FCTR ID LLC ("Fctr," "we," "our," or "us") provides a hosted identity-operations platform for helpdesk, IT support and organizational identity verification, including Fctr Mobile. This Privacy Policy applies to visits to fctr.io and related public web pages, direct communications and other business operations, and personal information Fctr processes in connection with the Fctr Identity Platform and related services that Fctr hosts, operates, or maintains under an applicable customer agreement (collectively, the "Platform Services"). For customer-controlled personal data processed through the Platform Services, the customer generally acts as the business or controller and Fctr acts as its service provider or processor under the applicable agreement.
1. Scope
The website and business-operations portions of this policy apply when you visit any fctr.io page (including pages describing Tako AI Agent for Okta or Tako MCP), request information, submit a security report, or otherwise communicate with Fctr. The customer-product portions apply only to the Platform Services.
This policy does not describe processing that occurs inside Tako AI Agent for Okta, Tako MCP, or another separately licensed Fctr GitHub project deployed, operated, or managed in a customer- or third-party-controlled environment, including on-premises systems, workstations, container infrastructure, or customer-selected cloud accounts. Publishing such software does not, by itself, give Fctr access to or control over data processed in that deployment. The deployer controls its configuration and selected identity, AI, hosting, logging, and other providers. Information intentionally sent to Fctr for support, security reporting, or another business interaction is covered by this policy. A separate executed agreement controls if Fctr expressly agrees to host or manage a deployment.
This policy also does not govern the independent privacy practices of Microsoft, Okta, an employer, an AI provider, a hosting provider, or another third party that determines how it processes personal data.
2. Information we collect
Information you provide
- Business contact information, such as your name, work email address, organization, and the content of an inquiry.
- Account, onboarding, support, contracting, and billing information provided by an authorized customer representative.
- Security reports and related communications you submit to us.
Website and service information
- Basic request and device information made available by browsers and hosting services, such as IP address, timestamp, requested page, referring website, campaign parameters included in a link, browser type, and error information.
- Service usage and operational metadata needed to authenticate users, secure sessions, troubleshoot the service, prevent abuse, and maintain auditability.
Customer-controlled product data
Depending on customer configuration and the active workflow, Fctr may process workforce identifiers, directory attributes, account status, group or device context, enrolled factor metadata, verification results, and support-action records obtained from connected identity services.
3. How we use information
We use information to:
- provide, secure, operate, and support the website and Fctr Identity Platform;
- authenticate authorized users and maintain protected sessions;
- retrieve identity context, perform customer-directed verification, and execute authorized support workflows;
- create privacy-reviewed operational and audit records;
- respond to demo requests, support questions, security reports, and contractual inquiries;
- detect abuse, investigate errors, and improve service reliability; and
- meet legal, accounting, and contractual obligations.
We do not sell personal data or use product data for third-party advertising.
4. Product data handling
The Fctr verification product retrieves workforce identity context from customer-connected services for authorized workflows rather than maintaining a replicated workforce directory or shadow workforce identity profile. Limited protected session state, opaque workflow references, provider configuration, delivery status, security events, PII-minimized audit metadata, and pseudonymous identifiers may be retained for defined service, security, support, and audit purposes. Personal and recovery contact details are excluded from approved audit records; organization-issued email addresses and UPNs are masked when used as human-readable audit labels.
Credentials and secrets are excluded from approved logs. Fctr's logging and audit policy excludes provider access tokens, authorization headers, raw cookies, session identifiers, OTP values, generated recovery credentials, and identity documents.
These limited records support service delivery, security, and auditability without creating a replicated workforce directory. Microsoft Entra Verified ID workflows may also require time-limited transaction and callback state.
Separately, Fctr's business systems retain limited account, customer-contact, contracting, billing, support, security-reporting, and website information needed to operate the company. Those business records are not part of the workforce verification product.
Fctr Mobile
Fctr Mobile uses your existing account at a participating organization to enroll a device and request or respond to identity verification. Access includes guests authorized by that organization. We process the identity information needed for these functions, device registration and security information, verification activity, and related service and security records. Relevant participant information and results are available to authorized participants and your organization. We use your organization's configured sign-in service and our service providers to operate these functions.
Your device handles fingerprint, face or permitted PIN or passcode authentication. Fctr does not receive your biometric images or templates, device PIN or passcode.
Removing this device revokes its Fctr Mobile registration and clears its local enrollment after confirmation. Your organizational account remains unchanged. Necessary organizational and security records follow the retention rules in this policy.
SMS and email verification delivery
When a customer enables SMS or email delivery, Fctr and the configured delivery provider may process the destination, message status, and verification metadata necessary to deliver a transactional security message. This information is not used for promotional messaging.
6. Service providers & connected services
We engage providers only for functions needed to operate, secure, communicate about, or support the service. Current service categories may include:
| Provider or category | Purpose | When used |
|---|---|---|
| Google Cloud | Product hosting, managed data services, logging, and infrastructure security | Standard product delivery |
| Cloudflare | Website delivery, security, bot protection, and processing demo requests | Public website and inquiry form |
| Mailjet | Fallback notification delivery for submitted demo requests | Website inquiry form when primary delivery is unavailable |
| HubSpot | Managing and responding to submitted business inquiries | Website inquiry form |
| Infobip or another configured delivery provider | Transactional SMS or email delivery for supported verification workflows | Only when enabled by the customer |
Microsoft Entra ID, Microsoft Entra Verified ID, Okta, and customer-selected support systems are connected services used at the customer's direction. Their own privacy terms may also apply. A current customer-specific subprocessor disclosure may be provided through the contracting or security-review process.
8. Retention
Fctr retains information only for as long as reasonably necessary for the purposes described in this policy, the applicable customer agreement, configured service operation, and legal or accounting obligations. Retention varies by record type and deployment. Transient workflow state is short-lived; operational and audit records follow configured or contractual schedules; financial and contracting records may be retained longer where required.
When retention ends, information is deleted, anonymized, or allowed to expire using the applicable service controls. Backup and managed-service deletion may complete over an additional limited period.
9. Your U.S. privacy rights
Depending on the U.S. state law that applies, you may have rights to request access to or a copy of personal information, correction, deletion, or portability; to opt out of sale, sharing, or targeted advertising; to receive equal service when exercising a privacy right; and to appeal certain decisions. Fctr does not sell personal information or use customer product data for targeted advertising.
Your organization controls your Fctr access and organizational verification data. For a request concerning data controlled by your employer or another Fctr customer, contact that organization or Fctr support at [email protected]. Fctr support will coordinate with the organization and assist as required by our agreement and applicable law. To submit a request concerning data Fctr controls, email [email protected]. We may need to verify your identity and authority before acting on a request.
10. Security
We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure. For more information about our product security model, see the Security page.
11. Processing locations
Fctr is based in the United States and the standard Fctr Identity Platform is offered as a U.S. SaaS service. Fctr and its contracted providers may process business and service information in the United States and in other locations where those providers operate, subject to the applicable agreement and U.S. law.
12. Changes to this policy
We may update this policy to reflect changes in our services, practices, or legal obligations. We will post the revised policy at this URL and update the date above. Material changes may also be communicated through the service or directly to affected customers when appropriate.