Frontlog Privacy Policy

Last updated: October 18, 2026

Frontlog is operated by Heraclius, LLC ("we," "us," or "our"). This Privacy Policy explains what information we collect when you use Frontlog, how we use it, who we share it with, and the choices you have. It should be read together with our Terms of Service.

1. Our Role

For account, billing, usage, and support information, Heraclius, LLC decides how that information is used and is the business (or "controller") responsible for it.

For workspace content, we process the content on behalf of the customer that owns the workspace and under that customer's instructions, acting as a service provider (or "processor"). If you are a team member invited to a workspace, the founder or company that owns the workspace controls its content, and we may refer requests about that content to them.

2. What We Collect

Account information. When you register or are invited, we collect your name, email address, and password. Passwords are managed by AWS Cognito and stored only as a secure hash; we never store raw passwords. Founders also provide billing contact details.

Workspace content. Everything you and your team put into Frontlog: ideas, hypotheses, attached context, AI audit results, outcome drafts, queue items, comments, suggestions, links, and workspace settings. This is your data. We use it to provide the service and for the limited support, security, and abuse-prevention purposes in Section 3. We never use it for advertising.

Usage and technical data. We log how the service is used: sign-in events, pages visited, audits run, features used, and error reports. We also receive technical data such as IP address, browser type, and device information when you load the app. We use this to operate the service, enforce quotas, detect abuse, and improve reliability. We do not use it for advertising.

Trial records. To allow one free trial per person, when a workspace starts a trial we keep a record with a one-way hash (SHA-256) of your normalized email address, your email domain, and a keyed one-way hash of your network address. We do not keep the email address or network address itself in this record. The hashes can only be used to recognize the same email or address again, not to recover them.

Payment information. Subscriptions are processed by Stripe. Your card details go directly to Stripe; we never see or store full card numbers. We store your Stripe customer ID, subscription status, and a record of single-audit purchases and credits so we can manage your plan. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.

Support communications. If you email support@frontlog.ai, we keep the messages so we can help you and track recurring issues.

Information we do not request. We do not request biometric data, precise location data, or other sensitive personal information. Because workspace content is free text, we cannot control what you type. Please do not submit sensitive personal information (such as health information, financial account numbers, or government ID numbers), and do not submit personal information about other people unless it is needed for your idea and you have the right to share it.

3. How We Use Your Information

• Provide the service. Store your workspaces, run audits, and manage accounts and sessions.
• Generate AI audits and outcome drafts. Your idea content is sent to our AI provider (Anthropic) to produce them. See Section 4.
• Billing. Manage subscriptions, trials, quotas, single-audit purchases, and failed payments through Stripe.
• Emails. Send the emails the service needs, such as account and sign-in emails, invitations, receipts and billing notices, and notices about your trial or plan. We may also send summaries of activity in your workspaces and reminders about your ideas. Every summary and reminder email includes a way to stop receiving it. We do not send advertising from other companies, and we do not track whether you open our emails.
• Support. Respond to your questions and troubleshoot problems, which may require viewing relevant workspace content.
• Security and abuse prevention. Detect unauthorized access, enforce seat limits, quotas, and the one-trial-per-person rule, and protect the service.
• Product improvement. Analyze aggregated usage patterns, such as which features are used most. We do not build individual profiles for advertising.

We do not sell your personal information or share it for cross-context behavioral advertising. We do not share it with advertisers or data brokers. We do not use your workspace content to train AI models without your separate written consent.

4. AI Processing Disclosure

AI research audits are Frontlog's core feature, and producing them requires sending your idea content to a third-party AI provider.

What is sent. The idea text you submit, plus any context you attach to it, is transmitted to Anthropic, our AI model provider, through its API.

Web research. To ground an audit in current information, the AI runs a few web searches based on your idea. The searches are made through Anthropic's web search tool, so search terms derived from your idea leave Frontlog as part of that request.

How Anthropic handles it. Anthropic processes this content to generate the audit under its commercial terms, which state that it does not train its models on content submitted through its API by default. Anthropic's retention and handling of this content are governed by its own terms and privacy policy, available at anthropic.com/legal. We do not control those practices.

Our recommendation. Do not submit trade secrets, unfiled patent material, or other highly sensitive confidential information into an AI audit unless you have assessed the risk. Anything you submit is transmitted to a third-party service.

Accuracy of output. Audits are generated automatically and may contain inaccurate or outdated statements, including statements about real companies, products, markets, or people. Review and verify output before relying on it or sharing it.

Audit history. The audits we generate are stored in our database and shown in your audit history. They are visible to members of your workspace and to our staff only as described in Section 6.

Provider changes. If we change or add AI providers, we will update this policy and notify you before the change takes effect.

5. Who We Share Information With

We share information only with the service providers needed to operate Frontlog, under contracts that limit their use of it:

• Amazon Web Services (us-east-1). Hosting, databases, file storage, authentication (Cognito), and email delivery (SES). Your account information and workspace content are stored here.
• Vercel. Hosts our marketing website (frontlog.ai) and processes technical request data, such as IP address and browser type, when you visit it. It does not receive your workspace content.
• Anthropic. AI model provider for audit generation. Receives idea content as described in Section 4.
• Stripe. Payment processing. Receives billing contact details and processes card payments.
• Cloudflare. Runs the automated bot check (Turnstile) on our sign-up and email-code sign-in forms and processes technical signals from those pages, such as IP address and browser characteristics. It does not receive your password or workspace content.
• Google Workspace. Hosts our support mailbox. Receives the messages and contact details you send to support@frontlog.ai.
• Google Fonts. Serves the typeface used on frontlog.ai and in the app. Your browser fetches it from Google, which receives your IP address and browser details. It receives no account information or workspace content.

