Request demo

Privacy Policy

This Privacy Policy (“Policy”) explains how Fragment Data Technologies, Inc. (“Fragment,” “we,” “our,” or “us”) collects, uses, and discloses information when you use our platform, including related websites, applications, software, and services (collectively, the “Services”).

Fragment believes that the privacy of its users is paramount and strives to use Personal Information (as defined below) only in ways outlined in this Policy. The Policy is incorporated by reference into our Terms of Service, available at https://fragment.ai/terms. By using the Services, you hereby warrant and represent that you have read, understand and agree to this Privacy Policy and the Terms of Service and that you are over 18 years of age. PLEASE DO NOT USE, INSTALL OR ACCESS THE SERVICES IF YOU DO NOT AGREE TO THIS PRIVACY POLICY.

1. Scope; Roles; Definitions

  • Scope. This Policy applies to information we process in connection with the Services, including our web properties and customer dashboard.
  • Controller vs. Processor/Service Provider.
    • Customer Data. To the extent Fragment processes personal information on behalf of a customer that has entered into a separate agreement with Fragment (e.g., data ingested from customer systems such as ERPs/CRMs/databases/cloud drives), the customer is the controller/business, and Fragment acts as the customer’s processor/service provider. The parties’ data processing is additionally governed by a Data Processing Addendum (DPA) (available on request or as provided by agreement).
    • Site/Account/Support/Marketing Data. For personal information we collect for our own purposes (e.g., account registration, billing, product analytics, security logs, marketing), Fragment is the controller/business.
  • Personal Information. “Personal Information” (or “Personal Data”) means information that identifies or relates to an identifiable individual. “De-identified” and “Aggregated” data are not Personal Information.

2. Notice at Collection (CCPA/CPRA); Categories, Sources, Retention

We collect the following categories of Personal Information from the sources and for the purposes described in this Policy. We retain Personal Information for the periods described in Section 11 (Data Retention).

  • Identifiers & Contact Data: name, email, company, title, billing address, phone number, account IDs.
  • Commercial Information: subscription tier, transaction records, limited (non-PCI) payment metadata.
  • Internet/Network Activity: device and browser type, IP address, cookie/SDK identifiers, pages viewed, referring/exit pages, timestamps, diagnostic logs, crash data, interactions with product features.
  • Professional/Employment Information: company, role, and (if provided) resume/application details.
  • Inferences: service usage inferences to personalize or improve features.
  • Customer-Provided Content & Connected-Source Data: queries, uploads, prompts, schemas/metadata, and data made available via integrations (e.g., databases, warehouses, cloud drives, ERPs/CRMs, ticketing/identity systems) as authorized by the customer.
  • Sensitive Personal Information (if any). We do not seek to collect SPI in providing the Services and request that customers avoid uploading it unless expressly permitted and subject to appropriate safeguards. If processed, it is solely as a processor/service provider and only as instructed by the customer.

Sources. We collect information directly from you, automatically from your devices/use of the Services, and from third parties (e.g., identity providers, integration partners, payment processors, and, for Customer Data, the systems you connect).

Sale/Sharing. Fragment does not “sell” Personal Information and does not “share” Personal Information for cross-context behavioral advertising as those terms are defined by the CCPA/CPRA.

3. Information You Provide

You may provide Personal Information when you: create or manage an account; request a demo; connect third-party data sources or authorize integrations; submit queries or upload content; communicate with support; participate in surveys; or apply for a role. You may choose not to provide certain information; however, this may limit your ability to use the Services.

4. Information Collected Automatically

We and our service providers automatically collect usage and device information (e.g., logs, IP address, user agent, pages and features used, timestamps, performance and diagnostic data) and use cookies/SDKs and similar technologies. See Section 10 (Cookies & Similar Technologies).

5. Customer Data from Connected Sources

When you connect external systems or repositories (e.g., databases, ERPs, CRMs, spreadsheets, cloud drives, or other business applications), we process the data you make available solely to provide the Services to you and in accordance with your configuration and instructions. Fragment acts as a processor/service provider for such Customer Data (see Section 1).

