Frontegg Ltd. (Registration No. 516093548) (“Frontegg”, “we”, “us”, “our” or “Company”) provides a cloud-based user management platform for B2B SaaS (“Platform”). The Platform provides companies with services which include fundamental authentication flows, complex organizational structures (multi-tenancy), fine-grained authorization, API-token management, self-service admin portal for end-users, subscription enforcement, single-sign-on (SSO), and more (“Services”).
This privacy policy and notice (“Privacy Policy”) describes how Frontegg collect, use and process Personal Data (as such term defined below), including the needed disclosure and information about the types of Personal Data collected, why we collect your Personal Data and the purposes for which we will use it, how long we will retain it, with whom we share it, what are your applicable right regarding your Personal Data, and how you can exercise them.
This Privacy Policy applies to our data collection and privacy practice in connection with:
Customer, Authorized User and Prospect shall be, collectively and separately, referred herein as “you”.
ANY PERSONAL DATA YOU PROVIDE IS MADE AT YOUR FREE WILL AND CONSENT (WHERE REQUIRED UNDER APPLICABLE DATA PROTECTION LAWS), AND YOU ACKNOWLEDGE THAT YOU ARE NOT UNDER ANY STATUTORY OBLIGATION TO PROVIDE PERSONAL DATA TO FRONTEGG. However, we must collect or receive some Personal Data to provide the Service, and if you will not provide us with such Personal Data, we will not be able to fulfill certain purposes, for example, provide certain Services or enable use of certain features – all as described under Section 3 below – “Personal Data Processed and the Purpose of Processing” which details the purposes for which each Personal Data set is collected. This Privacy Policy further includes or incorporates specific information required under applicable data protection laws for residents of certain jurisdictions, among others:
If you are a located in the EEA or UK – this Privacy Policy further details our lawful basis for processing Personal Data, information regarding cross border data transfer and your rights, as well as additional information we are required to disclose to you under the EU and the UK General Data Protection Regulations (collectively “GDPR”).
If you are a California resident – please also review our CCPA Privacy Notice which serves as a Notice at Collection as required under the California Privacy Rights Act (“CCPA”) and further details the categories of information collected and additional information regarding our privacy practices, including your rights.
Additional Information to certain United States Residents (including, for example and without limitations, Colorado, Connecticut, Virginia and Utah) – please also review Section 13 of this Privacy Policy “Jurisdiction Specific Notices” to learn more about our privacy practices and your rights under these territories.
For the purposes of GDPR and other applicable privacy laws, Frontegg is a data controller (as defined under the GDPR) and the database owner as defined under Israeli privacy protection law (both an owner and controller shall be defined herein as a “Controller”) in relation to the Personal Data, described in this Privacy Policy. This excludes data related to employees or job applicants, for which separate privacy policies are maintained. If you are a candidate, please review our Candidates Privacy Policy available at: https://frontegg.com/candidates
As a Controller, we are responsible for determining the purposes and means of processing your Personal Data, implementing appropriate measures to secure the Personal Data we store, and, where applicable, enabling you to exercise your rights. For any question, inquiry or concern related to this Privacy Policy or the processing of your Personal Data, you may contact as follows:
By email: privacy@frontegg.com By mail: Jabotinsky St. 7, Ramat Gan, Israel
We may collect two types of information from you, depending on your interaction with us:
The first type of information is non-identifiable and anonymous information (“Non- Personal Data”). We are not aware of the identity of the individual from who we have collected the Non-Personal Data and cannot link between the data and the individual with reasonable means. Non-Personal Data which is being gathered consists of technical information, and may contain, among other things, the type of operating system and type of browser, type of device, your action in the website or Services (such as session duration) – all is considered as Non-Personal Data when collected on an aggregate basis, or otherwise not combined with any identifiers. We may further process and anonymize data in a manner that the data will be Non-Personal Data.
