1. Our principles
- Legal process, every time. We disclose user data only when the law requires it, and only what the request lawfully covers.
- Narrow requests. We ask for a request to be narrowed when it is broader than its legal basis, and we challenge requests that are unlawful.
- Notice to users. We tell users about requests for their data, so they can protect their rights, unless we are not allowed to.
- The customer first. When data belongs to a business customer, we ask the requester to go to that customer first.
These guidelines describe how we work today. They are not a promise about any particular case, and they give no one rights against Frazer.
2. What Frazer has, and what it does not
| Kind of data | Examples | What we hold |
|---|---|---|
| Account records | Name, email address, organization, account creation date, billing name, address and tax IDs, payment records | While the account exists, and billing records as accounting law requires |
| Access records | Sign-in times, IP addresses, devices, and the audit log of actions in an organization | Audit logs for 400 days; some logs for 30 days |
| Content | Repositories, files, databases, agent sessions, model prompts and outputs, messages, support cases | As the customer stores it, under the customer’s settings |
| Mail delivery records | Sender, recipients, times, delivery results of mail sent through Frazer | 30 days by default, longer only if the customer chose it |
What we do not have, or cannot reach:
- Data on servers customers bring. Those servers run in the customer’s own site. Frazer staff have no shell on them, and their data is not stored by Frazer.
- Bodies of mail Frazer has delivered, unless the customer chose to keep copies. A message body is kept only until it is delivered.
- Prompts and outputs of model requests, by default: the LLM gateway keeps request metadata, not bodies, unless the customer turned capture on.
- Card numbers, which our payment processor holds.
3. What we require, for US requests
| To get | We require |
|---|---|
| Basic account records: name, email address, billing address, account dates, payment method type, and the IP address used to sign up or at a stated time | A subpoena, or a court order or warrant |
| Other non-content records, such as IP address logs, audit logs and detailed access records | A court order under 18 U.S.C. 2703(d), or a search warrant |
| Content | A search warrant, issued on probable cause |
Under the Stored Communications Act we cannot give the contents of communications to private parties, such as litigants in a civil case, without the user’s consent. Civil subpoenas can reach basic account records only, and we tell the user first.
4. Requests from outside the United States
Frazer AI LLC is a US company. Foreign authorities should use a mutual legal assistance treaty, letters rogatory, or an agreement under the US CLOUD Act where one applies. We may answer an emergency request from a foreign authority directly, as section 6 describes.
5. Telling users
We notify the affected users of a request for their data, with a copy of the request, before we disclose anything, and give them at least 7 days to object or seek legal help where the request’s deadline allows. We do not notify when:
- a law or a court order forbids it, such as an order under 18 U.S.C. 2705(b);
- there is an emergency involving danger of death or serious physical injury;
- notice would be pointless, for example because the account is controlled by someone other than its owner.
When a prohibition on notice ends, we notify then. We may ask a court to lift an order that forbids notice if we believe it is not justified.
6. Emergencies
If you believe someone faces an immediate risk of death or serious physical injury, write to legal@frazer.ai with “Emergency” in the subject, describe the emergency, why the data you ask for would help, and how to reach you at once. US law lets us disclose data voluntarily in such a case (18 U.S.C. 2702(b)(8) and (c)(4)). We decide case by case, and we may ask for legal process afterwards.
7. Preservation
We preserve a snapshot of an account’s records for 90 days when we receive a valid request under 18 U.S.C. 2703(f), and for 90 more days when the request is renewed. Preserving data is not disclosing it: we disclose only with legal process.
8. How to send a request
Send it by email to legal@frazer.ai. Formal service of process on Frazer AI LLC goes to its registered agent in Florida, listed with the Florida Division of Corporations. We accept requests by email without waiving any objection, including to jurisdiction or to the manner of service.
Please include:
- the requesting agency or party, the officer or lawyer, and how to reach them;
- the legal process and its authority, as an attached copy;
- the exact accounts, organizations, repositories or URLs, and the time period;
- the data requested, as narrowly as you can;
- any order that forbids notice to the user;
- the deadline, and why it is needed.
9. Costs
We may ask for reimbursement of our reasonable costs of answering, as 18 U.S.C. 2706 allows, and we may waive it in emergencies or cases involving harm to children.
10. Requests to remove content
A government that believes content on Frazer breaks its law can write to legal@frazer.ai with the content, the law and the reason. We remove content that breaks our Acceptable Use Policy or the law that applies to Frazer. Otherwise we tell the user about the request, unless we are not allowed to, and we may decline it. Copyright claims follow the Copyright and DMCA Policy.
11. Transparency
Every year we publish how many requests for user data and for removal we received, by kind and by country, and how we answered them.
12. What we have never done
- We have never given any government a way into Frazer’s systems, or installed its software or equipment in them.
- We have never handed over our encryption or signing keys.
- We have never changed a customer’s code or data at the request of an authority.
- We have never weakened a security control to make data easier to obtain.
If one of these statements stops being true, we remove it from this page.