6. How We Use Personal Information

We use Personal Information for the purposes below and, where required by law (e.g., in the EEA/UK), rely on an appropriate legal basis to do so:

  • Provide and Operate the Services: authenticate users; ingest/transform/query connected data sources; deliver analytics, insights, and agent-based workflows; provide support and maintenance.
  • Improve and Develop the Services: monitor usage; fix bugs; enhance features and models; conduct analytics and product research using de-identified/aggregated data.
  • Security and Abuse Prevention: detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized access; protect the Services and users.
  • Billing and Account Management: process payments; manage subscriptions; communicate material service and policy updates.
  • Compliance and Enforcement: comply with applicable laws, regulatory requests, and lawful process; enforce agreements and Terms; protect rights, safety, and property.
  • Marketing and Communications: send product updates or promotional communications (you may opt out at any time).

Important AI/ML Clarification. Fragment may use artificial intelligence and machine learning technologies to process data solely to deliver and improve the Services for you (e.g., query understanding, analytics generation, agent orchestration). Fragment does not use Customer Data to train generalized or non-customer-specific AI models. We may use de-identified or aggregated information for research, benchmarking, and product improvement.

Automated Decision-Making. Fragment does not engage in solely automated decision-making that produces legal or similarly significant effects concerning individuals without appropriate human oversight or as otherwise permitted by law and contract.

7. Disclosure of Personal Information

We may disclose Personal Information as follows:

  • Service Providers / Processors: hosting; storage and backup; analytics; logging and monitoring; email and in-app communications; authentication; payment processing; and customer support.
  • Integration Partners (as authorized by you): systems you connect to the Services (e.g., data warehouses, cloud drives, ERPs/CRMs, ticketing, identity providers).
  • Corporate Transactions: to a subsequent owner, co-owner, or operator of the Services and their advisors in connection with a merger, acquisition, financing, corporate reorganization, bankruptcy, or similar transaction.
  • Legal and Safety: to comply with law or legal process (e.g., subpoena, court order), enforce our agreements, or protect the rights, property, or safety of Fragment, our customers, users, or the public.
  • Affiliates: within our corporate group for purposes consistent with this Policy.

We do not sell Personal Information and do not share Personal Information for cross-context behavioral advertising.

Subprocessors. We maintain a list of current subprocessors used for the provision of the Services (available by request or via a posted URL, if provided in your agreement). We conduct diligence and enter into appropriate data protection terms with each subprocessor.

8. Your Choices & Rights

Your rights depend on your location and the laws that apply to your use of the Services.

  • United States (General). You may have rights to access, correct, or delete certain Personal Information, and to opt out of marketing communications.
  • California (CCPA/CPRA). California residents have rights to know/access, correct, delete, and to be free from discrimination for exercising rights; and, where applicable, to limit use/disclosure of Sensitive Personal Information. Fragment does not sell or share Personal Information for cross-context behavioral advertising.
  • Other U.S. States (e.g., CO, CT, VA, UT). Residents may have similar rights, including opt-out of targeted advertising, sale, and profiling (not applicable to Fragment as described).
  • EEA/UK. If the GDPR/UK GDPR applies to your use of the Services, you may have rights to access, correct, delete, or port your Personal Data and to object to or restrict certain processing.

Verification & Authorized Agents. We may require reasonable verification of your identity. Authorized agents must provide proof of authorization, and we may require you to verify your identity directly.
Appeals. Where required by law (e.g., CO/VA/CT), you may appeal our decision by replying to our response and stating “Appeal.” We will respond within the applicable timeframe.
Requests may be submitted to privacy@fragment.ai. We will acknowledge requests and respond within timelines required by applicable law (e.g., 45 days with possible extension where permitted).