The second type of information is individually identifiable information, namely information that identifies an individual or may with reasonable effort identify an individual (“Personal Data”).
For the avoidance of doubt, any Non-Personal Data connected or linked to Personal Data shall be deemed as Personal Data as long as such connection or linkage exists. We may collect different categories of Personal Data, depending on the nature of your interaction with us, our Website and Services. Below we detail the Personal Data we collect and how and for which purposes we process and use your Personal Data, as well as our lawful basis for processing (subject to the GDPR, if applicable).
Online Identifiers, such as IP address, are further used to generate certain information, for example, extract your approximate location (e.g., country and Zip).
Further, when you access the Website or interact with it, we may further collect information related to your interactions, including session durations time and date stamp, the content viewed on the Website, user- interface click, crash data, language preferences, etc. We may further use tools on the Website which provides us with information and insights regarding your Website interactions such as business intelligence tools that may identify your business organization’s IP referring URL (that is, the webpage or advertising campaign directing you to the Website, and other similar business’ websites you visited in the session (“Website Engagement Data”). If the Website Engagement Data is associated with an Online Identifier it is processed by us as Personal Data.
Online Identifiers collected through cookies that are essential for the basic and proper operation of the Website, including for strict security purposes, will be processed based on our legitimate interest.
You may withdraw consent at any time by using the cookie preference tool, or by managing opt-out through your browser or device. See Section 4 of this Privacy Policy “Cookies and Tracking Technologies” for additional information.
If you contact us with inquiries through an online form available on the website (such as the contact us and support pages), by email, by chat, any online form, or by any other means, or if you sign up to receive marketing communications, book a demo, or register for a webinar, you will be asked to provide your contact information. This may include your name, telephone number, email address or business email address, organization, and position, depending on your interaction with us (“Contact Information”).
Additionally, we may collect your Contact Information from third-party aggregators that provide contact and business information and intelligence for marketing and sales promotions, as well as similar sources.
Furthermore, when we communicate with you via email, phone, or other means, we will process and store these communications, including email correspondence and, where applicable, call and meeting recordings (with your consent, as required by applicable laws). We may also process data related to these communications, such as interactions with email communications (e.g., access time and date) (“Communications Data”).
Processing Contact Information and Communications Data for our unsolicited marketing campaigns, including Direct Marketing, is based on our legitimate interests.
Processing Contact Information and Communications Data to improve our marketing efforts and for internal records keeping, is based on our legitimate interests.
You have the right to withdraw your consent at any time. You may further opt-out from our marketing communications by using the “unsubscribe” or other option we provide within the body of the message.
As part of the Services, Frontegg offers an AI-powered chat within the Website (“Chat AI”) which generates automated responses to Prospects’ inquiries. The responses generated by the Chat AI are not under Frontegg’s control and Frontegg is not responsible for any content generated by the Chat AI (“Output”) or uploaded to the Chat AI (“Prompts”). The Outputs are provided based on the Prompts and are meant to be used solely for convenience, operations, and informational purposes only and do not constitute advice or recommendations.
In order to use our Services, our Customers will need to initially create an account for their admin (“Admin”) by providing such Admin information to us (through registration or otherwise directly to us to create the account).
For such purpose, Customer will provide with the Admin’s information such as name, company name, email address, login credentials. Additional account data the Customer may provide at its discretion include phone number, job title, profile picture, and other similar contact information (“Admin Account Data”).
Processing Admin Account Data for Direct Marketing purposes is based on our legitimate interest. You can opt-out at any time using the “unsubscribe” option within the body of the message.
Please note that if you choose to unsubscribe from our Direct Marketing, we will still retain your contact details and send you service-related emails, such as invoices.
When our Customer or any of its representatives contacts us for customer support, we will collect and retain records of the representative’s contact information, which may include their name, email address, phone number, organization name, and position. We will also keep records of our communications, which may include email correspondence, chat interactions, and call recordings (with consent obtained where required by applicable laws).
