This Privacy Notice describes how FalconStor Software, Inc. ("FalconStor", "we", "us") collects, uses, and shares information when you access or use the FalconStor Partner Portal at partners.falconstor.com (the "Portal"). This Notice should be read alongside any other privacy notice that FalconStor publishes for non-Portal interactions; for privacy questions about FalconStor's marketing website and other non-Portal contexts, contact privacy@falconstor.com.
If you are an authorized representative of a FalconStor partner ("Partner"), this Notice applies to you. If you submit information about other individuals (for example, your end customers) through the Portal, separate rules apply to that data; see Section 5.
1. Who we are and how to contact us
The data controller for personal data processed under this Notice is FalconStor Software, Inc., a Delaware corporation with its registered office at 111 Congress Ave, Suite 500, Austin, TX 78701, USA.
For privacy questions about the Portal, exercising your rights, or any complaint, contact us at legal@falconstor.com.
2. Scope
This Notice covers personal data processed in connection with:
- Account creation, authentication, and account-management
- Use of Portal features and any optional features we make available to your organization or to individual users
- AI-assisted features that rely on third-party providers
- Public-facing surfaces you operate through the Portal, including prospect-facing landing pages and customer-facing shareable links
- Support requests, error reports, and operational logs
It does not cover personal data we process under a signed Partner Agreement or Data Processing Addendum, which control where they apply.
3. Information we collect
Account and profile information. Name, business email, company, role, password (hashed), and login activity (timestamps, login count, and short-lived email-verification and password-reset tokens). Our login, signup, and password-reset pages use third-party services that evaluate sign-in and registration requests and verify details supplied at sign-up; those services receive browser signals from your device and the details you enter.
Partner-submitted business data. Business content you submit through the Portal, including text and form inputs about your pipeline, accounts, and partner activity; uploaded files, documents, and attachments; audio recordings of customer calls where you choose to submit them for transcription; content you publish for prospects or customers through the Portal; and any prompts and inputs you send to AI features. This data is often not personal data but may include personal data about your colleagues, your customers' employees, or other individuals if you choose to submit it.
End-customer data. Where you enter customer contact information, organization details, technical environment information, or attach documents about your customers, FalconStor processes that data on your behalf; see Section 5. Where you provide your customers with a share link to participate directly, your customers' submissions through that link are persisted under your control as the partner.
Information we compile about third parties. Some Portal features compile publicly available business information about the organizations in your pipeline. That information may include information about identifiable individuals associated with those organizations, such as their role, their publicly reported professional activity, and publicly reported changes at their organization; see Section 5.
Usage and activity data. Pages visited, features used, timestamps, audit-trail records of significant actions (who acted, when, on what, and the outcome), file-upload metadata (including IP address and user agent associated with the upload), diagnostic error logs (which may include diagnostic context about a failing request, including personal data you submitted just before the error), and security-relevant events. These operational and diagnostic records may include the content of requests and submissions (the text submitted and the parameters of the actions taken) and not only metadata about them, including submissions made by individuals who are not Portal account holders through pages and links you publish.
Cookies and similar technologies. The Portal sets first-party cookies for authentication and session management, including a persistent authentication cookie (up to seven days) where you choose to remain signed in, and a passcode cookie set on your customer's browser when they use a partner-shared link. The Portal also stores limited user-interface state and unsaved draft content in your browser's local storage. Third-party analytics, session-recording, and performance-monitoring technologies also operate on Portal pages, including the sign-in pages, and on the public-facing surfaces you operate through the Portal, whose visitors are not Portal account holders; those technologies set their own identifiers and record how those pages are used. See our Cookie Policy.
4. How we use this information
We process the data above to:
- Operate the Portal, authenticate you, and provide the features you request
- Run AI-assisted features (which may include content generation, summarization, classification, search, transcription of audio inputs, document analysis, research and enrichment of opportunity and account context, and assistance with workflows such as suggested actions, recommendations, and drafting reusable documents)
- Detect, prevent, and investigate security incidents and abuse
- Provide support, communicate with you about your account, and notify you of material changes
- Notify FalconStor staff of material partner activity through our internal collaboration systems
- Comply with legal obligations and enforce our agreements
- Improve the Portal (for example, by analyzing usage patterns; we do not use partner activity for advertising and we do not make solely automated decisions that produce legal or similarly significant effects concerning you)
5. Partner-submitted end-customer data: controller / processor split
When you submit data about your end customers through the Portal (for example, customer contact details, organization or technical-environment information, questionnaire responses, or documents about your customers), you (as Partner) are the data controller for that personal data and FalconStor acts as a data processor for the portion of that data we store and surface back to you within the Portal, acting on your documented instructions through the Portal.
