F-Secure TrustPath Privacy Notice

September 2026

In brief

In this notice, TrustPath refers to the browser extension and Gmail integration provided by F-Secure to assist you in your online shopping journeys and detecting scams.

To summarize privacy in this service:

• we read your shopping-related emails and pages you browse for shopping-related activities, so that we can warn you about scams and assist you in your shopping journeys;
• we use artificial intelligence to make sense of what we collect, including deciding whether to warn you or block something, but you always make the final decision;
• you can separately choose to let us use your data to improve our AI models: this is only done with your separate consent and never applies to anything we get directly from Gmail.

What do we collect and why?

General

This section describes what TrustPath collects and why. Much of the data we collect is collected directly from you or your device, and where this is not the case, we have clarified the source of the data.

Account and device data. When you sign up, we collect your user ID, login email, account status, profile fields, and passkey credential data. When you activate the extension on a device, we register a device ID, platform and OS, IP address, activation and last-active timestamps, and a device count against your subscription limit. We use this to authenticate you, manage your licence and devices, and provide support.

Email data. With your permission, TrustPath connects to your Gmail account through a read-only connection. We look at sender name and address, subject lines, and, in order to extract the details below, message bodies and attachments.

We do not store the body text or attachments themselves: only the extracted, shopping-relevant details (such as a merchant name or an order reference) are kept. We use this to fill in your shopping journey, analyze it and detect harms such as scam.

Browsing and web activity. With your permission, the extension reviews the pages you visit: the full URL, the page content of shopping sites, the region where you are shopping, our assessment of how trustworthy the domain is, and our reasoning for that assessment.

On commerce-relevant pages, it also extracts details like the product, price, seller, delivery terms, reviews posted by other shoppers and the applicable terms of service or privacy policy, along with the choices you make among what a site offers you, for example, which payment or delivery option you pick. We also read signals like whether you appear to be logged in to a retailer account and any loyalty tier that's visible on the page. We remove any personal identifiers (such as names, any visible payment type information) from this data, but as remaining data is still connected to you so that we can warn you about scams, the browsing data is still your personal data.

Purchase and financial data. We collect purchase, tracking and delivery information, captured by the extension at checkout. We use this to track your shopping journeys and to look for signs of price manipulation, risks or dropshipping.

AI-generated assessments about your shopping journeys. We generate narrative risk findings, an overall risk rating, and recommendations about a given shopping journey, and a predicted date for something you're waiting on. These are outputs of our AI processing rather than data we collect directly from your or your device.

Sensitive data. TrustPath is not designed to collect or use special categories of personal data (such as data revealing health conditions, religious or philosophical beliefs, sexual orientation, or trade union membership). However, because the service reads content such as emails and web pages that you did not create for us, this kind of data may sometimes appear incidentally within it. This is not our intention, and we do not use such data for any purpose. Where we become aware that we have processed special category data, we delete it as soon as reasonably possible.

Other data. We also process travel or appointment notices we find in your inbox, any feedback you choose to give us, your do-not-track preference, and technical telemetry from the extension.

Other people's data. Because TrustPath reads your inbox, the pages you visit and the reviews on those pages, it will sometimes see personal data about people who have no relationship with F-Secure. For example, the sender of an email about your order, or the username (occasionally a real name, particularly on some platforms) of a private seller on a marketplace listing or of the author of a review. We process this only as a necessary by-product of protecting you, and we anonymize it when we receive it.

Use of AI

AI use in general. TrustPath uses artificial intelligence in the following ways:

• extracting structured details (product, price, seller, terms) from pages and emails;
• classifying a page or message and deciding whether to let it through silently, warn you, block it, or escalate it for your attention;
• analysing your shopping activity as a whole to spot unusual patterns across a journey; and
• turning all of this into the plain-language explanation you see.

We never make decisions on your behalf: you can always choose to proceed past a warning or block. We also always show you the reasoning behind our advice. All AI processing takes place through AI infrastructure that we configure and control, and is never routed through any third-party AI aggregator, router, or model marketplace.

AI training. Separately from using TrustPath, you can choose to let us reuse data already collected through the service and your feedback on TrustPath's findings to help train and improve our AI models. This is off by default, and you can withdraw it at any time in settings. Data obtained through Gmail is never included in this. Whether or not you've opted in to help improve our models generally, no data collected from your Gmail account is ever used to train AI models and it is never shared with the AI model provider for training or secondary purposes.

Legal grounds

As TrustPath connects to your Gmail account through a read-only connection, we process your data described in this notice on the basis of your consent.

Where we ask you to separately opt in for using your data to improve our AI models, we rely on your separate consent, which you can withdraw at any time.

Where we process data about other people who appear incidentally in your inbox or on pages you visit, we rely on legitimate interest.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. In particular, in line with Google's Limited Use requirements, data obtained from your Gmail account is never used to train AI models and is not shared with the developer of any AI model we use.

Retention

Personally identifiable user data is retained for the duration of an active service subscription plus for the grace period of six months thereafter. This is to allow customers to re-engage their expired subscription. Thereafter, the customer account will be scheduled for removal. This removal leads to the deletion or anonymization of any personal data related to the account.

Security

We apply strict security measures to protect the confidentiality, integrity, and availability of any data we process. All data sent to F-Secure is transmitted securely and stored on servers with access limited to authorised personnel only.

