This Privacy Policy explains how FRAUS CYBERSECURITY SERVICES L.L.C. (“Fraus,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data in connection with our software-as-a-service human risk management platform — the Fraus SaaS Web-Application, accessible at https://app.fraus.ai (the “Service”).
Fraus provides the Service to organizations (each, a “Customer”). This Privacy Policy is intended primarily for our Customers, prospective Customers, and the business representatives who interact with us. Because of the nature of the Service, Fraus acts in two distinct capacities — as a data controller for certain personal data and as a data processor for other personal data. The section “Our Role: Controller and Processor” below explains this distinction, which determines how this Privacy Policy applies.
The Service is intended for business and professional use only. It is not directed to consumers or to the general public, and it is not intended for use by individuals acting in a personal capacity.
Interpretation and Definitions
Interpretation
Words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions have the same meaning regardless of whether they appear in singular or in plural.
Definitions
For the purposes of this Privacy Policy:
Company (referred to as “Fraus,” “We,” “Us,” or “Our”) refers to FRAUS CYBERSECURITY SERVICES L.L.C., Dubai, United Arab Emirates.
Service refers to the Fraus SaaS Web-Application, accessible at https://app.fraus.ai, together with any related products, modules, and services that link to this Privacy Policy.
SaaS Web-Application (or “Application”) means the cloud-based Fraus human risk management platform made available to Customers.
Customer means the organization or legal entity that subscribes to, or is otherwise authorized to use, the Service.
End User means an individual — typically an employee, contractor, or other personnel of a Customer — whose Personal Data is processed through the Service.
Customer Data means Personal Data and other data that a Customer (or its End Users) uploads to, connects with, or generates through the Service, and which Fraus processes on the Customer’s behalf.
Personal Data (or “Personal Information”) means any information relating to an identified or identifiable individual. We use these terms interchangeably unless a specific law requires otherwise.
Controller means the entity that determines the purposes and means of processing Personal Data.
Processor means the entity that processes Personal Data on behalf of, and on the documented instructions of, a Controller.
Subprocessor means a third party engaged by Fraus to process Customer Data in connection with the Service.
DPA means the Data Processing Agreement between Fraus and a Customer that governs Fraus’s processing of Customer Data.
Usage Data means data collected automatically through use of the Service or generated by the Service infrastructure (for example, the duration of a page visit).
Cookies are small files placed on a Device that store information about browsing activity.
Device means any device that can access the Service, such as a computer, mobile phone, or tablet.
You means the individual or entity accessing or using the Service.
Our Role: Controller and Processor
Fraus processes Personal Data in two capacities:
Fraus as Controller. For certain Personal Data, Fraus determines the purposes and means of processing and therefore acts as a Controller. This includes business contact and account information of our Customers and prospective Customers, billing and transaction information, and Usage Data and analytics relating to the operation and security of the Service. This Privacy Policy governs that processing.
Fraus as Processor. When a Customer uses the Service, the Customer uploads or connects Personal Data about its End Users, and the Service generates further data about those End Users (for example, security awareness and phishing simulation results). For this Customer Data, the Customer is the Controller and Fraus acts as a Processor. Fraus processes Customer Data only on the Customer’s documented instructions and in accordance with the agreement between Fraus and the Customer. Where this Privacy Policy and that agreement conflict in respect of Customer Data, the agreement prevails.
If you are an End User and have questions about how your Personal Data is processed, please contact your organization (the Customer), which is responsible as Controller for that data. Fraus will support its Customers in responding to such requests as described below.
Personal Data We Process as Controller
When Fraus acts as a Controller, we may process the following categories of Personal Data:
Business contact and account data, such as name, business email address, business phone number, job title, employer, and the credentials used to access the Service.
Billing and transaction data, such as billing contact details, billing address, payment-method information processed through our payment providers, and records of subscriptions and purchases.
Communications data, such as correspondence with our sales, support, and security teams.
Usage Data, such as Internet Protocol (IP) address, browser type and version, the pages or screens of the Service accessed, the date, time, and duration of access, device identifiers, and other diagnostic data.
We collect this Personal Data directly from you, from the Customer that authorized your access, and automatically through your use of the Service.
Customer Data and End User Data (Fraus as Processor)
Customers may upload, integrate, or otherwise connect Personal Data relating to their End Users in order to use the Service — for example, by connecting their identity, email, directory, collaboration, cloud, or security systems, or by importing user lists. This Customer Data may include End User names, business email addresses, job roles, department, manager, group or organizational-unit membership, and identifiers needed to associate activity with an individual.
