Privacy Policy

Last updated: September 16, 2026

1. Scope and contact details

This Privacy Policy explains personal-data processing in connection with the Frontierz website, business inquiries, demonstrations, Frontierz Studio, AI Fellows and Learning Paths. It applies to visitors, prospective customers and partners, administrators, learners and public-session participants.

Founderz AI, S.L., trading as Frontierz, has its registered office at Carrer Pau Vila 13-15, 2-4, 08174 Sant Cugat del Vallès, Barcelona, Spain; tax identification number B06944375; EU VAT number ESB06944375. For privacy inquiries and the exercise of rights, contact rgpd@founderz.com or write to the registered office for the attention of the person responsible for data protection. Business inquiries may be sent to hello@frontierz.com.

2. Who determines how your data is used

Frontierz acts as controller for its website, sales and partner inquiries, demonstrations operated directly by Frontierz, its own billing, business administration and legal obligations. A controller determines the purposes and means of processing.

For a customer workspace, the customer is the controller and Frontierz is its processor. This generally means your employer or the organization providing your program decides why you participate, who can access your records and how long they are retained. Frontierz processes those records on documented instructions under a data processing agreement. Where our customer itself acts for another controller, that controller's instructions govern.

Your organization must identify the responsible controller and provide its own privacy information, including its legal basis, assessment purposes, recipients and retention rules. The platform information below supplements that notice. A customer agreement does not remove your statutory rights or authorize unrelated use of your data by Frontierz.

3. Website, inquiries and Frontierz-operated demonstrations

Required form fields are identified. Without the information needed to handle a request or provide a selected service, we cannot complete that activity. Optional fields may be left blank. The privacy checkbox records acknowledgment of this information; it is not marketing consent. An organization's purchase does not authorize promotional email to every employee.

Our forms use Basin to receive, store, screen for spam and forward inquiries. Submit only information relevant to the inquiry; do not submit confidential learning records or other people's sensitive information through a website inquiry or public demonstration.

4. Data processed in customer workspaces

Depending on the features your organization enables, Frontierz processes the following on its behalf. The organization determines the applicable legal basis; use of the platform or acceptance of this notice does not substitute for that assessment.

We obtain data directly from you, from your organization and its authorized administrators, from its identity provider, directory or LMS, and from systems it connects. Technical records arise automatically when the service is used. Public sessions do not require an account, but their content or an identifier supplied by an embed can still identify you.

Special-category personal data, criminal-offense data and real financial-account data are outside the standard learning service. Use fictional or anonymized examples where real personal data are unnecessary. A separately agreed deployment involving those categories requires an appropriate legal basis and safeguards.

5. AI, live media and human review

AI Fellows are automated systems. Prompts, relevant conversation context, retrieved knowledge and inputs are processed by the configured AI service to generate responses and assessments. A pseudonymous user identifier may be supplied for provider abuse prevention. We do not use customer workspace data or AI Fellow interactions to train, fine-tune or improve AI models. Models are used for inference; document retrieval and permitted personalization do not involve model training.

Microphone access is needed for voice interaction. Camera sharing, where enabled, uses snapshots in a learner's personal AI Fellow (Your Fellow) and Learning Path Fellow sessions; it is not continuous video recording. Camera and screen sharing require an enabled feature and your action and can be stopped at any time. Browser permissions enable the selected function; they do not establish consent to unrelated processing.

Raw live audio, camera snapshots and screen frames are not retained as recordings after the session. Information spoken or shown can remain in transcripts, summaries, assessments or authorized integration records. Session files provide temporary conversation context; information discussed from them and their filenames may remain in the conversation record.

AI evaluates learning against configured objectives and criteria, can generate simulation feedback and scores, and can summarize a person's activity across programs. These results can affect learning progression and completion and may amount to profiling. Results depend on the information provided, the selected criteria and the AI's interpretation, and can contain errors. They are not intended to be the sole basis for employment, admission or other decisions with legal or similarly significant effects.

For a customer program, ask the responsible organization for human review of a disputed result, correction of inaccurate information and an explanation of any consequential decision. Frontierz assists the organization with information and records within its control. For a Frontierz-operated demonstration, contact us directly. Frontierz does not make solely automated decisions with legal or similarly significant effects through its website or public demonstrations. Any separately authorized regulated customer deployment requires its own assessment, notices and safeguards.

6. Access, recipients and service providers

Authorized customer personnel can access individual records according to their permissions. A private AI Fellow restricts who may start a conversation; it does not make those conversations confidential from authorized customer personnel. Data is separated by tenant and is not available to other customers. Authorized Frontierz personnel and service providers may access data as necessary for their assigned functions, under access controls and confidentiality obligations.

The following providers support the relevant services. Optional providers apply only when the corresponding feature is used. The customer data processing agreement and subprocessor information identify the legal entities and deployment-specific arrangements.

