Privacy Notice

Frictionary (“we,” “us”) provides an AI-agent testing service. For personal data about our account holders and visitors, we are the controller. For personal data contained in the sites and content you submit for testing, you are the controller and we act as your processor(see “Data you submit about others”).

Controller: [legal entity name], [registered address]. Privacy contact: privacy@frictionary.ai. EU/UK representative (if applicable under GDPR Art. 27): [name & address, or “not yet appointed”].

• Account data, name, email, hashed password, and (optionally) phone number.
• Profile data, the business profile and goals you give at onboarding.
• Content you submit, the target sites, tasks, and notes you enter, and the run data we generate: page snapshots and screenshots of the pages an agent visited (which may incidentally contain personal data shown on those pages), the agent’s steps, and findings.
• Usage & billing metadata, runs, costs, plan, and, if you buy a plan, limited billing details held by our payment processor (we do not store full card numbers).
• Communications, messages you send us and support correspondence.
• Technical data, IP address, device/browser info, and logs, used for security and to operate the service.

Under the GDPR we rely on these legal bases:

• To provide the service, run tests, deliver reports, manage your account. Basis: performance of a contract.
• To secure, maintain, and improve the service, prevent abuse, and keep usage/cost records. Basis: legitimate interests.
• To bill you and keep financial records. Basis: contract and legal obligation.
• To send product and account email you’ve enabled; you can opt out of non-essential messages in Settings. Basis: legitimate interests / consent where required.
• To comply with law and enforce our Terms. Basis: legal obligation / legitimate interests.

Tests are performed by third-party AI models operating a browser on your instructions. We do not use your Customer Data to train our own models, and we use providers on terms that do not use your data to train theirs for the enterprise/API access we use, where such terms are available. We do not make decisions producing legal or similarly significant effects about you solely by automated means.

We use trusted subprocessors to run the service, each processing data only to provide its part:

• Database & hosting, [Neon / your host] (data stored in [region]).
• AI model providers, OpenAI and Anthropic (the agents that perform tests).
• Email, Resend. SMS (if you enable phone), Twilio.
• Payments, [Stripe], once billing is enabled.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. A current subprocessor list is available on request. We may disclose data if required by law or to protect rights and safety, and we may transfer data as part of a merger or acquisition (you will be notified).

We and our subprocessors may process data in the United States and other countries. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum). Contact us for details.

We keep personal data while your account is active and as needed to provide the service, meet legal, tax, and security obligations, and resolve disputes. When you delete your account, we delete your workspace and its projects, runs, reports, screenshots, and findings; backups and logs age out on a rolling basis.

Depending on where you live, you have rights over your personal data. Under the GDPR/UK GDPR: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent; and the right to complain to your supervisory authority. Under the CCPA/CPRA(California): to know, access, delete, and correct; to opt out of “sale”/“sharing” (we do neither); to limit use of sensitive personal information; and not to be discriminated against for exercising these rights.

To exercise any right, email privacy@frictionary.ai or use account controls in Settings. You can delete your account and data yourself in Settings. We will verify your request and respond within the timeframe the law requires. You may use an authorized agent where the law allows.

We encrypt data in transit and at rest, scope access to your organization, hash passwords and API keys, hold provider keys server-side, rate-limit and restrict our automated agents, and restrict testing to public targets. No system is perfectly secure; see our Help for our security overview, and report concerns to security@frictionary.ai.

We use strictly necessary cookies to keep you signed in and to secure the service. We do not use advertising or cross-site tracking cookies. Because we use only essential cookies, no consent banner is required for them; if we add analytics later, we will ask for consent where required.

Frictionary is for business use and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data, contact us and we will delete it.

When you test a site, the run data may include personal data of third parties shown on that site. For that data you are the controller and we are your processor: you are responsible for having a lawful basis to submit it, and you should test your own or authorized, preferably non-production, environments. A Data Processing Addendum (DPA) is available at privacy@frictionary.ai.

We may update this notice; material changes will be notified (e.g., by email or in-app). The “last updated” date above shows the current version.

Privacy questions or requests: privacy@frictionary.ai.