Transfers and disclosures

We don't sell your data, and we don't share it with anyone for their own marketing purposes.

F-Secure operates globally. Consequently, some of our affiliates, subcontractors, distributors, and service provider partners are located in multiple countries, including outside the European Economic Area to ensure the global reach and availability of our services. For example, Google provides the Gmail connection you authorise, and is based in the United States. Depending on the scope of your interactions with F-Secure, your personal information may be stored in or accessed from multiple countries. The locations of F-Secure affiliates can be viewed from F-Secure’s public web pages.

When we transfer personal data to other jurisdictions, including outside the European Economic Area, we secure such transfers of personal data according to the requirements of the law. We do this by imposing appropriate technical and contractual safeguards on relevant subcontractors and F-Secure group companies, for example by using data transfer clauses that are approved by the European Union — the fixed content of such clauses is available here.

Additionally, F-Secure complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) as set forth by the U.S. Department of Commerce. F-Secure has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit the Data Privacy Framework website.

In compliance with the EU-U.S. DPF, F-Secure commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit jamsadr.com/submit for more information or to file a complaint. The services of JAMS are provided at no cost to you. If you have a complaint that we have violated the DPF Principles that has not been resolved by other means, you may have the ability to invoke binding arbitration following the procedure explained on the DPF website. F-Secure is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

We only do global or cross-border data transfers for a good reason and after assessing the resulting privacy risk. When we transfer your personal data onward to a third party, we remain liable under the DPF Principles if the data is processed in a manner inconsistent with the DPF Principles. We store more sensitive customer data within Finland or the European Economic Area and keep it under our own control.

Your rights

You can view the findings of data breaches relating to your monitored assets from the service. To get more information or to exercise your statutory rights relating to detection and collection of information on data breaches that relate to such findings, please contact our third-party provider.

You have the right to the data that we have on you. In particular, you have the following rights to the personal data that we hold on you:

• Access and rectification: You have the right to ask us what personal data we have on you and to get a copy of the data that we can identify pertaining to you in this context. Should you find any errors (e.g. obsolete information) in such data, we urge you to contact our customer care to resolve the issue. Some of our service portals allow you to update your customer information. For such, you should update any changes to your personal data, for example change of address or email address. If you cannot update the changes yourself, you may inform us of the necessary changes.
• Objection: You are entitled to object to certain processing of personal data, including for example the processing of your personal data for marketing purposes or when we otherwise base our processing of your data on a legitimate interest. In the latter case, you need to establish a legally valid rationale for your objection.
• Right to be forgotten: You also have the right to request us to cease storing your personal data and erase it. In this case you need to establish a legally valid rationale for your request.
• Portability: You also have the right to ask for personal data that you yourself have provided — pursuant to a contract or your consent. You may request the data in a structured, commonly used, and machine-readable format and further that the data is transmitted to another controller, where technically feasible.
• Withdrawing consent: In cases where the processing is based on your consent, you have the right to withdraw your consent at any time via relevant settings. For identifiable service analytics data, you can find the settings in the service user interface. You also have the right to opt out from our marketing communications via the preference center accessible through the link.
• Restriction: If you establish that the data we have on you is incorrect or we have no legal right to use it, you may request that we cease any further processing of your personal data, and merely keep it in store until the issue is resolved.

You can exercise your rights via our customer care function. The links to contact us are in the Contact information section.

Note that there may be situations where our confidentiality obligations, our right of professional secrecy, and/or our obligations to provide our services (e.g. to your employer) may prohibit us from disclosing or deleting your personal data or otherwise prevent you from exercising your rights. Your above rights are also dependent on the legal grounds based on which we process your personal data. If you have any complaints about how we process your personal data, or would like further information, please contact us at any time. If you feel that we are not enabling your statutory rights, you have the right to lodge a complaint with a supervisory authority. In most cases, this authority is the Finnish Data Protection Ombudsman (tietosuoja.fi).

Additional terms for Californian residents

We protect your rights under the California Consumer Privacy Act and Californian Privacy Rights Act (CCPA and CPRA). You can read about the categories and sources of personal information as well as the purposes for collecting personal information in the What we collect and why and Legal grounds sections of this privacy notice respectively. Your rights to your personal information are explained in the Your rights section of this privacy notice. We will not discriminate against you for having exercised your rights. We will not sell your personal information, and we have not sold any personal information in the past 12 months.

Contact information

F-Secure Corporation
Tammasaarenkatu 7
00180 Helsinki
Finland

How to contact us:

• Please contact us via the support channels available on our website.
• In privacy matters, you can also contact F-Secure by sending a message to privacy@f-secure.com. Note that this email address is not monitored for data subject requests. If you wish to exercise your rights as a data subject, please use the above support channels instead.

Changes

We'll update this notice as TrustPath changes and publish the revised version with a new date. If changes are significant, we may notify you by other means.

Beta waiting list

If you join the TrustPath beta waiting list from an invitation link, we use your email address to invite you to the TrustPath beta and to email you about it.

We store your email address, the time you signed up, which invitation link you used, and the version of the consent text you agreed to. Your email address is stored encrypted.

We keep this information until the beta invitations are sent. If you do not join the beta, we delete it within 12 months.

To be removed from the waiting list, contact us through the channels in the Contact information section of this notice.