Privacy Policy

Last updated: 10 October 2026

This Privacy Policy explains what personal data we collect when you use Franko (the “Service”), how we use it, with whom we share it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

1. Who is responsible

The data controller is:

Useful Systems OÜ Tornimäe tn 5 10145 Tallinn Estonia Registry code: 17370540 (https://ariregister.rik.ee/eng/company/17370540) Contact: contact@tellfranko.com

You can reach us about any privacy matter at the contact above. The supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee/en.

2. Whose data we process

We process data about two kinds of people:

• Creators: people who sign up for an account and create surveys.
• Respondents: people who answer a survey at a link a Creator has shared with them.

We treat Respondent answers as Creator Content for the Creator; we act as data controller for the Respondent personal data we collect directly for the operation of the Service (sign-in details, cookies, technical logs).

3. What we collect and why

We process the data below to provide the Service to you (performance of our contract), to comply with our legal obligations such as accounting and tax, and for our legitimate interests in keeping the Service secure and understanding how it is used.

3.1 Creator account data

When you sign up we collect:

• Email address, name, and (if you sign in with Google or LinkedIn) a profile picture URL.
• Preferred language (en / it) and preferred pronouns if you provide them during onboarding.
• An encrypted password if you sign up with email + password. Passwords are stored only as a salted hash; we never see your password in clear text.
• Session metadata: IP address, user agent, and session token, used to keep you signed in and to prevent fraud.
• OAuth tokens when you sign in with Google or LinkedIn (access and refresh tokens, kept only as long as needed to keep you signed in).

3.2 Survey content and onboarding answers

When you build or run a survey we store:

• The survey definition (title, description, questions, language, context).
• Your onboarding answers (Franko Personal asks a short set of meta-questions).
• The chat history of any wizard or onboarding conversation.
• AI-generated material linked to your survey (briefs, analyses, Personal Wrapped cards).

3.3 Respondent answers

When a Respondent opens a survey link we store:

• Their sign-in details: Respondents sign in so each person answers once. We store their email address and, if they sign in with Google or LinkedIn, their name and profile picture URL, plus the session metadata described in §3.1.
• The interview session: which survey, language, current position, the answers given, and the AI conversation that accompanies each answer.
• A completed submission: when an interview is finished, we store the answers together with the interview conversation, which the Creator’s report is built from. The Creator can read Respondents’ answers and their conversation with Franko, without knowing who wrote them. The report shows grouped points and how widely each one is shared. It never says which Respondent said what.

Answers and conversations are free text, so they may contain information that identifies a Respondent if the Respondent chooses to provide it. The underlying interview conversation may be retained so the Creator’s report can be generated, regenerated, or re-analysed (see §6).

3.4 Payments

If you subscribe to a paid plan we store the Stripe customer ID linked to your organisation. The actual payment (card details, billing address, VAT identifier) is handled by Stripe. We never see your full card number.

3.5 Error reports and observability

When something breaks, we capture an error report that may include the stack trace, the URL that was loaded, the user agent and IP address. We use this only to diagnose bugs. We also capture LLM traces (the prompt and the model’s response) for the same purpose; trace data is kept in a separate observability tool with a short retention.

3.6 Analytics

We use a self-hosted instance of Umami for product analytics. Umami is configured to be cookieless and to collect only aggregated, anonymous usage data (which page was viewed, country, browser type, referrer). It does not store an identifier in your browser and is not used to track you across sites. No data goes to Google Analytics or any third-party analytics provider.

4. Cookies

We use a small number of first-party cookies, all strictly necessary:

We do not use advertising, third-party tracking, or third-party analytics cookies. Our Umami analytics is cookieless.

5. Who we share data with (sub-processors)

We use the following sub-processors. Each is bound by a data-processing agreement. Transfers to the United States rely on the EU-US Data Privacy Framework where the recipient is certified, and on Standard Contractual Clauses otherwise.

Our self-hosted Umami analytics instance runs on infrastructure operated by Useful Systems OÜ; it is not a third party.

AI assistants a Creator connects. A Creator can choose to connect an AI assistant, such as Claude by Anthropic, to their Franko account through our connector. The assistant then receives what that Creator’s account can read: survey definitions, response statistics, report text and, on enterprise plans, the email addresses on a survey’s invitation list. Report text can include names, places and short quotes from what Respondents said. The assistant never learns which Respondent said what: it receives no interview transcripts and nothing that links an account to its answers. This is the Creator’s choice, the assistant’s provider handles that data under the Creator’s own agreement with it, and it is not our sub-processor. The Creator can disconnect an assistant at any time under Connected apps in their account menu.

6. How long we keep data

• Active account data: for as long as your account is active.
• Closed accounts: we delete personal data within 90 days of account deletion, except where retention is required for legal, accounting (typically 7 years under Estonian law) or security reasons.
• Interview sessions and the conversations within them: retained until the Creator deletes the related survey, so the Creator’s report can be generated, regenerated, or re-analysed. Closing a survey does not delete them. The Creator can delete a survey (and its responses) at any time, and a Respondent can ask us to delete their response by contacting us as described in §7.
• Error reports: typically 90 days.
• LLM observability traces: short retention (on the order of weeks).
• Backups: taken before each deployment and deleted on a rolling basis.

7. Your rights

Subject to the conditions in applicable data-protection law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data (“right to be forgotten”);
• Restrict how we process your data;
• Data portability to receive your data in a structured, machine-readable format;
• Object to processing based on our legitimate interests;
• Withdraw consent at any time where consent is the legal basis;
• Lodge a complaint with the Estonian Data Protection Inspectorate or with your local supervisory authority.

To exercise any of these rights, email contact@tellfranko.com. We will respond within the period required by law. There is no charge for reasonable requests.

8. International transfers

Several of the sub-processors above are based in the United States. We rely on the EU-US Data Privacy Framework where the recipient is certified, and on the European Commission’s Standard Contractual Clauses supplemented with additional safeguards where it is not. You can request details of the transfer mechanism that applies to a specific sub-processor by emailing us.

9. Children

The Service is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Security

We use industry-standard measures to protect your data: TLS in transit, hashed passwords, role-based access controls, encryption at rest for backups, and rate-limited authentication. No system is perfectly secure; we will notify affected users and the relevant authority of a personal-data breach where required by law.

11. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top reflects the latest revision. We will notify active users by email or an in-app notice when changes are material.

12. Contact

For any privacy question or to exercise your rights: contact@tellfranko.com.