Version 0.2+104700a8
Fristal Privacy Notice
Draft v0.2, 18 October 2026. Not for publication. This notice covers the UK GDPR and the EU GDPR (Regulation (EU) 2016/679). Items marked [LAWYER] or [TBD] are open; the full list is in legal/README.md.
1. Who we are
Fristal is run by Tagg Software Ltd, a company registered in England and Wales (company number 16997744), registered office Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE ("Tagg", "we", "us").
[LAWYER: Company details were confirmed on Companies House on 18 October 2026. Re-check on the day of publication.]
Contact for privacy questions: privacy@fristal.com [ROB: confirm these mailboxes exist]. Postal address: our registered office above.
Representative in the EU: [LAWYER: Tagg is based in the UK and does not have an establishment in the EU. Please advise whether we must appoint an EU representative under Article 27 of the EU GDPR, given that we offer the Service to businesses in the EU. If so, add the representative's name and address here: TBD.]
Data protection registration: [ROB/LAWYER: confirm whether Tagg must pay the UK data protection fee to the ICO, and add the reference if so: TBD.]
2. What this notice covers
This notice explains how we use personal data when:
- you sign up for, log in to, or use a Fristal account;
- you use the free "Am I in scope?" checker or the quick SBOM scan on our website;
- you visit our website and use the session cookie; and
- you contact us.
It does not cover the products that you make, or the people who use them. You are responsible for your own customers' and users' personal data.
3. Our role
- For account, billing, website and security data, we are a controller. We decide why and how that data is used.
- For personal data that appears in Customer Content (the lockfiles, SBOMs and product records that you upload), we act as a processor on your instructions, and you are the controller. [LAWYER: confirm this split. Also decide whether a standalone data processing agreement is needed for business customers, and whether it should be signed at sign-up.]
- Stripe handles payment card details and billing. [LAWYER: confirm whether Stripe is a processor for Tagg or an independent controller for the data it collects. Section 7 should match.]
We expect Customer Content to contain little or no personal data, because it is usually a list of software components and their versions. Please do not upload anything you would not want us to hold.
4. What personal data we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account data | Email address, organisation name, and a password stored only as a hash (argon2id). We never store or see your password in plain text. | You, when you sign up |
| Security data | A truncated SHA-256 hash of your IP address, used only to limit repeated sign-in attempts and free scans. We store the hash, not the IP address, and purge it after 1 day. We treat the hash as personal data, because hashed IPv4 addresses are easy to reverse. See section 8. | Your browser or device, automatically |
| Customer Content | Product names and versions, uploaded lockfiles and SBOMs (component names, versions, ecosystems and package identifiers), the original lockfile or SBOM file as uploaded, matching results, findings, reporting checklists, report fields, notes | You, when you upload or enter it |
| Evidence log (audit log) | A record of actions taken in your Account: who did what, when, on which product. Event text may include the email address of the user concerned. Password reset requests and password changes are recorded in it, with the account's email address and the time. | Generated by the Service |
| Billing data | Plan, subscription status, and the Stripe customer and subscription ids. Card and billing details are held by Stripe, not by us. | You and Stripe |
| Support correspondence | Emails you send us and our replies | You and us |
| Website cookie | One session cookie, described in section 10 | Your browser, set by us |
| Free checker and quick scan | Not stored. Your answers to the scope checker, and any SBOM you upload to the quick scan, are not kept. The only record is the hashed-IP rate-limit entry under Security data. | You |
| Slack webhook URL | The webhook URL, if you add one. It works like a password: anyone who has it can post to your channel. We store it and show it masked in the app. | You |
| Alert delivery log | For each alert we send: the recipient email address, the finding identifiers, the outcome, and any error text. | Generated by the Service |
| Scan-run records | When each scan ran and what it found, in outline. These contain no personal data. | Generated by the Service |
| Terms acceptance | The version of the Terms you accepted and the time you accepted it. | You, when you accept |
| Weekly digest record | A record of each weekly digest email sent to your Account email address. | Generated by the Service |
Slack or other webhooks. If you add a Slack webhook, alerts about your products will be sent to that channel. Slack handles them under its own terms. You are responsible for choosing a channel that the right people can see. We store the webhook URL, which is a credential, and mask it in the app. Anyone with the URL can post to the channel, so keep it private.
