Privacy Policy
What Frame collects, why, how long it’s kept, and how to control it.
In short
- We collect the minimum each feature needs, only when you turn it on.
- We never sell or rent your data, and we don’t run ads.
- You choose how long scan results and conversations are kept.
- You can export or delete everything at any time.
On this page
01Who we are
Frame is operated by Frame Technologies (placeholder legal entity), a 100% Canadian-owned company based in British Columbia. Our privacy officer can be reached at privacy@frameprivacy.com.
02What we collect
Account data: your email, a password hash or passkey public key, and your plan.
Identifiers you verify: emails, phone numbers, usernames and connected accounts you prove you own. We never scan identifiers you haven’t verified.
Scan results: breach matches, data-broker listings, leak-test results and exposure findings tied to your verified identifiers.
Agent conversations: messages you send Frame and the tool results it produces, kept according to your retention setting.
Billing: handled by our payment processor. We store the last four digits and expiry only.
03How we use it
To run the features you ask for, keep your account secure, send the alerts you opted into and meet legal obligations. We do not use your personal information to train third-party AI models.
04Frame (the agent) and AI processing
When you use Frame, your messages and relevant findings are processed by Anthropic’s Claude models through Amazon Web Services (AWS Bedrock). Requests are sent from AWS’s Canada (Central) region but are processed in the United States, because no Canada-only option exists for these models yet. AWS doesn’t store your prompts or Frame’s answers, and neither AWS nor Anthropic uses them to train models. Tool calls run on our infrastructure. You can turn off agent memory in Settings.
06How long we keep it
You decide. In Settings → Privacy and data you can keep scan results, agent conversations and reports for 30 days, 90 days, 12 months or until you delete them. Deleted data is purged from backups within 35 days.
07Your rights
Depending on where you live (Quebec Law 25, PIPEDA, GDPR, CCPA/CPRA and others) you can access, correct, export, restrict or delete your information and withdraw consent. Use Settings → Privacy and data or email privacy@frameprivacy.com. We respond within 30 days.
08Where data is stored
Primary storage is in Canada (region to be confirmed). Where a provider processes data outside Canada, we use contractual safeguards and assess the transfer as required by Quebec Law 25.
09Children
Frame is for adults 18 and over. Household plans can include members aged 16 or 17 only with a parent or guardian’s consent.
10Changes
We’ll tell you about material changes by email and in the app at least 30 days before they take effect. Previous versions are kept in our changelog.