What we keep about you, for how long, and who can see it.

Who is the data controller

The controller of your personal data is Frank SpA (Chilean tax ID 78.511.362-4), domiciled at Av. Cristóbal Colón 9646, Hualpén, Chile. For anything related to this policy, write to contact@tryfrank.app.

If you practice through your company, the company defines the program, decides who takes part and for what purpose, and Frank processes the data on its behalf to deliver the service. The commitments in this policy apply to you all the same, and you can exercise your rights with us or with your company.

What data we process

Only what is needed for the practice to work and for the report to make sense. This is it:

Identity and account

Name, email, company, role, language, and who invited you if you join through your organization.

Session audio

Your voice during practice. Recorded only with your consent, which is requested before the first session and which you can withdraw at any time.

Transcript

The text of what you said and what the counterpart said. It is used to build the report and so the next session in a story remembers the previous one.

Derived acoustic signals

Descriptive measures of how your voice sounded (pace, pauses, energy, pitch variation), compared against your own baseline. We do not use your voice to identify you or to verify your identity.

Usage data

Sessions completed, scenarios, date and time, browser, operating system and IP address. Strictly necessary cookies (session, language) and aggregate usage measurement. No third-party advertising cookies.

Your organization’s context

The documents and text that an administrator uploads so Frank can write scenarios (manuals, policies, guides). They are private to that organization and are never shared with another.

On what basis we process each type of data

Law 21.719 requires a lawful basis for every processing activity. These are ours:

Consent

To record and keep the audio of your sessions. We ask for it before the first session. You can withdraw it at any time, with effect going forward, and delete already stored audio from your account.

Performance of a contract

For everything needed to deliver the service you or your organization signed up for: account, transcript, derived signals, report, progress against your baseline and support.

Legitimate interest

For platform security: preventing unauthorized access, fraud and abuse, and keeping technical logs. Also for improving the product with aggregated, anonymized data that can no longer identify you.

Legal obligation

To keep what a law requires us to keep, such as billing records, and to respond to valid requests from an authority.

What we use the data for, and what we don’t

We use your data to deliver the service: run the session, generate your report, show your progress against your own baseline, support you and send you the essential communications about your account. To keep the platform secure. And to improve the product with aggregated data that no longer identifies you.

What we don’t do with it

• No automated decisions about people: hiring, promoting, evaluating performance or dismissing. Frank describes how a practice conversation sounded; the decision, if there is one, is made by a person.
• We don’t sell your data. We don’t share it with third parties for advertising.
• We don’t use your voice to identify you, nor your data to build profiles for commercial purposes.
• We don’t cross-reference your data with external sources to learn more about you.

Frank is an internal training tool. It is not used in hiring processes or with candidates, so we do not process data about people outside the organization. How that boundary works is in point 11.

How long we keep each type of data

Every type of data has a retention period, and the shortest one is the audio’s.

Session audio

A maximum of 90 days from the session. When the period ends, it is deleted. You can delete any session sooner, from your account, without asking permission.

Report and derived signals

Kept without the audio for as long as the contract with your organization lasts or, if you joined on your own, for as long as your account is active.

Account data

For as long as the account is active. When you close it or the contract ends, we delete your personal data within 30 days at most, except for what the law requires us to keep.

Usage data and technical logs

For as long as needed for security and diagnostics. Then deleted or anonymized.

Your organization’s context

For as long as the contract lasts, or until an administrator removes it.

Aggregated, anonymized data

No time limit, because it can no longer identify anyone.

Who else processes the data, and where

To operate, Frank uses providers that process data on our behalf and only under our instructions. By category:

Cloud infrastructure

Application hosting, database and file storage, including the audio during its retention period.

Voice synthesis and transcription

The provider that generates the counterpart’s voice and the one that converts your voice into text during the session.

Account email

Sending invitations, account notices and support replies.

Some of these providers process data outside Chile, including in the United States. When data leaves the country, the transfer is made with the safeguards required by Law 21.719 and, if the GDPR applies to you, with the ones that regulation requires. No provider may use your data for its own purposes.

The current list of providers, with the country where they process data, is given to every organization before signing and to anyone who requests it at contact@tryfrank.app.

Your rights over your data

Law 21.719 grants you these rights, and you can exercise them even if you are outside Chile:

Access

Know what data we hold about you, where it came from, what we use it for and who we share it with.

Rectification

Correct inaccurate, incomplete or outdated data.

Cancellation (erasure)

Ask us to delete your data, including the audio, when it is no longer needed, when you withdraw your consent or when the processing has no basis.

Objection

Ask us to stop processing your data for a specific purpose, for example when the basis is legitimate interest.

Portability

Receive the data you gave us in a structured, commonly used format, or ask us to send it to another controller.

You can also withdraw your consent at any time and ask for a temporary block on your data while a rectification, erasure or objection request is being resolved.

How to exercise them: write to contact@tryfrank.app from your account email and state which right you are exercising. If we cannot confirm it is you, we will ask you to verify your identity before replying. It is free of charge.

Timeline: we reply within 30 calendar days of receiving the request. If the case requires it, we may extend that once by another 30 days, and we let you know before the first period ends. Temporary block requests are resolved within two business days.

Where to complain if you are not satisfied

If you believe we did not respond properly or on time, you can file a complaint with Chile’s Data Protection Agency (Agencia de Protección de Datos Personales), the authority created by Law 21.719, which begins operating when the law comes into force on December 1, 2026. Until then, the complaint route is the one set out in Law 19.628 before the courts.

If the GDPR applies to you, you can also complain to the data protection authority of your country in the European Union.

Before going there, write to us: almost everything is resolved by email, and support has the answers to the most common questions.

Security, and what happens if something fails

We encrypt data in transit (TLS) and at rest. Internal access follows the principle of least privilege: each person on the team sees only what they need for their work, and we review access to personal data periodically. Audio is assigned a deletion date the moment it is recorded.

If a security breach affects your data, we will report it to the Data Protection Agency by the fastest available means and without undue delay, and we will notify you directly when the breach involves sensitive data or poses a real risk to your rights: what happened, which data was affected and what measures we took. If the GDPR applies to you, the authority is notified within 72 hours.

If the notification is your organization’s responsibility, we inform the organization first, with the detail it needs to meet its own obligations.

Minors

Frank is not intended for people under 18 and we do not knowingly create accounts for them. If we find that we have received data from a minor, we delete it. If you believe a minor has given data to Frank, write to contact@tryfrank.app.

Automated decisions and profiling

Frank does not make automated decisions that produce legal effects on you or affect you significantly. It does not hire, promote, evaluate performance or dismiss. What it produces is a descriptive report of how a practice conversation sounded, compared against your own baseline, for you to read.

We do not infer emotions, personality or mental states, least of all for employment decisions. Article 5 of the European Union’s AI Act (Regulation (EU) 2024/1689), applicable since February 2, 2025, prohibits using AI systems to infer people’s emotions in the workplace and in education. Frank does not do it in any region, not only in Europe: it is a design decision, not a temporary restriction. Nor does it detect lies or claim to.

Frank is not used with candidates or in hiring processes either: it is training for people who are already part of the organization. Why we compare each person against their own baseline, and not against an ideal, is explained on the Why Frank page.

Changes to this policy

We may update this policy when the service or the law changes. If the changes are material, we notify you by email or with a visible notice in the product before they take effect. The date of the last update is at the top of this page, and previous versions can be requested at contact@tryfrank.app.