Privacy Policy

Last updated: November 3, 2026

What Frabo OS collects, why, who receives it, how long it is kept, and how to see, export, or delete it. In short: your business data is yours, we never sell it, and Adam uses it only to work for you.

This document is the baseline English-language version and applies worldwide. Where mandatory local law requires different or additional terms, a jurisdiction-specific addendum may apply and shall be presented where relevant. If a translation conflicts with this English version, the English version controls to the extent permitted by law. The summary above is provided for convenience only and does not form part of this document. Nothing in this document constitutes legal advice.

Section 1 — Introduction, Scope, and Identity of the Controller

1.1 Identity. This Privacy Policy (this "Policy") is issued by Frabo OS, a subsidiary of USRA, LLC, a limited liability company organized under the laws of the State of Washington ("Frabo", "we", "us", or "our"). Frabo provides business software built around Adam, an AI assistant that operates from the records in a customer's own account.

1.2 Scope. This Policy applies to Personal Data processed in connection with frabo.ai, the Frabo web application, the Frabo mobile applications, the Frabo API, and Adam Local (collectively, the "Service"). It applies to account holders, their Authorized Users, visitors to our websites, and developers who build on the Frabo API.

1.3 Contact. Frabo may be contacted on any matter concerning this Policy at [email protected]. Written notices may also be sent to USRA, LLC, 1018 Market St, Suite 261030, Kirkland, WA 98033, USA.

1.4 Where the Service Is Offered. The Service is not offered to persons in the European Economic Area, the United Kingdom, or Switzerland. Frabo does not market the Service there and does not open new Accounts from those countries, and accordingly has not appointed a representative under Article 27 of the GDPR or of the UK GDPR. Frabo has not appointed a data protection officer; privacy matters are handled through [email protected].

1.5 Relationship to the Terms. This Policy is incorporated by reference into the Frabo Terms of Service (the "Terms"). Capitalised terms used but not defined in this Policy have the meanings given in the Terms.

Section 2 — Principal Commitments

Without limiting the remainder of this Policy, Frabo commits as follows:

(a) Frabo does not sell Personal Data or business data, and does not disclose it to any third party for that third party's own advertising.
(b) Frabo uses Customer Data solely to provide, secure, and support the Service. Frabo does not build profiles for sale and does not use Customer Data to train third-party AI models.
(c) Adam does not take any action that moves money, sends a message, or cannot be undone without the account holder's approval.
(d) Account holders may export their data, or request deletion of their account, from Settings at any time. Deletion is carried out seven (7) days after the request, during which period the request may be withdrawn, subject to the exceptions in Section 13.
(e) Where the law applicable to you grants rights greater than those described in this Policy, you shall have the benefit of those rights.

Section 3 — Definitions

In this Policy:

"Personal Data" (including "personal information" under US state privacy laws) means any information relating to an identified or identifiable natural person.
"Customer" means the person or entity that holds a Frabo account; "Customer Data" means data that a Customer or its Authorized Users submit to, or connect with, the Service.
"Controller", "Processor", "Data Subject", and "Processing" have the meanings given in Regulation (EU) 2016/679 (the "GDPR") and, as applicable, the GDPR as retained in UK law (the "UK GDPR").
"CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
"DPA" means the Frabo Data Processing Agreement published at frabo.ai/legal/dpa.

Section 4 — Roles of the Parties: Controller and Processor

4.1 Frabo as Controller. Frabo acts as a Controller with respect to Personal Data concerning account holders and Authorized Users (such as name, email address, sign-in records, and billing information), website visitors, and developers, and determines the purposes and means of that Processing as described in this Policy.

4.2 Frabo as Processor. With respect to Personal Data that a Customer submits to the Service concerning other individuals — including the Customer's customers, contacts, employees, and contractors — the Customer is the Controller and Frabo processes such data as a Processor (and, under the CCPA, as a "service provider") on the Customer's behalf and in accordance with the Customer's documented instructions and the DPA.

