Privacy Policy

1. Controller

The controller responsible for processing your personal data is:

Questions about data protection, or requests to exercise your rights, can be addressed to hello@fooh.com (attn. Moritz Lumetsberger). We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG).

2. What data we process

2.1 Data you provide

• Account: email address, password (stored only as a hash by our auth provider), and—if you sign in with Google—your Google display name and profile image.
• Profile / portfolio: display name and handle, talent type, country and city, biography, public contact email, availability, avatar, showreel, social links, key people you list, and your selected capabilities, industries and tools.
• Uploaded work: the videos, images, titles, descriptions, credits and other content you upload or submit, together with technical media metadata (dimensions, format, upload time).
• Engagement: likes, comments and collections you create.
• Jobs board: job/project postings you publish (company, description, logo, location, budget) and job applications you submit (your message and answers to screening questions).
• Awards: award entries, credits, votes and—where applicable—jury ballots.
• Newsletter: your email address if you subscribe.
• Contact & support: the content of messages you send us or to a creator through our forms.
• Full hiring report: when you ask for the full creative hiring report, your name, work email, company and, if you add it, what you are hiring for. We keep the request as a sales enquiry and email you the link to the report.
• Invoices you write: when you use Account → Invoices, the invoices you save (your details and your client's, the work, amounts, bank details and notes), the clients you save (their name, company, address, VAT id and email) and your billing details (name, studio, address, VAT id, email and bank details). Only you can see them; they are never shown on your profile, and they are deleted with your account.
• Payments: when you buy a paid service, our payment provider (Stripe) processes your payment data. We receive confirmation of payment plus limited details such as currency, amount and the billing email—not your full card number.

2.2 Data we collect automatically

• Server and security logs including IP address, browser and device type, and timestamps.
• Your time zone: when you are signed in, we store the time zone your device reports (such as Europe/Vienna, never a city or address) so messages we send you reach you at a sensible local hour.
• View analytics for creators: when a profile or work item is viewed, we record an aggregated event with a one-way hashed visitor identifier (so the same visitor is counted once per day), the approximate country (from a network header), a device class, and the referring source. We do not build cross-site profiles and the hash cannot be reversed to identify you.
• Privacy-friendly, cookieless edge analytics (Cloudflare Web Analytics) measuring aggregate page views and performance.
• Google Analytics 4: we use Google Analytics to understand how the site is used — pages viewed, sessions, approximate location, device type and the referring source. It sets cookies (see “Cookies” below) and assigns a random client identifier; we do not use it to identify you personally.

2.3 Special categories

We do not intentionally collect special categories of personal data (e.g. health, ethnicity, political opinions, religious beliefs). Please do not submit such data through public profiles or uploads.

2.4 Messages you send us on Instagram

If you send a direct message to our Instagram account @fooh_com, we receive and store that conversation so our team can read and answer it alongside our other correspondence instead of in the Instagram app. For each conversation we store your Instagram user ID and username, your profile picture as served by Instagram, the message content, and the times messages were sent. Where you send a photo, video, voice note or a shared post, we store only a note of the message type—we do not download or keep the media itself. Replies our team sends from our own tools are recorded the same way.

Messages are handled by people, not by automated agents. If you also appear in our business contact records, the conversation is linked to that record so we can see one history per person. We receive these messages through the Instagram Messaging API operated by Meta; Instagram’s own processing of your message is covered by Meta’s privacy policy.

2.5 The FOOH Screens app in AI assistants

The FOOH Screens app lets anyone find screens from our public screens directory inside an AI assistant such as ChatGPT or Claude, without a FOOH account. To answer, the assistant sends us what the request needs (for example a city, a country or a point on a map, or the screens, dates and campaign details of a quote request it prepares for you); we use it only to answer that request and do not store it. A quote request is only a prefilled link to our inquiry form: nothing reaches us until you submit that form on fooh.com. We do not receive your name, your account with the assistant or the rest of your conversation; how the assistant itself handles your conversation is covered by its provider’s privacy policy.

For each request we log which tool was used, whether it succeeded, how long it took, the time, and which assistant it came through (ChatGPT or Claude, read from the app address that assistant’s directory listing uses, or from what the assistant itself sends with the request; otherwise “unknown”) — never what was asked. We use this log to see how the app is used and to apply a platform-wide limit on requests per minute. Links the app hands out carry the Screens app as their source, so that a visit to fooh.com, and a screen inquiry you then choose to submit, can be attributed to it; the inquiry records that source alongside what you enter in the form.

