Your privacy matters.

1. Scope

This Privacy Policy applies to FrostKey websites, account registration, the FrostKey platform, forms, support communications, transactions, and related services. It describes how FrostKey handles personal information as a business and service provider.

2. Information We Collect

Depending on how FrostKey is used, we may collect:

• Account and identity information, such as name, email address, organization, role, and authentication details
• Firm workspace information, including firm name, governance owners, users, permissions, and participation settings
• Governance content submitted to the platform, such as policies, capability records, configurations, acknowledgements, attestations, review notes, and supporting evidence
• Transaction and subscription information, generally processed through payment providers
• Support, contact, demo, intake, and other communications
• Technical and usage information, such as IP address, browser, device, log data, pages viewed, feature usage, and error information

3. Customer Content and Confidential Information

Customer organizations control the governance content they submit to FrostKey. FrostKey processes that content to provide, secure, support, and improve the contracted service and according to customer instructions. Customers should avoid uploading unnecessary client matter content, privileged materials, regulated information, or highly sensitive personal information unless the use is authorized and appropriate safeguards are in place.

4. How We Use Information

FrostKey may use information to:

• Create, authenticate, administer, and secure accounts and firm workspaces
• Provide AI governance, documentation, monitoring, participation, and reporting workflows
• Process subscriptions, payments, and service communications
• Respond to support, contact, demo, and intake requests
• Maintain audit, security, fraud-prevention, and operational records
• Diagnose errors, measure service performance, and improve usability
• Comply with law, enforce agreements, and protect FrostKey, customers, users, and others

5. Legal and Business Grounds

FrostKey processes information as necessary to provide requested services, perform agreements, maintain security and legitimate business operations, comply with legal obligations, and, where required, based on consent.

6. Sharing and Service Providers

FrostKey may disclose information to service providers that support hosting, databases, authentication, email delivery, payment processing, analytics, customer support, security, and similar operations. These providers may process information only for authorized purposes and are expected to protect it appropriately.

FrostKey may also disclose information when required by law, to protect rights or safety, in connection with a corporate transaction, or with the customer’s direction or consent.

7. No Sale or Targeted Advertising

FrostKey does not sell personal information. FrostKey does not use customer governance content for targeted advertising. If these practices materially change, this policy will be updated and any legally required choices will be provided.

8. Security

FrostKey uses administrative, technical, and organizational safeguards designed to protect information, including access controls, authentication, tenant separation, secure service credentials, and other measures appropriate to the nature of the service. No system can be guaranteed completely secure.

9. Retention and Deletion

FrostKey retains information for as long as reasonably necessary to provide the service, maintain legitimate business and security records, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods may vary by data type and customer instructions. Deletion requests may be subject to authentication, legal holds, backup cycles, and other lawful limitations.

10. Cookies, Analytics, and Logs

FrostKey may use cookies, local storage, logs, and similar technologies for authentication, security, preferences, service operation, diagnostics, and analytics. Browser controls may allow users to limit certain technologies, although doing so may affect functionality.

11. Privacy Rights and Requests

Depending on applicable law, individuals may have rights to access, correct, delete, or obtain a copy of certain personal information, and to appeal a denied request. Requests may be submitted through FrostKey’s contact page. FrostKey may verify identity and authority before acting on a request.

When FrostKey processes information on behalf of a customer organization, requests relating to that organization’s workspace may need to be directed to the customer as the responsible organization.

12. International Processing

FrostKey and its service providers may process information in the United States and other locations where they operate. Where required, FrostKey will use appropriate safeguards for cross-border processing.

13. Children’s Privacy

FrostKey is intended for business and professional users and is not directed to children. FrostKey does not knowingly collect personal information from children under 13.

14. Third-Party Services

FrostKey may link to or integrate with third-party services. Their privacy and security practices are governed by their own terms and policies.

15. Changes to This Policy

FrostKey may update this Privacy Policy. Material changes will be reflected by an updated effective date and, when appropriate, additional notice.

16. Contact and Appeals

Privacy questions, requests, and appeals may be submitted through the FrostKey contact page. Include enough information for FrostKey to identify the relevant account or interaction without sending unnecessary sensitive data.

Effective Date: July 24, 2026