4.2A Frabo Shop Buyers. When a person buys from a Frabo Shop, Frabo is the seller and acts as Controller of the buyer's name, email address, shipping address and order details. Frabo uses them to take payment through Stripe, calculate sales tax, have the order made and delivered by Frabo's supplier, handle refunds and disputes, and keep the records the law requires. Frabo shares the shipping address with the supplier that makes and delivers the order and with the carrier, and does not share the buyer's contact details with the store owner. Card details are collected by Stripe and never received by Frabo; Frabo receives only Stripe's fingerprint of the card, which identifies a card without revealing it, and uses it to recognise a store owner buying from their own store and a buyer with repeated returns.

4.2B Returns, Product Alerts and Offers. A buyer who returns an item gives the reason they choose and confirms the return with a code sent to their email; Frabo keeps the return record with the order. A visitor who asks to hear when a product is back or cheaper gives an email address, which is used for that alert only, after they confirm it from that inbox. A buyer who asks for Frabo's updates from their order page is sent a confirmation to the email they paid with, joins Frabo's email list only once they confirm it, and can unsubscribe from any email. When a buyer disputes a payment, Frabo sends Stripe the order's records needed to answer it: what was bought, the email used at checkout, the carrier, tracking number and delivery date.

4.3 Requests Concerning Customer Data. If you are an individual whose information is held by a Frabo Customer and you wish to exercise your rights, please direct your request to that business. Frabo shall assist the Customer in responding as required by the DPA.

Section 5 — Categories of Personal Data Collected

Frabo collects only the Personal Data required for the features that are used. Depending on the features enabled, Frabo processes the following categories:

(a) Account Data: name, email address, sign-in history (time, browser, and approximate country), subscription plan, and a record of which terms and policies were accepted and when.
(b) Team Data: the identity of invited Authorized Users, their roles, and single sign-on configuration where an organisation uses it.
(c) Business and Financial Records: receipts, invoices, bills, bank statements uploaded or forwarded, transactions, categories, savings identified by Adam, and the reports and worksheets derived from them.
(d) Workforce Data (payroll and contractor features): names, pay type and rate, hours, pay dates, deductions entered, payment notes, and whether a contractor's Form W-9 is on file. Frabo does not request or store Social Security numbers or bank account numbers for a Customer's staff.
(e) Customer and Contact Data (CRM, invoicing, and email marketing): names, email addresses, telephone numbers, companies, notes, follow-ups, and campaign delivery and unsubscribe records.
(f) Payment Data (where a Customer connects Stripe): the Stripe account identifier and status and, for each payment, refund, dispute, and payout, the amount, currency, dates, and status reported by Stripe. Stripe collects and verifies identity and bank details itself; Frabo does not receive identity documents or full bank account numbers. For a Customer's own Frabo subscription, card details are transmitted directly to Stripe and are not received by Frabo's servers.
(g) Connected Account Data: where a Customer connects email, Google Search Console, a social account, or another service, the access authorised by the Customer (stored encrypted) and the data that connection provides — for example renewal notices Adam monitors, or comments on the Customer's own posts.
(h) Voice Data: when a user speaks to Adam in the app or records a team voice note, the audio is converted to text on infrastructure operated by Frabo and then discarded; Frabo keeps the transcript, not the audio. If a user chooses their browser's built-in speech recognition, the browser's provider processes that audio under its own terms. On a business phone line answered by Adam, Twilio, Inc. converts the caller's speech to text during the call, and a message left on a message line is recorded by Twilio, retrieved by Frabo to be transcribed, and then deleted from Twilio at Frabo's request. Transcripts are handled in the same manner as any other message to Adam.
(i) Mobile Application Data: receipt photographs taken by the user, a push-notification token, and device type. Biometric unlock, where enabled, occurs on the user's device; Frabo never receives fingerprint or facial data.
(j) Adam Local Data (optional): the computer's name, software version, health metrics (GPU, memory, installed models), basic security posture (whether disk encryption and the firewall are enabled), and summary counts from its local log. Documents, memory, and responses processed by Adam Local remain on the user's computer unless the user elects to transmit them to Frabo.
(k) Developer Data: application registrations, the permissions granted by account holders, and webhook delivery logs.
(l) Support Data: correspondence submitted to Frabo and Frabo's replies.
(m) Technical Data: IP address, browser and device type, error reports, and security signals necessary to operate and secure the Service. Public marketing pages may use analytics as described in the Cookie Policy.
(n) Storefront Event Data (Frabo Pixel): where a Customer installs the Frabo Pixel on its website, the page path, the event (page view, product view, add to cart, or purchase), an optional product identifier, and an optional order value and currency. Frabo processes these events on behalf of the Customer that installed the Pixel. The Frabo Pixel does not collect IP addresses, cookies, or customer identities, and Frabo's event records do not hold them.
(o) Frabo Shop Order Data: when someone buys from a Frabo Shop store, Stripe collects their payment details, email address, and shipping address at checkout. Frabo receives the order, the buyer's name and shipping address, and payment status, and passes the name, shipping address, and items ordered to the print provider that makes and ships the order.