Customer-selected identity providers, LMS platforms and connector destinations receive the data required by the customer's configuration. They are governed by the customer's arrangements and are not automatically Frontierz subprocessors. Customer billing is handled by Frontierz through invoices, purchase orders and bank transfer; no online payment processor is used for corporate customers. Our authorized staff and contracted business-service providers also handle correspondence, support, accounting and legal administration within their functions. We provide recipient and safeguard information on request through our privacy contact.

Your organization's administrators decide how certificates and other program assets are shared, including whether a certificate can be verified through a link, and can correct or withdraw them. Ask your organization about the settings that apply to your program. Exported records are handled under the recipient organization's responsibility. External links, including YouTube interviews and external credential claims, lead to services governed by their own notices.

We do not sell personal data. We disclose it where required by law, to protect legal rights, or for a proposed or completed corporate transaction under confidentiality, necessity and applicable data-protection safeguards.

7. Processing locations and international transfers

Core platform hosting and storage are in the European Union. AI processing, support and auxiliary-provider locations depend on the contracted deployment and the applicable provider arrangements, and are documented for each customer. Where BYOAI is agreed, inference uses the customer's designated Azure resources, while platform hosting and stored learning records remain with Frontierz under the customer agreement. The Data Location and Export page identifies the Azure regions used for the standard deployment, the safeguards against unlawful third-country access and the export formats available to customers.

Transfers or remote access outside the European Economic Area require an applicable adequacy decision or appropriate safeguards, including European Commission Standard Contractual Clauses and necessary supplementary measures. Reliance on the EU–US Data Privacy Framework requires an eligible recipient with a current certification covering the processing. Customer-controlled transfers also require the controller's documented authorization. You may request the applicable recipient, location and transfer information and a copy of relevant safeguards through rgpd@founderz.com.

8. Retention, return and erasure

We retain inquiry and partner records while dealing with the request and any resulting business relationship. Frontierz-operated demonstration records are retained for the requested interaction and the associated review, support and security purposes. The relevant record is deleted or anonymized when those purposes end, subject to any necessary legal or claims retention. Billing, accounting and legal records are kept for the periods required by the relevant legislation and limitation rules. Access to records retained solely for those purposes is restricted, including statutory blocking where required by Spanish law.

Marketing contact data is retained until consent is withdrawn or an objection is received, unless another lawful purpose independently requires retention. We may keep the minimum suppression information needed to respect an objection. Technical records are retained only for the security, reliability and incident-investigation purposes they serve, subject to applicable legal requirements.

Customer workspace records follow the customer's documented retention instructions and data processing agreement during the service. At exit, data is returned or erased as instructed, observing applicable retrieval rights, agreed deadlines and legal retention duties. Backup copies follow the agreed expiry and deletion lifecycle and are protected from ordinary use pending erasure. Applicable deletion instructions are reapplied if a backup is restored.

Deleting readable conversation content does not necessarily erase the associated activity record, such as dates, duration, counts and Fellow identity. Removing account access is also separate from erasure. Requests concerning all personal data are handled through the rights process below.

9. Security, professional audiences and minors

We apply encryption in transit and at rest, tenant separation, restricted access, logging, vulnerability management, backups and incident procedures appropriate to the processing. Production personal data is not used in development or testing. These measures are reviewed as risks and the service change.

Frontierz is intended for professional audiences and does not direct its website or public demonstrations at children. A customer deployment directed at minors requires express agreement and appropriate eligibility, information, authorization and protection arrangements before use.

10. Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction and portability; withdraw consent at any time without affecting earlier lawful processing; and exercise rights concerning solely automated decisions with legal or similarly significant effects.

Right to object. Where we rely on legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims. You may object to direct marketing at any time and without giving reasons; we will then stop that marketing.

For a customer workspace, contact the organization responsible for your program or its privacy contact. You may also write to rgpd@founderz.com. We forward requests relating to customer-controlled data to the controller without undue delay and assist it in responding. For processing we control, we respond directly.

We may request information reasonably necessary to verify identity. Responses are provided within one month, extendable by up to two further months where justified by complexity or the number of requests; any extension and its reasons are communicated within the first month. Requests are free unless the GDPR permits a reasonable fee or refusal for a manifestly unfounded or excessive request.

You may complain to the Spanish Data Protection Agency or another competent supervisory authority, including in the Member State of your habitual residence, workplace or the alleged infringement. Judicial remedies remain available.

11. Cookies and changes to this policy

The Cookies Policy identifies the website and public-demo cookies and explains the available controls. Optional tracking requires the applicable prior consent. This policy is information about processing, not a request to consent to every activity described.

We publish the revision date above and provide appropriate notice of material changes. A new purpose requires the relevant legal assessment and information before processing begins, and fresh consent where legally required. This policy does not amend the customer's data processing agreement or reduce statutory rights.