Fraus processes Customer Data solely to provide and support the Service on behalf of, and in accordance with the documented instructions of, the relevant Customer. The Customer is responsible, as Controller, for establishing a lawful basis for the processing, for providing any required notices to its End Users, and for the accuracy and lawfulness of the Customer Data it provides. Fraus does not use Customer Data for its own independent purposes and does not sell Customer Data.
Security Awareness and Phishing Simulation Data
As part of delivering the Service, Fraus generates and processes data about how End Users interact with security awareness activities and simulated phishing exercises. This may include:
participation in awareness campaigns and simulated phishing exercises;
whether a simulated message was opened, clicked, or reported, and the time taken to do so;
training assignments, progress, and completion;
response timing and other interaction metrics;
calculated risk scores and risk-level classifications; and
behavioral signals derived from the above and from connected systems, used to assess and reduce human risk.
This data is Customer Data and is processed by Fraus as a Processor on the relevant Customer’s instructions. It is intended to help Customers measure and reduce human cyber risk across their organization. Fraus makes this data available to the Customer; the Customer determines how it is used within its own organization.
AI and Automated Analysis
The Service uses artificial intelligence and other automated logic as a core part of its functionality. Fraus may use such techniques to, among other things, classify and analyze messages and signals, generate adaptive simulations and recommendations, answer security and policy questions, calculate risk scores, and produce risk insights and reporting.
These automated outputs are designed to assist Customers and their security teams. Fraus does not make final employment, disciplinary, or other legally or similarly significant decisions about End Users. Any decision of that nature is made by the Customer, which is responsible for applying appropriate human review and oversight to outputs generated by the Service.
Where the Service applies automated remediation, policy enforcement, or adaptive access controls, it does so to execute the policies and configurations established by the Customer. The Customer defines those policies and remains the decision-maker; Fraus does not independently determine outcomes for individual End Users.
How We Use Personal Data
Where Fraus acts as a Controller, we use Personal Data for the following purposes:
to provide, operate, maintain, and secure the Service;
to create and administer Customer accounts and manage access;
to perform our contract with the Customer, including processing subscriptions, purchases, and payments;
to provide customer support and respond to requests and enquiries;
to monitor and improve the Service, including analyzing usage trends and the performance, security, and reliability of the Service;
to communicate with you about the Service, including service, security, technical, and administrative messages; and
to comply with our legal obligations and enforce our agreements.
Where required by applicable law, we rely on an appropriate lawful basis for each purpose, such as performance of a contract, our legitimate interests in operating and securing the Service, compliance with a legal obligation, or consent.
Where permitted by applicable law, we may send business contacts information about Fraus products, services, and events. You can opt out of these communications at any time using the unsubscribe mechanism provided or by contacting us. We do not share Personal Data with third parties for their own marketing purposes.
How We Share Personal Data
We do not sell Personal Data. We share Personal Data only in the following circumstances:
Subprocessors and service providers: with third parties that process data on our behalf to host, operate, support, and secure the Service, subject to appropriate contractual safeguards. See “Subprocessors” below.
Affiliates: with companies under common control with Fraus, where necessary to provide and support the Service and subject to this Privacy Policy.
Professional advisers and authorities: with auditors, lawyers, regulators, or public authorities where required to comply with law, legal process, or a lawful request, or to establish, exercise, or defend legal claims.
Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case Personal Data may be transferred subject to this Privacy Policy.
With consent or instruction: where you or the relevant Customer has instructed or consented to the disclosure.
Subprocessors
Fraus engages a limited number of Subprocessors to help deliver the Service. These fall into categories such as cloud hosting and infrastructure, email and message delivery, product analytics, customer support tooling, artificial-intelligence and machine-learning providers, and logging, monitoring, and security providers.
Our Subprocessors may change over time. A current list of the Subprocessors we use, including their categories and locations, is available to Customers on request.
Data Processing Agreement
For Customers, Fraus processes Customer Data as a Processor on behalf of the Customer in accordance with a Data Processing Agreement (DPA) that forms part of the Customer agreement, together with this Privacy Policy. The DPA sets out the parties’ data protection obligations, including in relation to Subprocessors, security, assistance with data subject requests, international transfers, and the handling of Customer Data on termination. Where this Privacy Policy and the DPA conflict in respect of Customer Data, the DPA prevails. Customers can request a copy of our DPA by contacting us at info@fraus.ai.