Call recordings will be processed based on your consent. You have the right to withdraw consent at any time.
When you use our Services, information regarding such use is automatically generated and collected, which may include the click stream within the Services, the use of the Services (i.e., accessed or used by Customer) and the time spent on those pages or features, crash data and analytics, login data, etc. These session recordings record how you interact with the Services. We log crashes, interaction with the Services, how often you use the Services, how long you are on the Services, etc. (Collectively “Usage Data”)
Please note that the actual processing operation per each purpose of use and lawful basis detailed in the table above may differ. Such processing operation usually includes a set of operations made by automated means, such as collection, storage, use, disclosure by transmission, erasure, or destruction. The transfer of Personal Data to third-party countries, as further detailed in Section 11 of this Privacy Policy “International Data Transfers (EU and UK Data Subjects)”, is based on the same lawful basis as stipulated in the table above.
In addition, we may use certain Personal Data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity thefts, and any other misuse of our Services, and to enforce our terms of use and other policies, as well as to protect the security or integrity of our databases all systems, and to take precautions against legal liability. Such processing is based on our legitimate interests.
Depending on the nature of your interaction with Frontegg, we may collect Personal Data as follows:
We use “cookies” (or similar tracking technologies such as tags and pixels) when you interact with the Website. The use of cookies is a standard industry-wide practice. Cookies and similar technologies are a small piece of information, text or code that a website assigns and stores on your computer or browser while you access a website. Cookies can be used for various purposes, including allowing you to navigate between pages efficiently, for statistical purposes, for operation and security purposes, as well as for advertising purposes.
The information generally collected and stored by cookies includes Online Identifiers, Usage Data, and Usage Data (as defined under Section 3 of this Privacy Policy “Personal Data Processed and the Purpose of Processing”).
Such cookies and tracking technologies can be either placed by us (known as “first party cookies”), or by third parties such as our marketing partners, social media, analytic providers, etc. (known as “third party cookies”). In addition, the duration of such cookies and tracking technologies – meaning the period until such are deleted – can be either when you close your browser (known as “session cookies”) or longer periods according to their purpose and settings (known as “persistent cookies”).
Where we use third-party advertising cookies, such third-party may independently collect, through the use of such tracking technologies, some or all types of Personal Data detailed above, as well as additional data sets, including to combine such information with other information they have independently collected relating to your online activities across their network of websites, for the purpose of enhanced targeting functionality and delivering personalized ads, as well as providing aggregated analytics related to the performance of our advertising campaign you interacted with. These third parties collect and use this information under their own privacy policies and are responsible for their practices.
You can find more information about cookies here: www.allaboutcookies.org. List of cookies can be accessed through the cookie management platform embedded in the Website. You may change your cookies preference at any time, including, as applicable, withdraw consent or opt-out for the processing of Personal Data through cookies for certain purposes, by using our cookie setting tool available in our Website. Note that, certain cookies used for strict operation and security purposes are considered as “strictly necessary” and cannot be disabled.
In addition, most browsers will allow you to erase cookies from your computer’s hard drive, block acceptance of cookies, or receive a warning before a cookie is stored. You may set your browser to block all cookies, including cookies associated with our website, or to indicate when a cookie is being used by us, by adjusting the privacy and security settings of your web browser. Please refer to the support page of your browser to learn more about how you can adjust your privacy and security settings. Please note that once you choose to opt out or disable cookies, some features of our website may not operate properly, and your online experience may be limited.
We may disclose your Personal Data to third parties, including our affiliated companies (if we will have in the future), partners or service providers that help us manage our business operations or provide our Services. Below we provide information about the categories of such third-party recipients:
For avoidance of doubt, Frontegg may transfer and disclose or otherwise use Non-Personal Data or information which is linked to anonymous random identifiers or information that is aggregated in a non-identifiable way, at its own discretion.