9. International Data Transfers

Fragment is based in the United States and may process Personal Information in countries that may not provide the same level of protection as your jurisdiction. Where a cross-border transfer mechanism is required by applicable law, we will use an appropriate safeguard (for example, the EU Standard Contractual Clauses and the UK Addendum/IDTA) or another legally recognized mechanism. Details may be set out in your agreement or DPA.

10. Cookies & Similar Technologies

We and our providers use cookies, SDKs, and similar technologies to operate and secure the Services, remember preferences, and perform analytics.

  • Types: strictly necessary; functional; analytics/performance.
  • Choices: You can manage cookies via your browser settings and, where provided, in-product controls. Disabling some cookies may impact Service functionality.
    Do Not Track. We do not respond to browser “Do Not Track” signals.

11. Data Retention

We retain Personal Information for as long as necessary to (i) provide and support the Services, (ii) comply with legal, accounting, or reporting requirements, (iii) resolve disputes, and (iv) enforce agreements. Retention periods vary by category and context (e.g., account data is retained for the life of the account plus a reasonable period; security logs for a shorter operational window). Where feasible, we will de-identify or aggregate data when retention is no longer necessary.

12. Security

We implement administrative, technical, and physical safeguards designed to protect Personal Information, including access controls, encryption in transit, logical segregation, monitoring, and backup policies. No security program is infallible, and we cannot guarantee absolute security. If we learn of a breach affecting Personal Information, we will notify affected parties and regulators as required by law.

13. Children’s Privacy

The Services are not directed to individuals under 13 (or the age of digital consent in your jurisdiction). We do not knowingly collect Personal Information from children. If you believe a child has provided Personal Information to us, contact privacy@fragmentdata.com and we will take appropriate action.

14. Third-Party Sites and Services

The Services may contain links to or integrations with third-party sites or services. We are not responsible for the privacy practices of those third parties. Your use of third-party services is governed by their terms and policies.

15. Google API Services — Limited Use

If you connect Google services (e.g., Google Drive), Fragment’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace data to develop, improve, or train generalized/non-personalized AI or ML models.

16. Changes to this Policy

We may update this Policy from time to time. The “Last Updated” date will reflect the most recent changes. Material updates may be communicated via the Services or email. Your continued use of the Services after the effective date of an updated Policy constitutes your acceptance.

17. Contact Us

Fragment Data Technologies, Inc.
Email: privacy@fragment.ai (privacy requests)
Email: support@fragment.ai (support)
If you are in the EEA/UK, you may have the right to lodge a complaint with your local supervisory authority.

18. State-Specific Disclosures (U.S.)

This section supplements the Policy for residents of California and other states with comprehensive privacy laws.

California (CCPA/CPRA). In the preceding 12 months, we collected the categories listed in Section 2 for the business purposes described in Sections 6–7. We did not sell Personal Information and did not share Personal Information for cross-context behavioral advertising. We disclosed Personal Information to service providers/processors, integration partners as authorized by customers, affiliates, and as required by law. We honor rights to know/access, correction, deletion, and limit use/disclosure of Sensitive Personal Information (if applicable), subject to verification and exceptions. Methods to submit requests and timelines are described in Section 8. We do not discriminate for exercising rights. “Shine the Light” (Cal. Civ. Code §1798.83): we do not share personal information with third parties for their direct marketing purposes.

Colorado/Connecticut/Virginia/Utah, etc. We do not sell Personal Information or engage in targeted advertising as defined by those laws. You may submit rights requests and appeals as described in Section 8.

19. Additional Processor Commitments (Customer Data)

For Customer Data, Fragment:

  • Processes data only on the documented instructions of the customer;
  • Implements appropriate technical and organizational measures;
  • Ensures personnel confidentiality;
  • Engages subprocessors under written terms with data-protection obligations;
  • Assists the customer with data subject requests and security incident notifications;
  • Upon termination, deletes or returns Customer Data as directed, subject to legal retention requirements; and
  • Makes available information necessary to demonstrate compliance and supports audits as set forth in the DPA.