Privacy Policy
Effective Date: July 1, 2026
L.B. Foster Company (“Company,” “we,” “our,” or “us”) respects your privacy. This Privacy Policy describes how we collect, use, disclose, and otherwise process Personal Data in connection with Anatomy, also referred to as L.B. Foster’s Anatomy Asset Management System or Anatomy Asset Intelligence, including the related websites, applications, dashboards, APIs, software, and related services (collectively, the “Service”).
This Privacy Policy applies to Personal Data we collect as a business in our own right. If we process Personal Data on behalf of a business customer in providing the Service, that processing is governed by our contract with that customer, including any applicable Data Processing Agreement.
1. Relationship to Customer Data
Customer Data is defined in the applicable customer agreement and generally means connected asset, endpoint, equipment, device, telemetry, configuration, diagnostic, performance, location where enabled, command history, and related operational data processed through the Service.
Customer Data may include or constitute Personal Data depending on the nature of the data and the context in which it is processed. To the extent Customer Data, Usage Data, Derived Data, operational records, or other service-related data includes or constitutes Personal Data, we process that Personal Data in accordance with this Privacy Policy, applicable contractual terms, any applicable Data Processing Agreement, and applicable law.
Where we process Personal Data on behalf of a business customer as a processor, service provider, or similar role, that processing is governed by our contract with that customer, including any applicable Data Processing Agreement. Where we process Personal Data for our own business purposes as a business, controller, or similar role, that processing is governed by this Privacy Policy and applicable law.
2. Personal Data We Collect
We may collect the following categories of Personal Data:
2.1 Contact and Account Information. Name, business email address, phone number, company name, job title, account credentials, and account preferences.
2.2 Device, Network, Usage, Asset, and Environment Information. IP address, device identifiers, browser type, operating system, logs, session activity, clickstream data, authentication events, audit records, user activity records, device status, configuration state, network identifiers, location data where enabled, operational telemetry, event data, diagnostic data, performance data, asset health information, and records of remote commands or control actions, in each case to the extent associated with or reasonably linkable to an individual.
2.3 Communications Information. Information contained in support requests, chat messages, emails, calls, surveys, or other communications with us.
2.4 Payment and Transaction Information. Billing contact details, invoicing records, purchase records, tax-related records, remittance information, and other transaction or account administration information related to the Service.
2.5 Cookies and Similar Technologies. Information collected through cookies, SDKs, tags, pixels, and similar technologies, subject to applicable consent requirements.
2.6 Derived Data and Inferences. Analyses, metrics, scores, trends, insights, alerts, recommendations, and other information generated from Personal Data or service usage information, to the extent such information constitutes Personal Data under applicable law.
3. Sources of Personal Data
We collect Personal Data from:
users and customers;
devices, browsers, and the Service;
customer administrators and account owners;
service providers, vendors, and integration partners;
publicly available sources; and
marketing, referral, and analytics partners.
4. How We Use Personal Data
We may use Personal Data to:
provide, operate, maintain, secure, support, remotely administer, audit, and improve the Service;
authenticate users and manage accounts;
process transactions and send service-related communications;
provide customer support and respond to inquiries;
monitor performance, verify commands and control actions, debug errors, investigate incidents, prevent fraud, enforce access controls, maintain audit trails, and protect security;
analyze usage trends, asset and device activity, command execution patterns, service performance, and user experience;
develop and improve analytics, automation, AI, and machine learning features as described in Section 7;
comply with legal obligations and enforce our contracts; and
market our products and services where permitted by law.
5. How We Disclose Personal Data
We may disclose Personal Data to:
5.1 Service Providers. Vendors that provide hosting, infrastructure, analytics, communications, support, security, invoicing, collections, and related business services.
5.2 Affiliates and Corporate Transactions. Our affiliates and counterparties involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.
5.3 Integrations and Customer-Directed Disclosures. Third parties where a customer or user directs us to enable an integration, connection, or disclosure.
5.4 Legal and Safety Disclosures. Government authorities, regulators, law enforcement, courts, and other parties where required by law or reasonably necessary to protect rights, safety, and security.
5.5 Professional Advisors. Lawyers, auditors, insurers, and similar advisors under appropriate confidentiality obligations.
We do not "sell" your Personal Data, and we do not "share" your Personal Data for cross-context behavioral advertising, in each case as those terms are defined under applicable US state privacy laws. We use the advertising, analytics, and similar technologies described in Section 6 only with consent where required and only in a manner that does not constitute a sale or share under those laws. Where required by applicable law, we treat an opt-out preference signal, including a Global Privacy Control (GPC) signal, as a valid request to opt out of any sale or sharing.
6. Cookies and Similar Technologies
We and our partners may use cookies and similar technologies to remember preferences, analyze usage, secure the Service, and support communications and marketing. Where required by law, we will obtain consent before using non-essential cookies.
