Privacy Policy

1. Who we are

Frank Advice Ltd operates askfrank.org. We provide AI-powered building project advice to UK homeowners. References to ‘Frank’, ‘we’, ‘us’, or ‘our’ refer to Frank Advice Ltd.

Contact: hello@askfrank.org

2. What data we collect

• Account data: Email address and password when you create an account.
• Project data: Documents you upload (building contracts, quotes, scope of works, drawings, valuations, correspondence), project details you provide, site visit notes, communications you log, and conversations with Frank.
• Usage data: How you use the product, features you interact with, analyses you run. Collected via PostHog analytics.
• Payment data: Stripe processes all payments. We do not store your card details. We store your Stripe customer ID and subscription status.
• Device data: Browser type, device type, IP address, and general location.

3. Why we collect it and our lawful basis

• To provide the service (contract): We process your project data to analyse your documents, provide advice, and maintain your project record. This is necessary to perform the contract between us.
• To improve the product — usage analytics (legitimate interests): We use anonymised, aggregated data about how Frank is used (features used, analyses run, document types, error rates) to maintain and improve the product. This is usage telemetry, not the content of your documents.
• To improve detection and generate aggregate insight (consent): Separately, and only if you opt in, we may use anonymised, aggregated data derived from your analysis findings to improve Frank’s detection quality and build market/industry insight over time (see section 6). This is off by default. Declining it does not affect your ability to use Frank in any way.
• To process payments (contract): We share necessary data with Stripe to process your subscription payments.
• To send service communications (contract): We may email you about your subscription, product updates, and important service information.

4. Who we share data with

We share data with the following sub-processors:

• Anthropic (anthropic.com) — Your document content and project context is processed by Anthropic’s Claude AI to generate analysis and responses. Anthropic processes this data on our behalf under their data processing agreement. Anthropic does not use data submitted via API to train their models.
• Supabase (supabase.com) — Your account data, project data, and documents are stored on Supabase’s infrastructure, hosted in the EU.
• Vercel (vercel.com) — Our application runs on Vercel’s infrastructure.
• Stripe (stripe.com) — Payment processing.
• PostHog (posthog.com) — Product analytics. We use EU-hosted PostHog. Analytics data is anonymised where possible.
• Companies House (companieshouse.gov.uk) — We query public Companies House records using contractor details found in your documents.
• Public property registers — When you add or change a property’s address, we look up public records for that address: its postcode is sent to postcodes.io (to find the postcode’s location), and that location is checked against the Environment Agency’s flood-risk data and Historic England’s National Heritage List (listed buildings). The address and postcode may also be sent to the government’s Energy Performance of Buildings Register (MHCLG) to find the property’s EPC. The results are stored on your property and used in your analysis and chat. Nothing else about you is sent.

We do not sell your data. We do not share your data with third parties for marketing purposes.

5. Your documents and AI processing

When you upload a document, its contents are sent to Anthropic’s API for analysis. Anthropic processes this data as a sub-processor under a data processing agreement. Anthropic does not use API data to train their AI models.

Frank’s analysis is generated by AI and is designed to help you ask better questions and identify potential issues. It does not constitute professional legal or construction advice. Always seek professional advice before making significant financial or contractual decisions.

6. Improving Frank with aggregate insight (optional, consent-based)

Frank becomes more useful the more analyses it runs. With your explicit permission, we may use anonymised, aggregated data derived from your analysis findings— not your raw documents, and not personally identifying information — to improve Frank’s detection quality and to build market and industry insight over time.

Concretely, this means learning aggregate patterns such as “which finding categories are most common for a given project type” — the kind of anonymised, cross-project pattern that no individual homeowner could see alone. It never means sharing your actual documents, your specific findings, or any personal data with any third party, and it is never used to identify you, your property, or any contractor.

This use is optional and consent-based, and entirely separate from the core service. It is off by default. You can turn it on or off at any time under Account settings → Data & privacy. Declining, or later withdrawing, has no effect on your ability to use Frank normally — every feature works exactly the same either way. Withdrawing consent stops any future use of your findings for this purpose.

This is a different choice from the cookie/analytics banner (which controls product-usage tracking). Cookie consent is about tracking infrastructure; this is about using analysis findings for product improvement — we keep them separate on purpose.

7. Data retention

We retain your account and project data for as long as your account is active. If you delete your account, we delete your data within 30 days, except where we are required to retain it for legal or tax purposes.

You can delete individual projects at any time from the dashboard. Deleting a project permanently removes all associated documents, analysis, and records.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (right to erasure)
• Object to processing
• Data portability — receive your data in a structured format
• Withdraw consent where processing is based on consent

To exercise any of these rights, email hello@askfrank.org. We will respond within 30 days.

9. Cookies

We use essential cookies for authentication (Supabase session cookies). These are strictly necessary and cannot be disabled.

We use analytics cookies (PostHog) to understand how Frank is used. You can accept or decline these when you first visit the site. You can change your preference at any time via the cookie preferences link in the footer.

This cookie choice is separate from the optional consent in section 6 (using anonymised aggregate findings to improve Frank). They are deliberately kept apart: one is about tracking infrastructure, the other about data usage for product improvement.

10. Security

We use industry-standard security measures including encrypted data transmission (HTTPS), row-level security on all database tables, and secure authentication. We never store payment card details.

11. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email. The current version is always available at askfrank.org/privacy.

12. Contact and complaints

Frank Advice Ltd (company number 17295838)

For privacy questions: hello@askfrank.org

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.