Compliance Overview
Effective 2026-10-14 · Last updated 2026-09-13
This page summarizes the laws, standards, and partner programs that shape how Fratelli Platform Inc. builds and operates the Service, and what each means for you as a customer. It is a plain-language map; the binding commitments are in the Terms of Service, Privacy Policy, and Data Processing Addendum.
1. Data Protection & Privacy
| Framework | Applies to | How we comply |
|---|---|---|
| GDPR (EU) / UK GDPR / Swiss FADP | Customers and data subjects in the EEA, UK, Switzerland | Processor DPA with Standard Contractual Clauses and UK Addendum; data-subject request tooling; 72-hour breach notification; sub-processor notice with objection right; records of processing |
| CCPA / CPRA (California) | California residents | Service-provider terms; no sale or sharing of personal information; right to know, delete, correct; Global Privacy Control honored |
| Other U.S. state privacy laws (VA, CO, CT, TX, OR, and others) | Residents of those states | Access, correction, deletion, portability, and appeal process |
| Google API Services User Data Policy (Limited Use) | Gmail and Google sign-in integrations | Data used only to provide user-facing features; never for ads, never sold, never used to train models; annual verification |
2. Payments & Financial
| Framework | How we comply |
|---|---|
| PCI DSS | Card data is collected and stored exclusively by Stripe (PCI DSS Level 1). Fratelli uses Stripe-hosted payment fields, so card numbers never touch our systems; we store only brand and last four digits (SAQ-A scope). |
| KYC / AML (Bank Secrecy Act, EU AMLD) | Identity and business verification for payment acceptance is performed by Stripe under its regulatory licenses. We display verification status and requirements but never hold identity documents. |
| Card network rules (Visa, Mastercard, Amex, Discover) | Dispute-rate monitoring against network thresholds; restricted-business screening; statement-descriptor controls; ability to pause acceptance when required by a network. |
| Tax reporting (IRS Form 1099-K and equivalents) | Issued by Stripe as the payment settlement entity where thresholds are met. Fratelli's own invoices to you include applicable sales tax/VAT. |
| OFAC & export controls | We do not provide the Service to sanctioned persons or territories; accounts may be screened and suspended to comply. |
3. Communications
- CAN-SPAM (US), CASL (Canada), PECR (UK): one-click unsubscribe and a preference center on all marketing email; physical address in footers; unsubscribe requests honored within 10 days. Customers sending through Fratelli must meet the same standards under our Acceptable Use Policy.
- TCPA: SMS features require prior express consent from recipients and support STOP keywords.
4. Security Standards
- Infrastructure runs on Google Cloud, which holds SOC 1/2/3, ISO/IEC 27001, 27017, 27018, and PCI DSS attestations (available through Google's Compliance Reports Manager).
- Fratelli's own controls are aligned to the SOC 2 Trust Services Criteria (security, availability, confidentiality); see our Security Policy. A formal SOC 2 Type II report is on our roadmap; enterprise customers can request our security questionnaire responses at security@fratelli-app.com.
5. Accessibility
We aim for WCAG 2.1 Level AA across the web app and public sites. See our Accessibility Statement.
6. Employment, Payroll & Tax Tools
Payroll and HR features help you organize data; they do not make Fratelli an employer of record, payroll service bureau, or tax preparer. Compliance with federal, state, and local wage-and-hour, withholding, and filing obligations remains with you (see Terms §10). Sensitive identifiers such as SSNs are stored with last-four-only display and encrypted at rest.
7. Sub-processors & Data Location
Data is hosted in Google Cloud regions in the United States. The current list of sub-processors, their roles, and locations is maintained in the Sub-processor List, with 30 days' notice before changes.
8. Requests, Audits & Questions
- Privacy and data-subject requests: privacy@fratelli-app.com
- Security questionnaires, penetration-test summaries, and DPA signature: security@fratelli-app.com
- Law-enforcement and legal process: legal@fratelli-app.com — we require valid legal process, notify customers where permitted, and publish aggregate request statistics on request.