We acknowledge that different people have different privacy concerns and preferences. Our goal is to be clear about what information we collect so that you can make meaningful choices about how it is used. We allow you to exercise certain choices, rights, and controls in connection with your Personal Data. Depending on your relationship with us, your jurisdiction and the applicable data protection laws that apply to your Personal Data, you have the right to control and request certain limitations or rights to be executed. The principal rights that may apply to your Personal Data (subject to your jurisdiction and additional conditions) may include:
To exercise any of your rights, you can contact our data protection officer at privacy@frontegg.com. We will respond to requests to exercise these rights without undue delay as required by applicable laws. Note that Frontegg may have to undertake a process to identify a data subject exercising their rights. Frontegg may keep details of such rights exercised for its own compliance and audit requirements. Please note that Personal Data may be either deleted or retained in an aggregated manner without being linked to any identifiers or Personal Data, depending on technical commercial capability. Such information may continue to be used by Frontegg.
In the event you are a Customer – note that termination of the engagement or closing your account does not automatically resolve in deletion of data. If you wish to delete the data, please ensure to contact us with such request. For California residents – additional information regarding your rights is provided under our CCPA Privacy Notice.
For US residents – additional information regarding certain rights is provided under Section 13 of this Privacy Policy “Jurisdiction Specific Notices”.
We retain Personal Data we collect as long as it remains necessary for the purposes set forth above, all in accordance with applicable laws, or until an individual expresses a preference to opt-out or delete its Personal Data.
Other circumstances in which we will retain your Personal Data for longer periods of time include:
Please note that except as required by applicable law, we may at our sole discretion, delete or amend information from our systems, without notice to you, once we deem it is no longer necessary for such purposes.
We design our systems with your security and privacy in mind. Frontegg implements, enforces and maintains security measures, technologies and policies to prevent the unauthorized or accidental access to or destruction, loss, modification, use or disclosure of Personal Data. We likewise take steps to monitor compliance of such policies on an ongoing basis. Where we deem it necessary in light of the nature of the data in question and the risks to data subjects, we encrypt data in transit and at rest.
We use industry standard SSL (secure socket layer technology) encryption to transfer Personal Data. Likewise, we take industry standard steps to ensure the Website and Services are safe and to prevent unauthorized access to our data bases. Other security safeguards include, but are not limited to, firewalls, anti-virus, access logs, breach detection systems and physical access controls to buildings, systems and files.
Note however, that no data security measures are perfect or impenetrable, and we cannot guarantee that unauthorized access, leaks, viruses and other data security breaches will never occur.
Within Frontegg, we endeavor to limit access to Personal Data to those of our personnel who: (i) require access in order for Frontegg to fulfill its obligations, including also under its agreements, and as described in this Privacy Policy, and (ii) have been appropriately and periodically trained with respect to the requirements applicable to the processing, care and handling of the Personal Data, and (iii) are under confidentiality obligations as may be required under applicable law. Frontegg shall act in accordance with its policies and with applicable law to promptly notify the relevant authorities and data subjects in the event that any Personal Data processed by Frontegg is lost, stolen, or where there has been any unauthorized access to it, all in accordance with applicable law and on the instructions of qualified authority.
We store your Personal Data on servers owned or controlled by Frontegg located in the united states, or processed by third parties on behalf of Frontegg, by reputable cloud-service providers (see the following section regarding international transfers).
We may store or process your Personal Data by default within the EU, unless you actively choose to store your data in the US. Customer’s Personal Data may be accessed by our headquarters in Israel (a jurisdiction deemed adequate by the EU Commission and the UK), as well as by our teams in the EU or other adequate countries for support, development and DevOps purposes. Such Customer’s Personal Data may also be accessed, upon Customer request and on a case by case basis, by our staff in the US.