Original uploaded files. When you upload a lockfile or SBOM to a product, we keep the original file as well as the component list we read from it. The original is stored in a private Railway Storage Bucket in Amsterdam (EU), under a random key that we generate. The key does not contain your file name, and it is kept per organisation and product. The bucket cannot be made public, and unauthenticated requests to it are refused. The bucket has no backups or object versioning. Our storage provider states that data is encrypted at rest. We do not manage the encryption keys, and we set no server-side encryption options of our own. [ROB: confirm production uses the same bucket setup.]
The stored file is never public. Only users of your organisation can download it, through the Service, and each download is recorded in the evidence log. Separately from the app, our authorised staff and our hosting provider can technically access the stored files directly, because the bucket sits in our account with the provider. [ROB: confirm who holds bucket access.] If the file cannot be stored, the upload still works and the component list is still scanned; the evidence log records that the original was not kept.
The free "Am I in scope?" checker and the quick SBOM scan keep none of your answers or files. They do keep a hashed IP address for rate limiting, as described under Security data in section 4 and in section 8.
Deleting a product or closing your Account. You can delete a product yourself, from its page. Deletion is immediate and cannot be undone. It removes the product's data, its stored original files and its evidence-log entries, and it keeps one organisation-level record that the product was deleted (its name, who deleted it, when, and how many items were removed). Closing your Account locks it at once. Everything in it is permanently deleted 14 days later (section 8).
5. Why we use personal data, and our lawful basis
| Purpose | Data used | Lawful basis (UK GDPR and EU GDPR) |
|---|---|---|
| Creating and running your Account, and providing the Service | Account data, Customer Content | Contract (Article 6(1)(b)) |
| Daily scans, matching, alerts, weekly digest emails and the reporting checklist | Customer Content, account email, alert delivery log, weekly digest record | Contract (Article 6(1)(b)) |
| Recording which terms you accepted, and when | Terms acceptance | Contract (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)): being able to show which terms applied |
| Taking payments and managing your subscription | Billing data, account data | Contract (Article 6(1)(b)) |
| Keeping accounting and tax records | Billing data | Legal obligation (Article 6(1)(c)) |
| Preventing abuse, protecting the Service, rate limiting and security | Security data, audit log | Legitimate interests (Article 6(1)(f)): keeping the Service safe and available for all customers |
| Keeping the evidence log | Audit log | Contract (Article 6(1)(b)), for the record you asked the Service to keep. [LAWYER: confirm.] |
| Answering support questions | Support correspondence | Legitimate interests (Article 6(1)(f)), or contract where the question relates to your Account |
| Defending or bringing legal claims | Any of the above, as needed | Legitimate interests (Article 6(1)(f)) |
| Website session cookie | Session cookie | Strictly necessary cookie (see section 10). No consent is needed under PECR regulation 6. |
| Marketing emails to people who used the free checker | Email address | Consent only. We will not send marketing without opt-in. [LAWYER: confirm the approach. The soft opt-in under PECR does not apply to people who have not bought from us.] |
Where we rely on legitimate interests, we have weighed our interests against yours. The data is limited to what the purpose needs, and you can object (section 9).
6. Who receives your data (processors and recipients)
| Recipient | What they receive | Role | Location |
|---|---|---|---|
| Railway (hosting, and the Railway Storage Bucket for original uploaded files) | All data held by the Service, including Customer Content, original uploaded files and the audit log | Processor | Web app: Netherlands (europe-west4). Storage bucket: Amsterdam (EU). [ROB: confirm production uses the same regions.] |
| Email provider: [TBD: provider name] | Email addresses, and the content of account and alert emails | Processor | [TBD] |
| Stripe | Billing and payment details, and the email and organisation name needed to take payment | [LAWYER: processor or independent controller] | [TBD: confirm the Stripe entity and locations] |
| OSV.dev (run by Google) | Component names, ecosystems and versions, in queries. No personal data. | Independent provider of public data. We send it no account or user information. | United States [LAWYER: check] |
| CISA Known Exploited Vulnerabilities catalogue | Nothing about you or your components. We download the public catalogue; matching happens inside the Service. | Public data source. | United States |
| Slack (only if you add a webhook) | Alert content sent to your channel | Controlled by you, under Slack's terms | United States |
[LAWYER: Railway's storage runs on Tigris infrastructure. Please advise whether Tigris must be listed as Railway's sub-processor (and so in this table), and whether Railway's terms flow down the processor obligations.]