Section 6 — Sources of Personal Data

Frabo obtains Personal Data (a) directly from you when you create an account, use the Service, or contact us; (b) from the Customer that holds an account, where you are its customer, contact, employee, contractor, or end user; (c) from services that a Customer elects to connect, including Stripe, email providers, Google, Microsoft, and social platforms, within the scope of access the Customer authorises; (d) from applications authorised through the Frabo API; and (e) automatically from your device and browser when you use the Service or visit our websites.

Section 7 — Purposes of Processing

Frabo processes Personal Data for the following purposes and no others:

(a) Provision of the Service: to operate the features a Customer uses, including maintaining financial records, forecasting cash, preparing invoices, pay runs, tax worksheets, and financing summaries, monitoring renewals, and answering questions through Adam.
(b) Security and Integrity: to verify sign-ins, alert users to new devices, require re-authentication before sensitive actions, prevent fraud and abuse, and maintain a tamper-evident audit log of account actions.
(c) Billing and Legal Compliance: to bill for subscription plans and to maintain records required by law.
(d) Service Communications: to send email required for the Service — sign-in codes, receipts, alerts, and requested reports — and, where the recipient has opted in, product news. Every marketing email contains an unsubscribe mechanism.
(e) Reliability and Improvement: to improve reliability and resolve problems, using aggregated or de-identified usage data wherever practicable.
(f) Aggregate Proof Statistics: to publish anonymous aggregate totals of savings achieved by businesses using Frabo (the "Proof" page). Such totals are combined across businesses, are never displayed for a group of fewer than twenty (20) businesses, are never broken out by business, and never include names. A case study concerning a specific business is published only if that business approves its text and enables it, and may be withdrawn by that business at any time.

Section 8 — Adam and Artificial Intelligence Processing

8.1 Infrastructure. Adam answers from the records in the Customer's account. The AI models underlying Adam and Magic Briefs run on infrastructure operated by Frabo, on Cloudflare Workers AI, or on the user's own computer through Adam Local. Speech-to-text for in-app voice and team voice notes runs on infrastructure operated by Frabo. Speech on a phone call to a business line answered by Adam is converted to text by Twilio, Inc. Frabo shall list any additional AI provider in this Policy before any Personal Data is transmitted to it.

8.2 Safeguards. Before text is transmitted to a cloud-hosted model, Frabo removes account credentials and personal identifiers where practicable, and screens documents and emails for embedded instructions intended to manipulate Adam. Frabo does not use Customer Data to train third-party models.

8.3 Grounding. Adam is designed not to state a figure that it cannot trace to the Customer's records, and to disclose uncertainty where it exists.

8.5 Google User Data. Frabo's use and transfer of information received from Google APIs, including Gmail, Google Drive, and Google Search Console, adheres to the Google API Services User Data Policy, including its Limited Use requirements. Frabo uses that information only to provide the features the user has enabled; does not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition; does not use it for advertising; does not sell it; does not use it to train AI models; and does not allow people to read it unless the user agrees, it is needed for security or to comply with law, or it has been aggregated and made anonymous for internal operations.