Other Personal Data is transferred to, and stored and processed at, destinations located outside the European Economic Area (EEA) and UK. This includes transfer to our headquarters in Israel, and to the USA. Where your Personal Data is transferred outside of the EEA or UK, we will take all steps reasonably necessary to ensure that your Personal Data is subject to appropriate safeguards, including entering into contracts that require the recipients to adhere to data protection standards that are considered satisfactory under EU or UK law and other applicable laws, and that it is treated securely and in accordance with this Privacy Policy. Transfers from the EEA to Israel are made based on an adequacy ruling by the EU Commission. Transfers from the EEA to the USA are made based on the Standard Contractual Clauses published by the EU Commission. Transfers from the UK to the EEA and to Israel and made based on the UK’s Adequacy Regulations. Transfers from the UK to the USA are made based on the UK’s International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
Our Website and Services are not intended for use by children and we do not we do not knowingly collect or maintain information about anyone under the age of 16 without parental consent, or knowingly allow children under the age of 16 to register for the Services. If you are under 16, do not register or attempt to register for any of the Services or send any information about yourself to us. If we learn that we have collected or have been sent Personal Data from a child under the age of 16 without appropriate permissions, we will delete that Personal Data as soon as reasonably practicable without any liability to Frontegg. If you believe that we might have collected or been sent information from a minor under the age of 16, please contact us at: privacy@frontegg.com as soon as possible.
Information provided below supplements the information contained in this Privacy Policy and applies solely to residents of such states. These additional disclosures are intended to provide you with additional information with regard to our handling of your Personal Data and certain consumer rights.
This section applies to California residents only, pursuant to the CCPA. Please see the CCPA Privacy Notice which discloses the categories of Personal Information collected, purpose of processing, source, categories of recipients with whom the Personal Information is shared with for a business purpose, whether the Personal Information is sold or shared, the retention period, and how to exercise your rights as a California resident.
Residents of certain U.S. states (depending on the applicable state law, acting as an individual or in the household context only and not in a commercial or employment context, as a job applicant or as a beneficiary of someone acting in an employment context or as representative of a business), may have additional rights under applicable privacy laws and be entitled to additional disclosures.
“Personal Data” under applicable US privacy laws, generally means any information that is linked or reasonably linkable to an identified or identifiable individual (and usually does not include publicly available information that is lawfully made available from government records, or that a consumer has otherwise made available to the public; de-identified or aggregated consumer information; or information excluded from the states laws scope. “Sensitive Data” mainly includes data revealing racial or ethnic national origin, religious beliefs, information regarding an individual’s medical history, mental or physical health condition, diagnosis or medical treatment, neural data, status as transgender or non-binary, sex life, sexual orientation, status as a victim of a crime, citizenship or immigration status; genetic or biometric data; Personal Data collected from a known child; and precise geolocation data. We will obtain your consent before collecting Sensitive Data even if they are not used to identify you. We are required to provide you with a clear and accessible privacy notice that includes the categories of Personal Data processed, including any Sensitive Data, the purpose of processing, the categories of Personal Data shared with third parties, the categories of third parties with whom Personal Data is shared, the categories of Personal Data that is sold or used for targeted advertising, if any, the categories of third parties to whom the Personal Data is sold, if any, a list of your data rights and instructions for exercising those rights and appealing decisions, and our contact information. This information is detailed under this Privacy Policy and further below.
Categories of Personal Data & Categories of Third Parties with Whom Personal Data is Shared:
Under Section 3 of the Privacy Policy “Personal Data Processed and the Purpose of Processing”, we describe our collection and processing of Personal Data, the categories of Personal Data that are collected or processed, and the purposes for which Personal Data is processed, stored or used. We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated, or incompatible purposes without obtaining your consent, unless we are otherwise entitled, required or permitted under applicable laws. Additionally, under Section 6 of the Privacy Policy “Disclosure of Personal Data” we detail and disclose the categories of third parties we share Personal Data with for a business purposes
“Sale” of Personal Data:
Under US privacy laws, in principle, the term “sale” is referring to disclosing or making available Personal Data to a third-party in exchange for monetary or other valuable consideration, including for targeted advertising purposes. We do not “sell” information as this term is commonly understood, meaning – we do not, and will not, disclose your Personal Data in direct exchange for money or some other form of payment. However, subject to the definition of the term “sale” under applicable US privacy laws, our practice of using “cookies or other third-party advertising services and sharing Personal Data for such purpose to third party advertising and marketing providers (e.g., providers of marketing tools and analytic tools, advertising networks, social media networks, media buying, search platforms) is considered a “sale”.