2.6 Presentations we send you

When we send you a presentation, it comes as a personal link on fooh.com (fooh.com/for/…) made for you, plus a password. Once the password has been entered, we record each visit to the presentation through that link: which link was used (and so whom we sent it to, even if it was forwarded), which version of the presentation was shown, when the visit started and last showed activity, how long the presentation was on screen in total and how long each slide was on screen, whether it was read on a phone or a desktop, and whether the PDF was downloaded from it. Time only counts while the presentation is visible in your browser. Nothing is recorded before the password is entered, so a link preview in an email or chat app is not counted; we do not record what you type or click inside the presentation, and the presentation itself cannot reach the rest of fooh.com.

We use this to follow up on the business conversation the presentation belongs to: our team sees these visits with our record of that conversation, and the team member responsible for that conversation may be notified by email when you open the presentation (who opened it, which presentation and version, not how long it was read). Your IP address is used only briefly to limit password attempts and is not stored with the visit.

2.7 The Screen Viewer, on fooh.com and on other sites

Some screens in our directory have a Screen Viewer: an interactive street view of the screen playing example work. It appears on the screen’s page, through links people share, and embedded on other websites (for example a screen owner’s site). Each time a viewer is loaded we record one “viewer view”: which screen and which example work it opened on, whether it was on fooh.com, a shared link or an embed, which sharing button was used when a shared link includes that information (and for an embed, the address of the website it was embedded on, its origin only, never the page), whether it was shown on a phone or a desktop, the connection type your browser reports (such as “4g”), how long the viewer took to appear, and how much it had loaded by then (the amount of data, and how many seconds of the example video were ready). The record is updated while the viewer stays open, and last when you leave the page, with what happened in the viewer: how long it was on your screen, which example works played and for how long (and whether to the end), how many times you walked or zoomed, whether you tried your own file in it (only that you did: your file never leaves your device), whether you followed its link to fooh.com, and how long the video paused to load.

This measurement sets no cookies and stores nothing on your device. To count how many people saw a viewer on a given day, our server combines your IP address, your browser’s user agent and the screen with a random key that changes every day, and keeps only the resulting one-way code; your IP address and user agent are not stored. The day’s key is deleted within minutes of the day’s end (midnight UTC), after which the code no longer allows anyone, including us, to tell whose view it was, or to recognise you on another day or another website. The embedded viewer loads no Google Analytics. We use these records, which our team sees only in aggregate in our admin tools, to learn how the viewer is used and how fast it loads.

On fooh.com, the viewer remembers whether you chose to expand or collapse the works panel using localStorage in your browser. This preference stays until you clear the site’s browser data and is not used to identify you. The embedded viewer does not save this preference.

3. Purposes and legal bases

• Operating your account and providing the platform (library, profiles, uploads, engagement, jobs board, awards, the invoices you save) — performance of a contract, Art. 6(1)(b) GDPR.
• Processing payments for paid services (job postings, awards entries) — Art. 6(1)(b) GDPR.
• Publicly displaying your profile and work and attributing credits — performance of our contract with you and our and your legitimate interest in attribution, Art. 6(1)(b) and (f) GDPR.
• Security, fraud and spam prevention (including bot detection via Cloudflare Turnstile) and keeping the service stable — legitimate interest, Art. 6(1)(f) GDPR.
• Aggregate analytics and improving the platform — legitimate interest, Art. 6(1)(f) GDPR.
• Operating the FOOH Screens app (answering requests, logging calls to limit load and measure use, attributing visits and inquiries to the app) — legitimate interest, Art. 6(1)(f) GDPR.
• Sending you the full hiring report you asked for, and following up about hiring artists through FOOH — legitimate interest, Art. 6(1)(f) GDPR. You can object at any time by replying to our email or writing to hello@fooh.com.
• Recording visits to presentations we send you (section 2.6), to follow up on our business conversation with you — legitimate interest, Art. 6(1)(f) GDPR. You can object at any time by writing to hello@fooh.com.
• Measuring how the Screen Viewer is used and how fast it loads (section 2.7) — legitimate interest, Art. 6(1)(f) GDPR.
• Sending the newsletter and any third-party embedded content that sets cookies — your consent, Art. 6(1)(a) GDPR (withdrawable at any time).
• Complying with legal obligations (e.g. accounting and tax retention) — Art. 6(1)(c) GDPR.

4. Public visibility

FOOH is a public, user-generated-content platform. Your profile, the work you upload, your public comments and any public collections are visible to anyone on the internet and may appear in search engines. Information you place on a public profile (such as your name, company, role or contact email) is published deliberately for attribution. You control most of this content and can edit or remove it from your account.

