Privacy Policy
Document version: 2026-05-16-v2 ·
Effective May 16, 2026
This Privacy Policy explains what information Frontieras North America, Inc. (“Frontieras,” “we,” “our”) collects when you use the FASForm 6-1 Spread Calculator dashboard (the “Service”), how we use that information, and what choices you have. The Service is provided as an access-controlled tool for qualified institutional investors evaluating Frontieras’ proprietary processing margin framework.
[REVIEW] Counsel: please confirm the legal entity name, jurisdiction of incorporation, and registered agent designation used throughout this document.
1. Information We Collect
1.1 Information you provide to us
When you request access to the Service, we collect:
- Identification: your full name, organization, professional title, and phone number (optional)
- Email address used to create your account
- Password (stored as a salted hash; we never see the plaintext)
- Investor type self-certification: whether you are a Qualified Institutional Buyer (Rule 144A), an accredited individual investor (Rule 501(a)), an accredited entity investor (Rule 501(a)(1)-(3),(7)-(13)), or do not qualify
- Legal acknowledgments: a timestamped record of every Privacy Policy, Terms of Service, No-Reliance Notice, and Investor Acknowledgment you accept, including the version accepted and the IP address used
1.2 Information we collect automatically
When you use the Service, we automatically collect:
- Account-activity telemetry: sign-in and sign-out events, the IP address used, the device user-agent (browser and operating system), and the time each event occurred
- Behavioral analytics: page views (URL path, referrer), and interaction events on the calculator (slider adjustments, chart period selections, scenario resets, methodology section opens). Each event includes a per-tab session identifier, your assigned user identifier, a timestamp, and the page on which it occurred
- Session cookies: a single HTTP-only, Secure, SameSite-Lax cookie named
fasform_supabase_session that contains a JSON Web Token authenticating your session. The cookie has a 7-day maximum lifetime and is not used for cross-site tracking
1.3 AI-derived analytical content
To assist Frontieras’ investor relations team in understanding institutional interest in the FASForm 6-1 framework, the behavioral analytics described in Section 1.2 may be summarized by a large language model (currently Google Gemini 3 Flash via OpenRouter). The model receives the structured event stream and produces a short narrative describing the scenarios you appeared to test (for example, downside stress tests or bull-case modeling). The generated summary is stored in our database and may be shown to Frontieras administrators. The model provider does not retain your data for training purposes; we operate under their no-training data processing terms.
[REVIEW] Counsel: please confirm whether OpenRouter and Anthropic/Google are appropriately classified as data sub-processors for purposes of any state-law or international transfer obligations (CCPA § 1798.140(ai); GDPR Art. 28 if any users are EU residents). A data processing addendum (DPA) with our AI provider may be advisable.
2. How We Use Information
- Provide and secure the Service — authenticate you, maintain your session, prevent unauthorized access
- Understand institutional engagement — analyze how qualified investors use the calculator to inform investor relations strategy
- Maintain SEC and regulatory audit trail — preserve immutable records of which investors viewed which materials at which times, in support of Frontieras’ obligations under Regulation A, Regulation D, the Securities Act of 1933, and the Securities Exchange Act of 1934
- Send transactional communications about your account — signup confirmation, approval, denial, password reset, security alerts, and changes to these policies. These are not marketing emails and do not require separate consent
- Send marketing and outreach communications — only if you have given separate opt-in consent at signup. This may include updates on Frontieras’ capital raise, follow-up about your evaluation of the Service, invitations to events or briefings, and similar communications. You may withdraw this consent at any time using the unsubscribe link in any such email or by emailing investor.relations@frontieras.com
- Comply with law, valid legal process, and reasonable requests from law enforcement or regulators
[REVIEW] Counsel: please confirm the CAN-SPAM Act § 5 (15 U.S.C. § 7704) requirements for any outreach to consenting users (clear sender identification, accurate header information, functional unsubscribe mechanism, postal address in footer). State-specific opt-in rules (CCPA for California, etc.) may also apply to marketing communications.
3. How We Share Information
We do not sell, rent, or lease your personal information. We share information only as follows:
- Frontieras personnel with a need to know (executive, finance, IR, legal, IT)
- Service providers we use to operate the platform: Supabase (database and authentication hosting), Railway (application hosting), OpenRouter (AI inference routing), and the underlying model provider (currently Google) — each bound by contract or terms of service to use your information only to provide their service to us
- Auditors, underwriters, and counsel in connection with capital-markets activities, subject to confidentiality
- Government agencies and regulators if required by law, court order, or valid subpoena, or to protect rights and safety
- Successors in the event of merger, acquisition, financing, sale of assets, or similar transaction
4. How Long We Retain Information
- Account records and legal acknowledgments: retained for the longer of the period during which you have an account or seven (7) years after account closure, to satisfy SEC books-and-records requirements
- Behavioral analytics and AI-derived summaries: retained for the longer of three (3) years after generation or the period required by applicable securities law
- Authentication telemetry (sign-ins, sign-outs): retained for one (1) year for security purposes
- Audit-trail records (admin actions taken on your account): retained indefinitely for SEC compliance
[REVIEW] Counsel: please confirm retention periods, particularly the 7-year SEC books-and-records framing under Exchange Act Rule 17a-4 and Rule 31a-2 (or applicable Reg A equivalents). If different periods apply pre- vs. post-S-1 effectiveness, please advise.
5. How We Protect Information
We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Specifically:
- All Service traffic is encrypted in transit over HTTPS (TLS 1.2 or higher)
- Database storage uses provider-managed encryption at rest
- Session tokens are HTTP-only and Secure-flagged
- Role-based access controls and database row-level security (RLS) restrict who can read which records
- Administrative actions on user records are timestamped and immutable
No method of electronic transmission or storage is 100% secure; we cannot guarantee absolute security.
6. Your Rights and Choices
You may, at any time and free of charge, request:
- Access to the personal information we hold about you
- Correction of inaccuracies in your account profile
- Deletion of your account, subject to our right to retain certain records for legal, audit, or compliance purposes
- Portability — a copy of the information you provided to us in a structured, machine-readable format
- Withdrawal of consent — though this may terminate your access to the Service
To exercise any of these rights, contact us using the details in Section 11.
[REVIEW] Counsel: California residents may have additional rights under CCPA/CPRA (right to know categories of information, right to opt-out of “sales” or “sharing,” right against discrimination). Please confirm whether we should add a California-specific section. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under CCPA § 1798.140.
7. Cookies and Similar Technologies
We use a single essential session cookie (fasform_supabase_session) to authenticate you. We do not use third-party advertising cookies, marketing pixels, or cross-site tracking technologies. Disabling this cookie will prevent you from signing in.
8. International Users
The Service is hosted in the United States. If you access it from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.
[REVIEW] Counsel: if Frontieras intends to permit access to investors located in the European Economic Area, the United Kingdom, or other jurisdictions with comprehensive data protection laws, additional disclosures and Standard Contractual Clauses may be required. Please advise.
9. Children
The Service is offered only to persons who are 18 years of age or older and who meet the qualified-investor criteria. We do not knowingly collect information from minors.
10. Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will publish the new version with an updated effective date and version identifier. Material changes will be communicated to active users by email, and continued use of the Service after the effective date constitutes acceptance of the revised policy. You will be required to re-acknowledge the new version on your next sign-in.
11. Contact
Questions about this Privacy Policy may be directed to:
Frontieras North America, Inc.
Attn: Investor Relations — Privacy
Email: investor.relations@frontieras.com
[REVIEW] Counsel: please supply the appropriate registered address, designated privacy contact, and any state-required contact information (e.g., California Shine the Light request address).