The iframe loads the authenticated /web-engage/account/dashboard page which has NO X-Frame-Options and NO CSP frame-ancestors directive.
PII displayed: member name, loyalty card number, memberId.