We also act as controller for certain operational uses of partner- and account-related data, including: replicating partner and account content into our own customer-relationship-management system as part of our sales-pipeline operations; processing prospect-form submissions through our marketing-automation system when you publish a prospect-facing landing page; and provisioning partner-user accounts in our learning-management system when you access training. We process this data on the basis of our legitimate interests in operating our partner program and the contract between our organizations.
Separately from the data you submit, some Portal features compile publicly available business information about the organizations in your pipeline, which may include information about identifiable individuals associated with those organizations. FalconStor determines the purposes and means of that compilation and therefore acts as controller for it, not as your processor. Compiled information is stored against the relevant Portal record, and is visible to colleagues in your organization whose access reaches that record and to FalconStor staff.
Where you use Portal features that collect personal data directly from your end customers or prospects (for example, prospect-facing landing pages, or customer-facing shareable links), you are responsible for providing those individuals with any notices and obtaining any consents required of you under applicable law, including informing them that their submissions will be processed by FalconStor and our sub-processors in support of your relationship with them.
You are responsible for:
- Having a lawful basis to submit that data to FalconStor
- Providing any required notice to the individuals concerned (including those individuals who interact with the Portal directly through links you share)
- Honoring data-subject requests directed at you
FalconStor will:
- Process the data only to provide the Portal features you use and the operational purposes described above
- Not sell or share that data for advertising
- Apply contractual safeguards with the sub-processors referenced in Section 7
- Cooperate, at your reasonable request, with data-subject requests and audits, subject to the master Partner Agreement and any Data Processing Addendum signed with you
6. Legal bases for processing (EEA and UK)
If you are in the EEA or the UK, we rely on the following legal bases under the GDPR and UK GDPR:
| Purpose | Legal basis |
|---|---|
| Provide the Portal under the Partner Agreement | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, abuse detection | Legitimate interests (Art. 6(1)(f)) |
| AI features that process your inputs | Performance of a contract / legitimate interests |
| Service announcements | Legitimate interests |
| Compliance with applicable law | Legal obligation (Art. 6(1)(c)) |
| Features we make available to your organization or to individual users | Consent, where required (Art. 6(1)(a)) |
You may withdraw any consent at any time without affecting prior processing.
7. Sub-processors
We engage third-party sub-processors to host the Portal, provide AI and machine-learning features, deliver transactional email, run our customer-relationship-management and marketing-automation systems, operate our partner-training platform, monitor performance and security, serve content from global content-delivery networks, and support our internal collaboration and document workflows. Sub-processor categories include:
- Cloud hosting and infrastructure
- AI, machine-learning, and speech-to-text providers
- Customer-relationship-management and marketing-automation systems
- Transactional email
- Bot-detection, sign-up verification, and security services
- Analytics, session-recording, performance-monitoring, and operational telemetry services, which operate both on Portal pages and on the public-facing surfaces you operate through the Portal
- Content-delivery and font-hosting networks
- A learning-management platform
- Internal collaboration and messaging platforms
- Productivity, document, and spreadsheet services
- Third-party content and business-information sources
Our sub-processors are primarily located in the United States. Some sub-processors process data in other regions (for example, some vendors process data in the European Union, and certain AI, content-delivery, and observability vendors operate global infrastructure). Where personal data is transferred from the EEA, UK, or Switzerland to the United States or to other regions, we rely on appropriate transfer mechanisms, including the EU Standard Contractual Clauses and equivalent UK and Swiss frameworks.
Each sub-processor is bound by written agreements that restrict their use of personal data to the purposes for which we engage them. A current list of named sub-processors, their purposes, and processing regions is available upon request to legal@falconstor.com.
8. AI processing disclosure
When you use AI-assisted features of the Portal, the content you provide, which may include text prompts, uploaded files, and audio recordings, is processed by third-party AI providers, together with the business records that the relevant feature draws on. Those records may include contact details and correspondence about your customers, and are sent whether or not you enter them into the feature yourself. Some of this processing runs automatically as part of normal operation, for example when a record is opened or updated, rather than only when you ask for it. Some features also draw on internal knowledge-base material, public-web search, URL-fetching, and other research and verification tools to retrieve grounding context for AI outputs. AI providers may operate from the United States or from other regions of their global infrastructure.
Provider terms differ; in some cases providers may use submitted content to improve their services under their applicable terms. The list of AI providers in current use is available on request to legal@falconstor.com.
Do not place in the Portal any data that you are not contractually permitted to share with third-party AI providers, because Portal content may be processed by AI-assisted features whether or not you invoke them. Treat AI outputs as drafts that require your review before use; AI outputs can be inaccurate, incomplete, biased, or fabricated.
