1. Who is responsible
Technologies Frontless, Inc. is responsible for the personal information described here. Our person in charge of the protection of personal information (Privacy Officer) can be reached at the address below for any question, request or complaint about privacy.
Privacy Officer — privacy@frontless.app — 555, rue Chabanel Ouest, bureau 1541, Montréal (Québec) H2N 2J2, Canada.
2. What we collect
| Information | When | Examples |
|---|---|---|
| Account and workspace | You sign up, are invited or apply for the beta | Work email, first and last name, company, sector, the workspace you belong to and your role |
| Sign-in and security | You sign in or request a sign-in link | Email address, IP address, browser (user agent), time of each link request and session |
| Billing contact | Your workspace buys credit | Name, email and billing address of the billing contact, any GST/QST numbers you enter, and payment history. Card details are entered with Stripe and never reach us. |
| Support | You use the support chat or email us | Your email and name, your messages and any files you send |
| Usage analytics (only with your consent) | You use the website or the app after allowing measurement | A pseudonymous account ID, your workspace’s ID, address and sector, your role, the pages you visit and the features you use, and the IP address our analytics provider receives |
| Demo access | You open a sector demo workspace | Email address, IP address and browser, recorded and sent to our team |
| Preferences | You choose them | Site language, phone layout, notices you have dismissed |
We do not ask for sensitive information, and Frontless is not intended for children: you must be of the age of majority to create an account.
3. Why we use it
- To create and secure your account, sign you in, and keep each workspace’s data separate (performance of our contract with you).
- To bill for paid work and keep the accounting records the law requires (contract and legal obligation).
- To answer support requests and tell you about changes to the service, prices or these policies (contract and legitimate interest).
- To review beta applications (steps you asked us to take before a contract).
- To understand how Frontless is used and improve it — only if you allow measurement (consent).
- To protect the service, detect abuse and enforce our Terms (legitimate interest and legal obligation).
We use personal information only for these purposes, or for a compatible purpose the law allows. If we ever want to use it for a new purpose, we will ask for your consent first.
4. Artificial intelligence and automated processing
Frontless uses AI models to understand requests, read documents and emails you forward, and draft text. The model receives only what a request needs. It is never sent passwords or connection tokens, and our providers’ business terms exclude training on what we send.
Frontless does not make decisions about you based exclusively on automated processing. Its findings and suggestions are proposals that a person reviews and approves. If a rule your workspace sets up acts automatically, it was configured and can be reversed by the people in that workspace.
5. Cookies and similar technologies
We use a small number of cookies and browser storage entries. The essential ones keep you signed in and remember your choices; analytics is off until you say yes.
| Name | Purpose | Lasts |
|---|---|---|
| fl_session | Keeps you signed in (essential). HttpOnly and sent over HTTPS only. | Up to 30 days |
| fl_oauth_nonce | Protects a connection to another tool while you authorise it (essential). | 10 minutes |
| fl_lang | Remembers the site language you chose. | 1 year |
| fl_device | Remembers that you prefer the phone layout. | 1 year |
| Amplitude cookie | Usage analytics — only after you allow measurement. | Set by Amplitude |
| Browser storage (fl_…) | Remembers your analytics choice, dismissed notices and an open support conversation. | Until you clear it |
You can change your analytics choice by clearing this site’s data in your browser; the question will be asked again.
6. Who we share it with
We do not sell personal information. We share it only with service providers that process it on our behalf, under contracts that require them to protect it and use it only to provide their service. They are listed, with what each one does, on our Trust & Security page: hosting and storage (DigitalOcean, Vercel), AI (Anthropic, OpenAI, Google, Augure, Mistral AI), email (Resend), payments (Stripe) and usage analytics (Amplitude).
We may also disclose information where the law requires it, to protect people or the service, or to a successor in a merger or sale of our business, which would remain bound by this policy.
Our staff can see account-level information needed to run the service — for example a workspace’s name, member count, credit and usage — and what customers send to support. They do not open a customer’s workspace records without the customer’s request.
7. Where it is processed
Our service providers may store or process personal information outside Québec and Canada, including in the United States. Workspaces whose data region is Canada keep their AI requests with a provider processing in Canada, and those whose region is the European Union keep them with an EU-hosted provider.
Before communicating personal information outside Québec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose, the safeguards in place and the applicable legal framework, and we put written agreements in place. For personal data from the European Economic Area, we rely on the European Commission’s standard contractual clauses or another recognised safeguard.
8. How long we keep it
| Information | Kept |
|---|---|
| Account and workspace information | While the account is open, then deleted when the workspace is deleted, unless the law requires us to keep it longer |
| Sign-in link requests (email, IP address) | 30 days after the link expires |
| Sign-in sessions (IP address, browser) | 90 days after the session ends |
| Support conversations | 2 years after the last message |
| Log of emails forwarded into a workspace (sender, subject, date) | 1 year. The emails and attachments themselves are filed as workspace documents and kept until the customer deletes them |
| Issued invoices and credit notes in a workspace | Until 31 December of the seventh year after issue, as tax law requires, then deleted automatically |
| Our own billing and payment records | As long as tax and accounting laws require |
| Sign-in rate-limit records | 24 hours |
| Analytics | As set in our agreement with Amplitude |
| Beta applications | Rejected applications: 12 months after the decision. Accepted ones become the account |
When information is no longer needed, we destroy it or anonymise it in line with the law.
9. How we protect it
Each workspace is sealed off by the database itself, sign-in uses single-use links instead of passwords, connection credentials are encrypted, and every change to a record is kept in a history no one can edit. The details are on our Trust & Security page.
If a confidentiality incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d’accès à l’information du Québec, and any other authority the law requires, promptly.
10. Your rights
Depending on where you live, you can ask us to:
- tell you whether we hold personal information about you and give you access to it;
- correct information that is inaccurate, incomplete or out of date;
- delete it, or stop disseminating it, where it is no longer needed or was collected unlawfully;
- give you, or a body you name, a copy of the information you provided in a structured, commonly used technological format;
- withdraw a consent you gave, such as consent to analytics;
- explain the information used to make a decision about you, if a decision were ever based exclusively on automated processing.
Send your request to privacy@frontless.app. We will answer within 30 days, free of charge, and may ask you to confirm your identity first.
If you are not satisfied with our answer, you can complain to the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or, in the European Union, your local data protection authority.
11. Changes to this policy
We will post any update here and change the date at the top. If a change materially affects how we use your personal information, we will tell account holders by email before it takes effect.