Privacy Policy

Who is responsible for your data

PENDING — the operating legal entity and its registered address are being confirmed and will be named here. Until then, the publisher of franbase.ai is the controller of the data described below, and every request in this policy is answered through the contact form in the footer of any page.

franbase.ai is offered to franchise investors, franchisors and consultants worldwide, including in the European Union and the United Kingdom. We therefore treat the GDPR (including Art. 3(2), which applies because we offer this service to people in the EU wherever we are established), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA as all applying here.

What we collect

• Running a free tool — your email address, your name if you give one, which tool you ran, and the interface language. Free tools do not require a verified account.
• Creating an account — your name and email address. We email you a six-digit code to prove the address is yours; the code expires in ten minutes and is never shown to us in your record.
• What you type into a tool — the business figures, documents and notes you enter, for example into the FDD analyser, the ops copilot or the client brief. See “AI features” below before you paste anything sensitive.
• Buying a plan — your name and email are passed to our payment provider to open a checkout, and we receive back the fact of the order and which plan it was. We never see or hold your card number.
• Messages you send us — whatever you write in the contact form, plus the address we reply to.
• Technical request data — your IP address is read from the request header to enforce rate limits and to spot automated abuse, together with a hidden form field and a submission-timing check that only bots trip. We do not build a profile from any of it.

We do not ask for special-category data — health, biometrics, political opinions, religion, trade-union membership, sex life or sexual orientation — and have no use for it. Please do not send it.

Why we hold it, and on what legal basis

• To run the tool or deliver the plan you asked for — performance of a contract with you, or steps taken at your request.
• To verify your email address — performance of that contract, and our legitimate interest in keeping fake accounts out.
• To send you the follow-up sequence after you run a free tool — consent, given when you submit your address. Every message carries an unsubscribe link and unsubscribing takes effect immediately.
• To keep the service standing up — rate limiting and abuse prevention, on our legitimate interest in a service bots cannot exhaust.
• To keep records of orders — our legal obligation to keep accounting and tax records.

Who else receives it

These are processors and providers acting on our instructions or under their own terms as merchant of record. None of them is given your data to sell.

• Vercel — hosting. Serves every page and holds short-lived request logs.
• Supabase — the database of record for registrations and tool runs.
• Wix — a mirror copy of registration records, so the wider franbase and Nguyen Phi Van ecosystem shows one consistent record.
• Resend — delivers your verification code, the follow-up sequence and our replies.
• Anthropic — the Claude models behind our AI tools. What you type into a tool is sent to Anthropic to produce the output.
• Lemon Squeezy — takes payment as merchant of record. Your card details go to them and never reach us; their own privacy terms govern what they hold.

We also disclose personal data where the law requires it — a binding order from a competent authority — and we will tell you when we are permitted to.

We do not sell your personal information

We do not sell personal information for money or other valuable consideration, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CPRA. We do not pass your details, or what you type into a tool, to franchise brands or to any other buyer of leads.

AI features

Our tools run on Claude models operated by Anthropic. The text, figures and documents you submit are sent to Anthropic to generate the output and are retained by us only as far as needed to deliver the result and debug the feature. We do not use what you submit to train any model.

AI output can be wrong, incomplete or out of date. Nothing a tool produces is legal, tax, accounting or investment advice — check the numbers before you act on them. Do not paste a third party’s confidential information, or personal data about other people, into a tool unless you are entitled to.

We do not make automated decisions about you that produce legal or similarly significant effects.

Cookies, analytics and third-party scripts

This site sets no advertising cookies and carries no advertising or cross-site analytics trackers. Signing in uses a signed token so we can recognise your session. A chat widget is loaded from bots.nguyenphivan.com, operated by us on the same terms as this site; opening a chat sends what you type to that service so it can reply.

How long we keep it

• Account records — while your account exists, and for a short period after you close it.
• Verification codes and tokens — ten minutes, then they are worthless by design.
• Tool runs and their inputs — kept so you can return to a result, and deleted on request.
• Order records — for as long as tax and accounting law requires.
• Marketing consent — until you unsubscribe.
• Rate-limit counters — held in memory and discarded within minutes.

Your rights

Depending on where you live, you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to port it elsewhere, or to withdraw a consent you gave. Under the CPRA you may also ask what we collected and request deletion or correction. We will not treat you worse for asking.

Make any of these requests through the contact form in the footer of any page. We answer within one month and will tell you if we need longer. If you are in the EU or the UK, you may also complain to your national data protection authority.

Where your data goes

Our providers operate internationally, so your data may be handled outside your country, including in the United States. Where data leaves the EEA or the UK we rely on the transfer terms in those providers’ standard data processing agreements, which incorporate the European Commission’s Standard Contractual Clauses.

Children

franbase.ai is a business service. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us data, tell us and we will remove it.

Changes to this policy

When what the service does changes, this page changes with it and the date at the top moves. Material changes to how we use data you have already given us will be announced before they take effect.

Contact

Privacy questions, rights requests and complaints go through the contact form in the footer of any page. Our Terms of Use sit alongside this policy.