9. Sharing and disclosure
We disclose personal data only:
- To the sub-processors referenced in Section 7, for the purposes shown
- To our auditors, advisors, and insurers, under confidentiality
- To FalconStor internal teams (for example, sales, partner-success, and engineering staff) for operational purposes connected with our partner relationship
- To comply with a binding legal request (court order, subpoena, regulatory demand)
- In connection with a merger, acquisition, financing, reorganization, or asset sale, in which case successor entities will be bound by this Notice or a comparable one
- With your direction or consent
We do not sell personal data and we do not "share" personal data for cross-context behavioral advertising as those terms are defined under California law.
10. International transfers
The Portal application is operated from the United States. Some of the sub-processors described in Section 7 may process data from other regions of their global infrastructure. If you access the Portal from the EEA, the UK, Switzerland, or another jurisdiction with cross-border-transfer rules, your personal data may be transferred to the United States and to our sub-processors' locations. For transfers from the EEA, UK, and Switzerland, we rely on appropriate transfer mechanisms, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (IDTA) or equivalent.
11. Retention
We keep personal data only as long as needed for the purposes described in this Notice and for the duration of your organization's Partner Agreement with FalconStor, plus any period required to meet our legal, accounting, audit, or dispute-resolution obligations. Aggregated or de-identified data that no longer identifies you may be retained indefinitely.
Some categories of data are pruned on a scheduled basis (for example, and without limitation, inactive chat sessions, expired authentication tokens, certain operational logs, and certain orphaned records). Other categories (including, without limitation, your account record, active business records you maintain in the Portal, content you publish through the Portal, knowledge-base content you contribute, and AI-generated artifacts associated with your account) are retained for the duration of your organization's Partner Agreement and are not pruned automatically.
If a legal hold or regulatory requirement applies, we may retain longer.
12. Security
We protect personal data with administrative, technical, and physical safeguards proportionate to the risk, taking into account the nature of the data and the way the Portal is used. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.
13. Your rights in the EEA and UK (GDPR / UK GDPR)
If you are in the EEA or the UK, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data, subject to legal-retention exceptions and the operational limits described below
- Restrict or object to certain processing
- Port data you provided to us, in a structured machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your supervisory authority (you can also raise concerns with us first)
To exercise any of these rights, email legal@falconstor.com. We will acknowledge your request within ten business days and respond substantively within one month (extendable by two further months for complex requests, with notice).
Fulfilling some requests (particularly erasure and portability requests that touch data we have replicated to our customer-relationship-management or learning-management systems, content you authored within shared Portal records (such as notes, comments, and questionnaire responses), file attachments stored in cloud object storage, copies held in search and indexing services, records generated by the Portal in association with a business record, or AI provider logs) may require coordinated action across multiple systems and we will explain any limits in our response. Where erasure cannot reach a downstream record without breaking a regulatory or contractual obligation that overrides your erasure right, we will tell you which records are affected and why.
14. Your rights in California (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, the categories of sources and recipients, and the purposes
- Delete personal information we collect from you, subject to exceptions and the operational limits described in Section 13
- Correct inaccurate personal information
- Opt out of sale or sharing for cross-context behavioral advertising: we do not sell or share for behavioral advertising
- Limit use of sensitive personal information: we do not use sensitive personal information for purposes that require this right under the CPRA
- Non-discrimination: we will not deny service, charge a different price, or provide a different level of service for exercising your rights
Categories of personal information collected over the past 12 months: identifiers, professional/employment information, commercial information, internet/network activity, audio information (only where you submit audio recordings to the Portal), and inferences drawn from the foregoing. Account credentials are the only category of sensitive personal information we collect, and we collect them solely to authenticate you and secure your account; we do not collect biometric information or precise geolocation, and we do not use sensitive personal information for purposes that would give you the right to limit its use under the CPRA. Where you submit short audio recordings to the Portal (for example, recordings of customer calls), audio is processed by third-party AI providers in transit to extract text and structured fields, is not retained by FalconStor after extraction, and is not used to build voice templates or for identification.
To exercise these rights, email legal@falconstor.com. You may also designate an authorized agent.
15. Children
The Portal is intended for business users acting on behalf of a partner organization. It is not directed at, and we do not knowingly collect personal data from, children under 16.
16. Changes to this Notice
We may update this Notice from time to time. We will post the new "Last updated" date at the top, and for material changes we will take reasonable steps to bring the change to your attention. Continued use of the Portal after the "Last updated" date constitutes acceptance.
17. Contact
Privacy questions and rights requests (Portal): legal@falconstor.com
Privacy questions about other FalconStor interactions: privacy@falconstor.com
General partner contact: partners@falconstor.com
FalconStor Software, Inc.
111 Congress Ave, Suite 500
Austin, TX 78701, USA