Privacy Policy

Farving Ltd · Last updated 23 August 2026

This explains what we collect, why, and what you can make us do about it. It is written to be read, not to be survived.

Who is responsible

Farving Ltd, company number HE 493219, registered office in Limassol, Cyprus, is the data controller for farving.co. Contact: support@farving.co.

What we collect, and why

Your email address From the quiz, or from your purchase. Used to send your result, to deliver what you bought, and — if you ticked the box — to send the check-in emails and the newsletter.

Your quiz answers — as a score and a pattern We store the number of yes answers and which of the four patterns you landed on (belly, bloat, fatigue or mixed), so the emails you get are about your result rather than about something else. We do not store the individual answers.

Your five baseline numbers, if you send them to us Waist at navel, morning bloat, afternoon energy, post-meal bloat, weight. Nothing on this site collects these any more — we ask for them in the first email after you buy, and we hold whatever you choose to reply with, against your email address. Supporting a guarantee claim is the only reason we hold them. If you never send them, we never have them, and the guarantee then runs on the copy you kept yourself.

Purchase records What you bought, when, for how much, and the order reference — from Gumroad, which is the merchant of record and takes the payment. Kept because Cypriot tax and company law requires it.

Card details Never. The checkout happens on Gumroad, not on this site; we never see or store a card number, and no card is ever entered on a page we serve.

Health information

Your quiz pattern and your five baseline numbers say something about your health. We treat them as sensitive, we collect them only because you chose to give them, we use them only for the two purposes above, and we never sell or share them for advertising. You can have them erased at any time, and erasing them does not affect anything you have already bought — but it does mean we no longer hold the baseline the guarantee compares against, so keep your own copy.

Lawyer Confirm whether the quiz pattern and the five baseline numbers are special-category data under Article 9 GDPR, and if so which Article 9(2) condition we are relying on and whether the explicit-consent wording at each capture point is sufficient. This also determines whether an Article 30 record and a DPIA are required.

Why we are allowed to hold it

To do what you paid for — the check-in emails, answering you, and handling a guarantee claim. The files themselves are delivered and hosted by Gumroad. (Performance of a contract.)
Because you agreed — the quiz result email and the newsletter. You tick a box for each, and you can withdraw it at any time without affecting anything else. (Consent.)
Because the law requires it — invoices and payment records. (Legal obligation.)

Lawyer — the question changed shape, it did not go away The old version of this asked whether bundling a marketing opt-in with the pay button was compatible with Article 7(4) GDPR. That checkbox was on a checkout page we controlled, and that page no longer exists — the checkout is Gumroad's. Advise instead on what we may lawfully do with a buyer's address that reaches us from Gumroad: whether marketing to a Gumroad customer needs its own consent or rests on the soft opt-in for an existing customer, what Gumroad's own checkout collects on our behalf and on what basis, and whether Farving Ltd and Gumroad are joint controllers or controller-and-processor for that address. The forms on this site (the quiz and the two capture forms) carry their own unbundled tick box and are not affected.

Who else touches it

Gumroad — the checkout, the payment, the tax, the receipt, and the hosting of every file you buy. Gumroad is the merchant of record, not a processor acting on our instructions: for the payment it decides its own purposes and it has its own privacy policy, which applies to you as well as this one.
Netlify — hosting this site and the one function behind the email capture forms.
Beehiiv — the email list, including your quiz pattern as a custom field.
Resend — the email that sends you the thing you asked for on this site.

Netlify, Beehiiv and Resend are processors acting on our instructions. Gumroad is not, and that distinction is deliberate rather than a technicality — it is why your payment data is governed by Gumroad's policy and your quiz answers are governed by this one. We do not sell your data to anyone, and we do not run advertising pixels.

Lawyer Confirm the international-transfer position for the US-based recipients above (SCCs or an adequacy route), that a written processor agreement is in place with each of the three processors under Article 28, and whether a UK addendum is needed given we sell into the UK. Then, separately, settle the Gumroad relationship: merchant of record is not the same as processor, and this page now says so — confirm the characterisation is right, whether an Article 26 joint-controller arrangement is required for the buyer address that reaches us, and which of the two policies has to be surfaced where.

Cookies

None of ours. This site sets no cookie of its own: no analytics cookies, no advertising pixels, no cross-site tracking, and no local storage. That is a change — the checkout used to run here and needed essential cookies to do it. Clicking a buy button takes you to gumroad.com, and what Gumroad sets there is covered by Gumroad's policy.

How long we keep it

Purchase and tax records for as long as Cypriot law requires. Your email address until you unsubscribe or ask for deletion. Your quiz pattern and baseline numbers until you ask for deletion, or until you unsubscribe and the account is closed.

What you can make us do

Ask for a copy of what we hold, correct it, delete it, get it in a portable file, object to a use, restrict a use, or withdraw a consent. Email support@farving.co and we will act within thirty days, usually much sooner. There is no charge and you do not have to give a reason.

One limit, stated plainly: we can only act on what we hold. Your payment record sits with Gumroad, which is the merchant of record and not our processor, so a request that reaches into the payment itself has to go to Gumroad as well. Write to us anyway and we will tell you which part is which.

You can also complain to the Cypriot supervisory authority — the Office of the Commissioner for Personal Data Protection — or to the authority where you live.

Lawyer Advise whether an EU/UK Article 27 representative is required, and whether the business meets any threshold requiring a designated Data Protection Officer.

Contact

support@farving.co