Security Measures
Fraus implements risk-based technical and organizational measures designed to protect Personal Data appropriate to the nature of the data and the risks involved. At a high level, these measures include:
Encryption of data in transit and at rest;
Access controls based on the principle of least privilege, including authentication and role-based access;
Logging and monitoring of access to, and activity within, the Service;
Tenant separation, so that each Customer’s data is logically segregated from that of other Customers;
Backups and recovery processes;
Vulnerability management, including patching and periodic testing; and
Incident response procedures to detect, assess, and respond to security incidents.
No method of transmission over the Internet or method of electronic storage is completely secure. While we work to protect Personal Data using appropriate measures, we cannot guarantee its absolute security. Any specific security commitments applicable to Customer Data are set out in the agreement between Fraus and the Customer.
Security Incidents
If Fraus becomes aware of a confirmed Security Incident affecting Customer Data, Fraus will notify the affected Customer without undue delay and will provide information reasonably available to it to help the Customer meet its own notification obligations. Further details of Fraus’s incident-handling and notification commitments are set out in the Data Processing Agreement. A “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Data processed by Fraus.
International Transfers and Data Residency
The Service is operated from, and Customer Data is hosted in, data-center regions selected by Fraus. Fraus’s default hosting region is the United Arab Emirates. Where offered, Customers — particularly enterprise Customers in the UAE and wider GCC — may be able to select a specific hosting region for their Customer Data, and Fraus also supports sovereign and on-premise deployment options where required.
Where Personal Data is transferred across borders, including to a country whose data protection laws differ from those of your jurisdiction, Fraus applies appropriate safeguards as required by applicable law. Details of the hosting region and any available data residency options for a particular Customer are set out in the applicable Customer agreement.
Data Retention
We retain Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy, and no longer than required.
For Customer Data, retention is determined by the applicable Customer agreement and by the Customer’s documented instructions. During the term of the Customer’s subscription, Fraus retains Customer Data as needed to provide the Service. On termination or expiry, Fraus returns or deletes Customer Data in accordance with the applicable Customer agreement and the Customer’s instructions, subject to any residual copies retained in routine backups for a limited period consistent with our backup schedule and to any retention required by law.
For Personal Data that Fraus holds as a Controller, retention periods are determined by reference to factors including the duration of the Customer relationship, contractual requirements, security and fraud-prevention needs, the establishment, exercise, or defense of legal claims, and applicable legal, accounting, and regulatory obligations. Where these factors no longer require retention, we delete, anonymize, or aggregate the data. Residual copies may remain in secure backups for a limited period consistent with our backup schedule and are restored only where necessary for security, disaster recovery, or legal compliance.
Your Rights and Requests
Depending on applicable law, individuals may have rights in relation to their Personal Data, such as the rights to access, correct, delete, restrict, or object to processing, or to data portability.
If you are an End User, these rights are generally exercised through your organization (the Customer), which acts as Controller for your Personal Data within the Service. Fraus will provide reasonable assistance to enable the Customer to respond to such requests.
If Fraus is the Controller of your Personal Data — for example, if you are a business contact of ours — you may exercise your rights by contacting us at info@fraus.ai. We may need to verify your identity, and we may retain certain information where we have a legal obligation or lawful basis to do so.
Cookies and Tracking Technologies
The Service uses Cookies and similar technologies (such as tags and scripts) to operate the Service, authenticate users, remember preferences, and analyze how the Service is used. Cookies may be “session” cookies, which are deleted when you close your browser, or “persistent” cookies, which remain until they expire or are deleted.
Where required by applicable law, we use non-essential cookies (such as analytics cookies) only with consent. You can manage non-essential cookies through your browser or device settings and, where a consent mechanism is made available, through that mechanism. Restricting cookies may affect the availability of some features.
Links to Other Websites
The Service may contain links to third-party websites or services that are not operated by Fraus. We are not responsible for the content or privacy practices of those third parties, and we encourage you to review their privacy policies.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and post the updated Privacy Policy. Where a change is material and we are required, or consider it appropriate, to do so, we will provide additional notice, which may include notifying the relevant Customer. We encourage you to review this Privacy Policy periodically.
Data Protection Contact
Where required by applicable law, Fraus appoints or designates a data protection officer or contact responsible for overseeing compliance with this Privacy Policy and applicable data protection law. You can reach our data protection contact using the details in the “Contact Us” section below.
Contact Us
If you have any questions about this Privacy Policy, you can contact us:
.svg)
.svg)
.svg)
.svg)
.svg)