[LAWYER: The brief said OSV.dev and CISA receive component names and versions. The code shows that OSV.dev receives component names and versions in queries, while CISA is a downloaded feed and receives nothing about your components. This notice follows the code. Please confirm.]
We do not sell personal data. We share it only with the recipients above, with professional advisers, and where the law requires.
7. International transfers
Some of our providers may process personal data outside the UK and the European Economic Area, including in the United States. Where that happens, we rely on [LAWYER/TBD: the mechanism for each provider, for example the UK International Data Transfer Agreement or UK Addendum, the EU Standard Contractual Clauses, or certification under the EU–US Data Privacy Framework].
For transfers from the EEA, the position on UK adequacy and any EU-side safeguards must be confirmed. [LAWYER: check the current status of the EU adequacy decision for the UK and the UK's adequacy decisions for the EEA before publication.]
Our web app is hosted on Railway in the europe-west4 region (Netherlands), which is in the EEA. Original uploaded files are stored in a Railway Storage Bucket in Amsterdam (EU). Railway's storage runs on Tigris infrastructure. [ROB: confirm production uses the same regions.] [LAWYER: check the Railway contracting entity, whether the Tigris infrastructure or any access from outside the UK and EEA (for example by Railway staff) is a restricted transfer, and the mechanism that applies.]
8. Retention
| Data | How long we keep it |
|---|---|
| Account data | While your Account is open. Deleted 14 days after the Account is closed, unless the rows below say otherwise. |
| Customer Content | While your Account is open, or until you delete the product it belongs to, which removes it immediately. Deleted 14 days after your Account is closed (see the Terms, clause 12.5). Original uploaded files are covered by the next row. |
| Original uploaded files (lockfile and SBOM originals) | For the life of the product, as evidence. Deleted immediately when you delete the product, and 14 days after your Account is closed (Terms, clause 12.5). If a deletion from the bucket fails, it is retried daily until it succeeds. The bucket has no backups or object versioning. |
| Evidence log (audit log) | Entries about a product are deleted when you delete that product. The rest of the log is deleted 14 days after your Account is closed, with the Account. The log includes email addresses in event text, and those are deleted too. We keep one organisation-level record that a product was deleted (its name, who deleted it, when, and how many items were removed) until the Account is permanently deleted. [LAWYER: confirm whether any record should be kept for longer to deal with claims or disputes, and that the Terms (clause 12.5) say the same.] |
| Security data (hashed IP addresses used for rate limiting) | Purged after 1 day. [TBD: confirm the purge is built.] |
| Slack webhook URL | Until you remove it or your Account is closed. |
| Alert delivery log | [TBD: retention period] |
| Scan-run records | [TBD: retention period. These contain no personal data.] |
| Terms acceptance record | While your Account is open. Deleted 14 days after your Account is closed, with the Account. [LAWYER: after closure we can no longer show which terms applied. Confirm that deletion at that point is acceptable, given that we rely on legitimate interests for this record (section 5).] |
| Weekly digest record | [TBD: same as the alert delivery log] |
| Billing and accounting records | As required by UK tax and company law. [LAWYER/accountant: normally 6 years.] Closing your Account cancels your Stripe subscription at once. Stripe keeps the payment records it holds under its own terms. |
| Support correspondence | [TBD: proposal: 2 years after the last message] |
| Server and error logs | [TBD] |
| Backups | [TBD: for example 30 days, then overwritten. Must match the Terms clause 11.4.] |
9. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in some cases;
- have processing restricted in some cases;
- receive a copy of data you gave us, in a usable format (portability), where the lawful basis is consent or contract;
- object to processing based on legitimate interests, including direct marketing;
- withdraw consent at any time, where we rely on it; and
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects. We do not make decisions like this. Alerts and matches are automated information, not decisions about you.