We keep a current list of these providers at frontlog.ai/subprocessors and update it before a new provider begins receiving customer data.

We do not share your information with anyone else except:

• When required by law, court order, or valid government request. We will notify you unless legally prohibited.
• To protect our rights, safety, or property, or that of our users, where the law permits.
• In connection with a merger, acquisition, or sale of assets. We will notify you before your information transfers.

What you choose to make public. Workspace content stays private to your workspace unless a founder shares it. If you publish an idea and its audit to the Public Library, it can be read by anyone, including people without an account, and it shows your name as the author. Comments on public ideas show the commenter's name. You see a preview of exactly what will be shown before anything is published. See Section 7 of our Terms of Service for the license that applies to published content.

We do not sell personal information, and we have no advertising partners.

6. Data Security

• Encryption in transit. All traffic uses TLS (HTTPS). We do not serve the product over unencrypted connections.
• Encryption at rest. Databases are encrypted with AWS KMS. File storage uses KMS-managed keys. Secrets such as API keys and credentials are stored in AWS Secrets Manager, never in code or logs.
• Authentication. Managed by AWS Cognito with secure password hashing and email verification. We support the MFA options Cognito provides.
• Access control. Staff access to production data is limited to what is needed to operate and support the service, and is logged.
• Network isolation. Production databases and caches run in a private network, reachable only by the application.

No system is perfectly secure. If we discover a breach affecting your information, we will notify you as required by law and describe what happened and what we are doing about it.

7. Data Retention and Deletion

• Active accounts. While your account is active, we keep your information so the service works.
• Free accounts. If a trial ends without a subscription or you cancel, your workspace moves to the free account and your data is kept so you can keep using it. If nobody signs in to an account for 24 months, we may close it and delete its data. We will email you at least 30 days before this happens.
• Trial records. The hashed trial records described in Section 2 are kept after a workspace or account is deleted, so that deleting and signing up again does not start another trial. They contain no email address, name, or network address.
• Public Library. If you unpublish or delete an idea you published to the Public Library, we remove it from the Public Library. Copies that other people already claimed are theirs and are not deleted.
• After termination. You may request an export of your data (workspaces, ideas, and audit history in a standard machine-readable format) within 30 days. After that, we delete your data, including from backups as they cycle out on our normal schedule. If you delete your account yourself, your data is deleted at once and nothing is left to export afterwards, so export it first from Settings.
• Earlier deletion. You can delete your account at any time in Settings, under Delete account, or email support@frontlog.ai from your account email address. Comments and suggestions you made in workspaces that continue stay there, shown as "Former member". Purchased research credits you have not used are forfeited, and our records of those payments are kept without your name, for accounting.
• Legal holds. We may keep limited information longer if required by law, to resolve disputes, or to enforce our agreements. We will tell you if this applies to you.
• Aggregated data. We may keep aggregated usage statistics that do not identify you.
• Third-party copies. Anthropic and Stripe retain data under their own policies and legal obligations after we delete our copies.

8. Your Rights

Depending on where you live, you may have the right to:

• Access: Ask what personal information we hold about you.
• Correction: Fix inaccurate information in your account settings or by contacting us.
• Deletion: Request deletion of your personal information, subject to Section 7.
• Emails: Stop receiving summary and reminder emails at any time. Emails the service needs, such as sign-in, security, and billing emails, continue while you have an account.
• Export: Receive your workspace data in a machine-readable format.
• Opt out of sale or sharing: We do not sell personal information or share it for advertising, so there is nothing to opt out of.

To exercise any of these rights, email support@frontlog.ai. We will verify your identity before acting on a request, and we will respond within 30 days. You may use an authorized agent where the law allows. If you are a team member, we may refer requests about workspace content to the workspace owner. If we deny your request, you may appeal by replying to our response. We will not discriminate against you for exercising your rights.

9. Cookies

The Frontlog app uses one strictly necessary cookie to keep you signed in. It is sent only to our sign-in service, cannot be read by scripts on the page, is never shared with other sites, and is removed when you log out. The app also uses your browser's local storage to remember preferences such as your selected workspace. We do not use analytics, advertising cookies, or cross-site tracking. The typeface is loaded from Google Fonts (Section 5), which sees your IP address when it is fetched. If we add analytics, we will update this policy first.

10. Age Requirement

Frontlog is a business product intended for users 18 and older. It is not directed at children, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it promptly. If you believe a minor has provided us information, contact support@frontlog.ai.

11. International Transfers

We store your account information and workspace content in AWS us-east-1 (United States). Our web application is delivered through Amazon's global content delivery network, and our marketing website through Vercel's; both may process technical request data on servers outside the United States. If you access Frontlog from outside the United States, your information is transferred to and processed in the United States.

12. Changes to This Policy

We may update this policy from time to time. If we make a material change, we will notify you by email or in-product notice at least 30 days before it takes effect, and the "Last updated" date will change. If a change would let us use information we already collected in a materially different way, we will ask for your consent where the law requires it.

13. Contact

For privacy questions, rights requests, or deletion requests:
Email: support@frontlog.ai
Operator: Heraclius, LLC