Such practice includes the following Personal Data categories shared with these third parties:
Identifiers – online identifiers such as IP and Cookie ID;
Internet and electronic network activity information – such as your engagement with our website and ads
Geolocation data – derived from IP (country level).
Consumer Rights Related to Their Personal Data:
Residents of certain U.S. states may have additional rights under applicable privacy laws, subject to certain limitations, which may include
Access – the right to confirm whether we are processing their Personal Data and to obtain a copy of their Personal Data in a portable and, to the extent technically feasible, readily usable format.
List of Third Parties – the right to receive a list of the specific third parties to which we have disclosed either your Personal Data or any Personal Data.
Delete – the right to request us to delete their Personal Data provided to or obtained by us.
Correct – the right to request us to correct inaccuracies in their Personal Data, taking into account the nature and purposes of the processing of the Personal Data.
Opt-Out – the right to opt out of certain types of processing, including: (i) to opt out of the “sale” of their Personal Data; (ii) to opt out of targeted advertising by us; and (iii) to opt out of any processing of Personal Data for profiling in furtherance of making decisions that produce legal or similarly significant effects. However, as noted above, we do not engage in profiling in furtherance of legal or similarly significant effects.
Appeal – the right to appeal if we decline to take action in response to your exercise of a privacy right
Non-Discrimination – the right to not be discriminated against for exercising your privacy rights.
Section 7 under this Privacy Policy “Data Subject rights” provides additional information regarding your principal rights.
Exercising Consumer Privacy Rights:
To exercise any of your rights, you can contact our data protection officer at privacy@frontegg.com. We will respond to requests to exercise these rights without undue delay as required by applicable laws. Note that Frontegg may have to undertake a process to identify a data subject exercising their rights. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for denial and how to remedy any deficiencies, where applicable. Authorized agents may initiate a request on behalf of another individual, provided that such will be required to provide proof of their authorization, and we may also require that the individual directly verify his/her identity and the authority of the authorized agent.
We will respond to your request within the timeframe required under applicable law, and we reserve the right to extend the response time subject to applicable law requirements. If we refuse to take action on a request, we will notify you and our notification will include a justification for declining to take action.
Appeal Rights
Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request, by contacting us as instructed in our response. Please send your appeal request with a summary of the request and decision you want to appeal to privacy@frontegg.com.
Not more than 60 days after receipt of an appeal, and always in accordance with the timelines set by the applicable US Privacy Laws, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reason for the decision.
If you are not happy with our response, depending on your jurisdiction, you may have the right to lodge a complaint against us with the relevant State’s Attorney General:
We may include third-party links on our website, and allow registration and login to our Platform through third party accounts. Please note that this Privacy Policy only applies to the Personal Data that we (or third parties on our behalf) collect from or about you and we cannot be responsible for personal information collected and stored by third parties. Third parties have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to them. We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.
We reserve the right to amend or update this Privacy Policy from time to time, at our sole discretion. The most current version of this Privacy Policy will always be posted on the Website and the update date will be reflected in the “Last Updated” heading. We will provide notice to you if these changes are material, and, where required by applicable law, we will obtain your consent. Any amendments to the Privacy Policy will become effective immediately, unless we notify otherwise. We recommend you review this Privacy Policy periodically to ensure that you understand our most updated privacy practices.