8.4 Transparency. Adam is an AI system, and the Service says so wherever a person interacts with it. Images that Adam generates carry machine-readable metadata (IPTC Digital Source Type) identifying them as AI-generated, as required by Article 50 of Regulation (EU) 2024/1689 (the AI Act). Customer remains responsible for disclosing AI-generated or AI-altered content it chooses to publish where the law requires it.

Section 9 — Legal Bases for Processing (EEA, UK, and Comparable Jurisdictions)

Where the GDPR, the UK GDPR, or a comparable law applies, Frabo relies on the following legal bases:

(a) Performance of a contract (Article 6(1)(b)): operating the Service under the Terms, including Account Data, Business and Financial Records, and Service Communications.
(b) Legitimate interests (Article 6(1)(f)): securing the Service, preventing fraud and abuse, and improving reliability, in each case balanced against your rights and freedoms. You may object to Processing on this basis as described in Section 14.
(c) Legal obligation (Article 6(1)(c)): maintaining tax, accounting, and other records required by law.
(d) Consent (Article 6(1)(a)): marketing email, analytics cookies where consent is required, and publication of a case study. Consent may be withdrawn at any time without affecting the lawfulness of Processing before withdrawal.
(e) Necessity of provision: the provision of Account Data is a contractual requirement for opening an account; without it Frabo cannot provide the Service. Provision of other Personal Data is optional and depends on the features you elect to use.

Section 11 — No Sale, No Sharing for Targeted Advertising

(a) Frabo does not sell Personal Data, and does not "share" Personal Data for cross-context behavioural advertising, as those terms are defined in the CCPA. Frabo has not done so in the preceding twelve (12) months and has no actual knowledge of selling or sharing the Personal Data of consumers under sixteen (16) years of age.
(b) Frabo does not access Customer Data for its own purposes beyond operating, securing, and supporting the Service. Staff access is restricted on a least-privilege basis to personnel who require it to assist the Customer or to secure the Service, and all such access is logged.
(c) Frabo does not publish any information about a Customer's business without that Customer's approval.

Section 12 — International Transfers

12.1 The Service operates on Cloudflare's global network. Accordingly, Personal Data may be processed in countries other than the country in which you reside, including the United States, which may not provide an equivalent level of data protection.

12.2 Where Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not been recognised as providing an adequate level of protection, Frabo relies on the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, the UK International Data Transfer Addendum, and the corresponding Swiss adaptations, as set out in Article 12 of the DPA. A copy of the relevant safeguards may be requested at the address in Section 22.

12.3 Adam Local performs processing on the user's own computer, wherever located.

Section 13 — Retention Schedule

Frabo retains Personal Data only for as long as necessary for the purposes for which it was collected, as follows:

(a) Account Data, Customer Data, and Team Data: for the duration of the account, so that the Service functions.
(b) Upon a request for account deletion: after a seven (7) day grace period in which the request may be withdrawn, a daily job deletes records and uploaded files from live systems, and Frabo shall complete deletion within thirty (30) days of the request. Database recovery points kept by Frabo's hosting provider expire on that provider's schedule, currently within thirty (30) days.
(b-1) Records retained after deletion without the account holder's name or account identifier attached: (i) payment and payout records, and orders or offers to which another person was a party, which Frabo must retain for accounting, tax, and dispute purposes; and (ii) records within a shared team or organisation workspace, which remain with that workspace.
(b-2) The tamper-evident record of actions taken within the account (what was done and when) is retained after deletion for security, fraud-prevention, and legal-claims purposes. On deletion, the account identifier, session identifiers, IP address hashes, and browser details are removed from it; its integrity hashes are kept unchanged and each changed entry is noted, so that the record remains verifiable.
(c) Billing and tax records: for the period required by applicable tax and accounting law.
(d) Security, fraud-prevention, and dispute records: for so long as the specific security, fraud-prevention, or dispute purpose subsists, and no longer.
(e) Connected-account access tokens: deleted immediately upon disconnection of the relevant connected account.
(f) Voice audio: not stored by Frabo. A message left on a phone line is held by Twilio until Frabo has transcribed it and requested its deletion.
(g) Marketing preferences and unsubscribe records: for so long as necessary to honour your choice.
(h) Frabo Pixel events: deleted ninety (90) days after they are recorded.
(i) Images, video, and other content Adam generates for a user: deleted once downloaded, or seven (7) days after it is created if it is never downloaded.
(j) Founding Operator prize draw entries: as set out in Section 13A.
(k) Product alerts: an alert not confirmed is deleted three (3) days after it was asked for; a sent alert is deleted thirty (30) days after it was sent; an alert that never fires is deleted ninety (90) days after it was confirmed; an address whose owner stopped alerts is kept, as a stop record only, for one (1) year so that no further alert is sent to it.
(l) Frabo Shop returns: kept with the order they belong to, under (c).