5. Recipients and processors

We use carefully selected service providers who process data on our behalf under data processing agreements:

• Google / Firebase — authentication and login.
• Google Analytics (Google Ireland Ltd / Google LLC) — website usage analytics. Data may be processed in the United States under Google’s EU–US Data Privacy Framework certification.
• Google Cloud (Cloud SQL) — hosting of our application database (EU region).
• Cloudflare — media storage and video streaming (R2 and Stream, served from media.fooh.com), CDN and security, bot protection (Turnstile) and cookieless website analytics.
• Stripe — payment processing.
• Mailchimp / Mandrill — newsletter and transactional email.
• Slack — internal operational notifications (e.g. a new job posting or award entry).
• Meta Platforms (Instagram) — direct messages you send to our Instagram account reach us through Meta’s Instagram Messaging API. Meta processes those messages as its own controller under its own privacy policy.
• Embedded players — when a profile or work page loads a YouTube, Vimeo or Instagram embed, your browser contacts those providers, who may receive your IP address and set their own cookies under their own privacy policies.

We do not sell your personal data.

6. International transfers

Some of the providers above are based in, or process data in, the United States. Where data is transferred outside the EU/EEA, we rely on an EU Commission adequacy decision (including the EU–US Data Privacy Framework, where the provider is certified) and/or the EU Standard Contractual Clauses together with additional safeguards. You can request more information or a copy of the relevant safeguards at hello@fooh.com.

7. Retention

• Account, profile and uploaded content: for as long as your account exists. When you delete your account or content, it is removed, subject to short technical backup cycles.
• Job and award data: for the duration of the relevant cycle plus the period needed for disputes.
• Payment and invoicing records: 7 years, to meet Austrian accounting and tax obligations.
• Newsletter: until you unsubscribe.
• Hiring report requests: kept as a sales enquiry while it is relevant to a business conversation with you, and deleted on request.
• Instagram direct messages: for as long as we keep the contact record the conversation belongs to, and deleted earlier on request.
• Presentation visits: for as long as we keep the business contact record the link was made for, and deleted earlier on request.
• Screen Viewer views: kept without a time limit, as they no longer point to a person once the day’s key is deleted (at the end of that day).
• Screens app call log: kept only as long as needed for statistics and the request limit, then deleted or aggregated. It contains no personal data of the person asking.
• Server logs and analytics events: kept only as long as needed for security and statistics, then deleted or aggregated.

8. Your rights

Under the GDPR you have the right to:

• access your personal data;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict processing;
• data portability (a structured, machine-readable copy);
• object to processing based on legitimate interest, including any direct-marketing processing;
• withdraw consent at any time, without affecting prior lawful processing.

To exercise any of these, contact hello@fooh.com. You can also delete or edit most of your data directly in your account.

8.1 Deleting your data

To have your personal data erased, email hello@fooh.com from the address on your account, stating what you want deleted. To delete an Instagram conversation and the profile details we hold from it, message us from the Instagram account concerned or email us the handle. To delete the record of your visits to a presentation we sent you, email us from the address we sent it to. We answer every request and complete verified ones within 30 days, except where the law requires us to keep a record (for example, invoicing data we must retain for seven years). Deleting your account removes your profile and uploads directly.

9. Right to complain

If you believe our processing infringes data protection law, you can lodge a complaint with a supervisory authority. The competent authority in Austria is the:

10. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

11. Cookies

We keep cookies to a minimum. We use a strictly necessary session cookie to keep you signed in, and our hosting/security provider may set strictly necessary cookies to protect the service. These do not require consent. Our edge analytics (Cloudflare) are cookieless. When you enter the password of a presentation we sent you (section 2.6), a strictly necessary cookie keeps that one link open in your browser for 8 hours.

We also use Google Analytics, which sets analytics cookies (such as _ga and _ga_*) to measure site usage with a random client identifier. You can prevent these through your browser’s cookie controls or Google’s opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Non-essential cookies are only set by third-party content—embedded YouTube, Vimeo or Instagram players and, at checkout, our payment provider Stripe—when that content loads. These are governed by the third party’s own policy. You can manage or delete cookies through your browser settings; blocking all cookies may break parts of the site.

12. Data security

We apply appropriate technical and organisational measures—including encryption in transit, access controls and hashed credentials—to protect personal data. In the event of a data breach that is likely to result in a high risk to your rights, we will notify the supervisory authority within 72 hours where feasible and affected users without undue delay.

13. Changes

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date; for significant changes we will provide a more prominent notice.