and MCP server (api.fuentio.com/mcp): here is what a call leaves with us, and why.

Your API key, if you create one. We keep a hash of the key and its first characters (never the key itself), your plan, when the key was created and last used, any label you give, and the email address you give when you create the key (required for a free key: one free key per person). We use that email to manage your key (for example, if you lose it) and to contact you about the service, such as changes to your plan, limits or the API. We don't use it for marketing and we don't share it. To keep one free key per connection, we also keep a scrambled (hashed) form of the IP address that created the key. Legal basis: our contract with you (art. 6(1)(b)). If you pay, we also keep Creem's customer and subscription references.
Usage counters. For each key, or without a key for a hashed form of your IP address, we count the units and requests used per day. Why: your quota, rate limits and, for paid plans, billing. Legal basis: our contract with you (art. 6(1)(b)) and our legitimate interest in preventing abuse (art. 6(1)(f)).
Call logs. Our application writes one line per call: a request ID, the time, the kind of call (the route, without the company number or search text), the status, the units used, the source and whether our cache answered, and a hashed form of the caller. For MCP, each tool call is also recorded with the tool name, the country asked for, the outcome, the units, the time it took, a hashed caller or your key's ID, and the name and version your app announces (for example its name as an MCP client). The text of what you search is not in these logs. Why: security, debugging and measuring the service. Legal basis: our legitimate interest in running a reliable, secure service (art. 6(1)(f)).
Web server access log. The web server in front of the application also writes a technical access log, which includes the address you called (so a company number or the words of a search), the IP address that Cloudflare passes on, and your client's name and version. It is kept only until it is overwritten (at most five files of 10 MB per service).
Receipts. For each lookup we keep the record we served and its hash, linked to your key, so you can prove later what you received.

Neither the API nor the MCP server offers search by a person's name. Company data in the answers comes from official registers (see below).

If you use Fuentio for a business and we process personal data on your behalf, a data processing agreement is available on request at hello@fuentio.com.

How long we keep it

Waitlist and contact messages: up to 24 months, or until access opens and you tell us whether you want to stay in touch, whichever comes first. You can ask us to delete them sooner.
Free list checks (email, number of lines, date) and country requests: up to 12 months. You can ask us to delete them sooner.
Technical logs: as long as Cloudflare keeps them under its own policy.
If you buy a plan: your customer details for as long as your plan runs, and billing records as long as accounting and tax law requires.
API key details: while your key exists. Ask us and we delete them, except what the law requires us to keep.
Usage counters and call logs: 14 days.
Web server access log: until it is overwritten, at most five files of 10 MB per service.
Receipts: 24 months, then deleted.
Database backups: nightly copies kept 7 days.

Who processes it for us

Cloudflare, Inc. (United States): hosting, security, the database that stores form messages, the Turnstile spam check, and forwarding emails sent to hello@fuentio.com.
The founder's email provider, where our replies and forwarded messages are stored.

Hetzner Online GmbH (Germany): the server that runs the API, the MCP server and their database, in Falkenstein, Germany.
Cloudflare, Inc. (United States) also sits in front of api.fuentio.com: it carries the traffic, handles TLS and filters attacks, so it sees your IP address and requests.

We also share data with:

Creem (Armitage Labs OÜ, Estonia), our reseller and merchant of record: when you buy a plan, Creem sells it to you, processes your payment and handles VAT, under its own privacy notice.

Transfers outside the European Union

The API's server and database are in the EU (Germany). Cloudflare is based in the United States, and the publisher lives in Morocco. Data may therefore be processed outside the EU. Cloudflare relies on the EU's standard contractual clauses and the EU–US Data Privacy Framework for such transfers. Creem explains in its own privacy notice how it protects the data it processes. We keep what we hold to the minimum described above.

Your rights

You can ask to access, correct or delete your data, to object to its use, to restrict it, or to receive a copy (portability), and you can withdraw your consent at any time. Write to hello@fuentio.com; we reply within one month.

If you think we have not respected your rights, you can complain to a data protection authority, for example the CNIL in France (cnil.fr) or the AEPD in Spain (aepd.es).

Company data we publish

Fuentio's product is official company data. It is not about people, but company registers do name company officers. Here is how we handle that:

The data comes only from official public registers: the Annuaire des Entreprises in France and the BORME in Spain. Each record names its source.
No answer names a person: officers, shareholders and sole traders are not served, and the company graph links companies only. We store officers' names and roles only, as the register publishes them, and nothing else about them: no birth dates, no nationality, no private addresses. National ID numbers printed in BORME texts are removed before anything is stored.
We honour the French opt-outs from public diffusion: those companies are not in the source, and not in Fuentio either.
When the BOE later withdraws a BORME document from indexing, we treat it as a removal request and hide the officer data that came from it.
You cannot search Fuentio by a person's name.
On this website, the demo shows no officers and no names.

Anyone can ask us to review a record that concerns them: write to hello@fuentio.com with the company and what you would like checked.

Changes

If this page changes, the date at the top changes too. If a change affects how we use data you gave us, we will tell you by email first.