Section 13A — Founding Operator Prize Draw Entries

13A.1 Data collected. When you enter the Founding Operator prize draw at frabo.ai/founding-operators, Frabo collects your name, business name, website or store address, what the business sells, the operational problem you describe, the country or region where you live, your email address, your LinkedIn profile if you give one, the version of the official rules you accepted and when, and whether and when you confirmed your entry.

13A.2 Purpose and legal basis. Frabo uses these details only to run the draw under its official rules (https://frabo.ai/founding-operators/rules): to confirm the entry, check eligibility, run and record the draw, contact potential winners, apply prizes and, with a winner's separate permission given after the draw, publish the winner's name and business name. The legal basis is the performance of the contract formed by the official rules. Entry details are not used for marketing and are not sold.

13A.3 Retention. Entries that do not win are deleted 90 days after the draw. The draw record keeps only the names and business names of the winners and reserve entries. When a winner opens a Frabo account, the details needed to run it become Account Data under Section 13(a).

13A.4 Contact. Questions and requests about an entry may be sent to [email protected] or to the address in Section 22.

Section 14 — Your Rights

14.1 Subject to applicable law, you may have the right to: (a) be informed of and access the Personal Data Frabo holds about you; (b) receive a copy in a portable format; (c) rectify inaccurate data; (d) erase data; (e) restrict Processing; (f) object to Processing based on legitimate interests or for direct marketing; (g) withdraw consent; and (h) under US state privacy laws, know, access, correct, delete, and opt out of the sale or sharing of Personal Data, targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects.

14.2 Most of these rights may be exercised directly in Settings → Your data.

14.3 Non-Discrimination. Frabo shall not discriminate against you for exercising any of these rights.

14.4 Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the jurisdiction of your habitual residence, place of work, or place of the alleged infringement.

Section 15 — Submitting Requests, Verification, Authorised Agents, and Appeals

15.1 Submission. Requests not available in Settings may be sent to [email protected] from the email address associated with your account.

15.2 Verification. Frabo shall verify your identity before acting on a request, using information already associated with your account.

15.3 Timing. Frabo shall respond within thirty (30) days of receipt, or within any shorter period required by the law applicable to you.

15.4 Authorised Agents. You may designate an authorised agent to submit a request on your behalf. Frabo may require proof of the agent's authority and may require you to verify your identity directly.

15.5 Appeals. If Frabo declines to act on your request in whole or in part, you may appeal by replying to Frabo's decision and requesting reconsideration. Frabo shall inform you in writing of the outcome of the appeal and its reasons within the period required by applicable law. If you remain dissatisfied, you may contact your state Attorney General or local data protection authority.

Section 16 — California Notice at Collection

16.1 This Section constitutes Frabo's notice at collection under the CCPA with respect to Personal Data for which Frabo is a "business". In the preceding twelve (12) months Frabo has collected the following categories of Personal Information, from the sources described in Section 6, for the purposes described in Section 7, and has disclosed each category for a business purpose only to the recipients described in Section 10. Each category is retained in accordance with Section 13.