How to exercise your rights: email privacy@fristal.com from the email address on your Account, or write to our registered office. We may need to confirm your identity. We will reply within one month. We can extend this by two further months for complex requests, and we will tell you if we do.
There is no charge, unless a request is clearly unfounded or excessive.
If we process data for your business as a processor, we will pass requests to you where you are the controller, and help you respond.
10. Cookies
We use one cookie, named tw_session, to keep you logged in and to protect forms against cross-site request forgery. It:
- holds a signed session record containing your user identifier, a form-protection token and a session version number, which lets us sign you out of every device at once. It is signed, so it cannot be changed without us noticing, but it is not encrypted. Do not share a device you use for Fristal with people you do not trust;
- is marked HttpOnly and SameSite=Lax, and is marked Secure in our production environment;
- expires after 14 days; and
- is strictly necessary for the Service. We do not use analytics, advertising, tracking or third-party cookies.
Because this cookie is strictly necessary, we do not show a cookie consent banner for it. [LAWYER: confirm this view under PECR regulation 6, and whether any other storage or third-party script would change it. The site loads no third-party scripts, fonts or images.]
To remove the cookie, clear cookies for the Fristal site in your browser. You will then need to log in again.
11. How we keep your data secure
We take reasonable technical and organisational measures, including:
- passwords stored as argon2id hashes;
- session cookies that are signed, HttpOnly and SameSite, and marked Secure in production;
- form-protection tokens on every form submission, and a Content Security Policy that blocks inline scripts;
- checks on every product and incident request, so that one customer cannot see another's data;
- limits on upload size, and parsing that rejects unexpected input;
- rate limits on sign-in attempts and free scans, using hashed IP addresses rather than the addresses themselves;
- an evidence log that users cannot edit, deleted only with the product or Account (section 8);
- original uploaded files kept in a private bucket: no public access and no public links, random storage keys, and downloads only by users of the owning organisation through the Service, each one recorded in the evidence log;
- encryption in transit: [TBD: confirm HTTPS is enforced on the hosting platform];
- encryption at rest: our storage provider states that data is encrypted at rest. We do not manage the encryption keys, and we set no server-side encryption options of our own on the file bucket. [ROB: confirm production uses the same setup;] and
- access controls at the hosting provider: [TBD].
No internet service is completely secure. If we become aware of a personal data breach, we will assess it, tell affected customers without undue delay, and notify the ICO (and, where required, EU supervisory authorities) within 72 hours where the law requires.
Account deletion is built (section 8). Email verification, password reset and session revocation are built. When you sign up we email a verification link to the address you gave, and we do not email alerts or the weekly summary to an address until it is verified. You can reset a forgotten password by email, and changing or resetting your password, or using "Log out everywhere" on the Account page, ends your other sessions. Reset links work once and expire after 1 hour. Normal logout ends only the session you are using. Verification links work once and expire after 48 hours.
12. Complaints
If you have a concern about how we use personal data, please contact us first at privacy@fristal.com. We will try to resolve it.
You also have the right to complain to a data protection authority:
- In the UK: the Information Commissioner's Office (ICO), at ico.org.uk, or by phone on 0303 123 1113. [LAWYER: verify the ICO contact details before publication.]
- In the EU or EEA: the supervisory authority in the EU member state where you live, work, or where the alleged infringement took place. [LAWYER: consider whether to name the relevant EU authorities.]
13. Children
The Service is for businesses. It is not directed at children, and we do not knowingly collect personal data from them.
14. Changes to this notice
We may update this notice. If the change is material, we will tell the Account owner by email before it takes effect. The date at the top of the notice will change when we make any update.
Last updated: [TBD: date of final version].