7. Operational Records, Derived Data, and AI/ML Development
We may maintain logs, telemetry, audit trails, authentication records, support records, configuration records, and records of remote commands, control actions, settings changes, and related service events for service operation, security, support, compliance, billing verification, dispute resolution, analytics, benchmarking, and improvement.
To the extent the Service includes analytics, automation, anomaly detection, recommendations, alerts, classifications, predictions, or other AI/ML-enabled functionality, we may process Personal Data, Customer Data, Usage Data, Derived Data, and related service data as necessary to provide, operate, secure, maintain, support, and generate outputs from that functionality for the applicable customer in accordance with the applicable customer agreement, any applicable Data Processing Agreement, and applicable law. This customer-specific operation of Service functionality does not, by itself, authorize us to use Personal Data for AI/ML training, model development, model retraining, tuning, testing, validation, or improvement.
We may use Aggregated Data, De-identified Data, Derived Data, Usage Data, and Customer Data for which the applicable customer has provided any required opt-in to develop, train, retrain, tune, test, validate, and improve analytics, automation, AI, and machine learning models, features, systems, and related functionality, subject to the applicable customer agreement and applicable law.
We do not use Personal Data for AI/ML training, model development, model retraining, tuning, testing, validation, or improvement unless expressly agreed in writing with the applicable customer and permitted by applicable law.
Any contractual opt-out from AI/ML training or improvement applies prospectively only and does not require us to delete, retrain, roll back, modify, or cease use of models, systems, features, automations, analytics, outputs, learnings, or derived outputs developed or improved before the effective date of the opt-out, except to the extent required by applicable law or expressly agreed in writing.
8. Data Retention
We retain Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, meet legal, accounting, or reporting obligations, resolve disputes, enforce agreements, and protect our interests.
Following expiration or termination of the applicable customer agreement, we will delete Customer Data within ninety (90) days after receiving the customer’s written deletion request, unless retention is required by applicable law or reasonably necessary for backup, archival, security, legal, compliance, or dispute-resolution purposes.
We may retain and continue to use Usage Data, Derived Data, Aggregated Data, and De-identified Data after expiration or termination for lawful business purposes in accordance with the applicable customer agreement, this Privacy Policy, the DPA, and applicable law. To the extent any such data constitutes Personal Data, we will continue to process it in accordance with this Privacy Policy, the DPA, and applicable law.
Deletion of Customer Data does not require us to delete, retrain, roll back, modify, or cease use of models, systems, features, automations, analytics, outputs, learnings, Derived Data, Usage Data, model parameters, weights, or other outputs created or improved before deletion, except to the extent required by applicable law or expressly agreed in writing.
9. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Data. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.
10. Your Privacy Rights
Depending on where you reside, you may have rights regarding your Personal Data, such as the right to know, access, correct, delete, or appeal certain decisions regarding your Personal Data.
If you are a California resident, you may have rights under California law, including rights to know, delete, correct, and limit certain uses of sensitive Personal Data, subject to applicable exceptions.
To exercise applicable privacy rights, contact us at anatomy@lbfoster.com. We may need to verify your identity before processing a request.
11. Children’s Privacy
The Service is not directed to children under 13, and we do not knowingly collect Personal Data from children under 13.
12. International Data Transfers
If Personal Data is transferred to a country other than the country in which it was collected, we will take steps designed to ensure the transfer is subject to appropriate safeguards as required by applicable law.
13. Third-Party Websites and Services
The Service may contain links to, or integrations with, third-party websites or services. We are not responsible for the privacy practices of third parties.
14. Supplemental US State Privacy Notice
To the extent required by applicable US state privacy laws, the following disclosures apply:
Categories Collected. We may collect identifiers, commercial information, Internet or network activity information, geolocation data in limited circumstances, professional or employment-related information, and other information described in this Privacy Policy.
Business Purposes. We collect and use these categories for the purposes described in Sections 4 and 7, including service delivery, remote administration, security, logging, audit, analytics, derived data generation and use, authorized AI/ML development, communications, compliance, billing verification, and business operations.
Retention. We retain each category of Personal Data for as long as reasonably necessary for the relevant disclosed purpose, unless a longer period is required or permitted by law.
Sale and Sharing. We do not sell Personal Data or share Personal Data for cross-context behavioral advertising as those terms are defined under applicable US state privacy laws.
Sensitive Personal Data. We use sensitive Personal Data only as permitted by applicable law and only where relevant to providing and securing the Service or for other permitted business purposes.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version and revise the Effective Date above. Where required by law, we will provide additional notice.
16. Contact Us
If you have questions about this Privacy Policy or our privacy practices, contact us at:
L.B. Foster Company
415 Holiday Dr 100
Pittsburgh, PA 15220
anatomy@lbfoster.com