(a) Identifiers — name, email address, IP address, account identifiers, and push-notification tokens. Disclosed to: hosting and infrastructure providers, payment processor, and push-notification provider.
(b) Customer records described in Cal. Civ. Code § 1798.80(e) — name, contact details, and billing information. Disclosed to: hosting and infrastructure providers, payment processor, and, for Frabo Shop orders, the print provider and its delivery carriers.
(c) Commercial information — subscription plan, purchase and billing history, and transaction records. Disclosed to: hosting and infrastructure providers and payment processor.
(d) Internet or other electronic network activity — sign-in history, browser and device type, error reports, and security signals. Disclosed to: hosting and infrastructure providers.
(e) Geolocation data — approximate country derived from IP address only. Frabo does not collect precise geolocation. Disclosed to: hosting and infrastructure providers.
(f) Audio or electronic information — voice input in the app and team voice notes, which is converted to text and not stored; and calls to a business phone line answered by Adam, converted to text by Twilio, with any message left held by Twilio until transcribed. Disclosed to: hosting and AI infrastructure providers, transiently, and Twilio for phone calls.
(g) Professional or employment-related information — team roles and business details of account holders. Disclosed to: hosting and infrastructure providers.
(h) Sensitive personal information — access credentials for services a user elects to connect, and the contents of email in a connected mailbox where the user enables that feature. Frabo uses and discloses sensitive personal information only for the purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), and not to infer characteristics about any consumer.
(i) Inferences — Frabo does not draw inferences from Personal Information to create a profile about a consumer's preferences or characteristics.

Section 17 — Other United States Privacy Laws

Residents of states with comprehensive consumer privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others) may exercise the rights described in Section 14 and the appeal process described in Section 15.5. Because Frabo does not sell Personal Data, engage in targeted advertising, or conduct profiling in furtherance of decisions producing legal or similarly significant effects, no opt-out of those activities is required. California residents may also request information under Cal. Civ. Code § 1798.83; Frabo does not disclose Personal Information to third parties for their direct marketing purposes.

Section 18 — Automated Decision-Making

Frabo does not make decisions based solely on automated Processing that produce legal effects or similarly significant effects concerning you within the meaning of Article 22 of the GDPR. Adam prepares work for human review; the account holder decides whether to approve it. The financing readiness feature is an informational calculation and is not a credit decision.

Section 19 — Security

19.1 Frabo implements technical and organisational measures designed to protect Personal Data, including encryption in transit and encryption at rest for credentials and tokens, server-side role checks on every request, re-authentication before sensitive actions, alerts for sign-ins from new devices, and a tamper-evident audit log of account actions. These measures are described further in the Compliance Statement and in Annex II of the DPA.

19.2 No method of transmission or storage is completely secure, and Frabo cannot guarantee absolute security. Users should maintain a secure email account, enable single sign-on where their organisation offers it, and notify Frabo without delay at [email protected] upon suspecting unauthorised access to an account.

19.3 In the event of a personal data breach affecting your Personal Data, Frabo shall notify you and the competent authorities as required by applicable law.

Section 20 — Children

The Service is intended for adults operating a business. Account holders must be at least eighteen (18) years of age (see the Age and Eligibility Statement). Frabo does not knowingly collect Personal Data from any person under sixteen (16) years of age. If you believe that a child has provided Personal Data to Frabo, please contact [email protected] and Frabo shall delete it.

Section 21 — Changes to this Policy

Frabo may amend this Policy from time to time and shall update the "Last updated" date above upon doing so. Where an amendment is material — for example, the collection of a new category of Personal Data or the engagement of a new AI provider — Frabo shall notify affected users by email or within the Service before the amendment takes effect.

Section 22 — Contact

Privacy questions, requests, and complaints may be directed to [email protected]. Written notices: USRA, LLC, 1018 Market St, Suite 261030, Kirkland, WA 98033, USA.

Email from Frabo OS is sent from @frabo.ai addresses (such as [email protected] for sign-in and account email, [email protected] for notifications and reports, and [email protected] for marketing). Our monitored support and legal inbox is [email protected].

Frabo OS is a subsidiary of USRA, LLC.