Privacy Policy

1. Who we are

Frankly is an independent property price analysis platform for residential properties in Spain.

The controller of your personal data is:

• Frankly Data Lab, S.L. (“Frankly”)
• NIF: B05581624
• Registered address: Calle Juan de Austria 15, Piso 3, 28010 Madrid, Spain
• Privacy contact email: privacy@frankly.es
• General contact email: hello@frankly.es

This Privacy Policy explains how Frankly processes personal data when you access or use frankly.es and the services made available through the platform.

This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679, General Data Protection Regulation (“GDPR”), and Spanish Organic Law 3/2018, of 5 December, on the protection of personal data and guarantee of digital rights (“LOPDGDD”).

2. Scope of this Privacy Policy

This Privacy Policy applies to the processing of personal data of users who access, register with or purchase services through Frankly.

In particular, it applies to users who:

• create an account;
• use Frankly’s property analysis tools;
• request or purchase valuation or pre-offer reports;
• access their reports through their account;
• communicate with Frankly;
• request support;
• exercise their data protection rights;
• receive service or commercial communications from Frankly.

This Privacy Policy does not regulate the processing of non-personal property data or real estate market data unless such data is linked to an identified or identifiable user.

3. Categories of personal data processed

Frankly may process the following categories of personal data.

3.1. Identification and contact data

This may include email address, user ID or internal account identifier and, where provided by the user or required for a specific functionality, support request, billing, invoicing, partner consultation or legal compliance, name, surname, phone number, billing address, country or other contact details.

Where contact details relate to individuals acting on behalf of a company (for example, real estate agents), Frankly will process them solely for professional contact purposes and to maintain the relationship with that company, in accordance with applicable law.

3.2. Account and authentication data

This may include:

• password hash, if you register with email and password;
• email verification status;
• verification tokens;
• password reset or magic-link tokens;
• Google user ID, if you use Google Sign-In;
• account creation date;
• account status;
• plan or subscription status;
• trial information, where applicable.

Frankly does not store your password in plain text. Passwords are stored in hashed form.

If you sign in with Google, Frankly receives your email address and Google user ID. Frankly does not receive your Google password.

3.3. Operational and service data

This may include:

• optional onboarding information, such as buyer intent;
• reports requested or generated;
• property address or listing URL submitted by the user to generate a report;
• report outputs linked to the user account;
• favourites or saved items;
• consultation or partner-referral requests, where expressly requested by the user, including the user’s contact details, the relevant listing context, and property preferences or activity data relevant to the consultation;
• account deletion requests and related records.

3.4. Usage, event and technical data

This may include:

• properties viewed;
• searches performed;
• report generation events;
• report downloads or access events;
• outbound clicks to agency websites;
• account creation, verification and service events;
• IP address;
• referrer;
• locale;
• date and time of the event.

When you are logged in, some of this information may be linked to your account. Some technical events may be stored without a user ID.

Frankly uses this data to operate the service, maintain security, prevent abuse, improve performance and understand how the platform is used.

3.5. Billing and payment data

If you purchase a paid service, payments are processed by Stripe or the relevant payment provider.

Frankly does not receive or store your full card details.

Frankly may process or store:

• payment provider customer ID;
• subscription ID, where applicable;
• checkout session ID;
• payment status;
• payment, refund or cancellation timestamps;
• invoicing or billing information where required.

Invoices and receipts may be managed directly by the payment provider.

3.6. Communications and electronic evidence

This may include:

• emails sent to or from Frankly;
• support requests;
• privacy rights requests;
• service notifications;
• report-ready notifications;
• evidence of acceptance of terms;
• date, time and IP address associated with relevant electronic actions;
• checkout consents, where applicable.

4. Source of the data

Most personal data is provided directly by you when you create an account, use the service, request a report, purchase a service, contact Frankly or exercise your rights.

Some data is generated automatically when you use the platform, such as technical logs, usage events, account status, report access events or payment status.

Where Google Sign-In is used, Frankly receives limited authentication data from Google, such as your email address and Google user ID.

Where Stripe or another payment provider is used, Frankly may receive limited payment status and transaction identifiers from that provider.

5. Mandatory and optional data

Some personal data is necessary to create an account, provide the service, generate reports, process payments or comply with legal obligations.

If you do not provide the data required for these purposes, Frankly may not be able to create your account, provide the requested service, generate the report, process your payment or comply with the relevant legal requirements.

Optional data will be identified as such. Not providing optional data will not prevent you from using the core service, unless expressly indicated.

6. Purposes and legal bases

Frankly processes personal data for the following purposes and legal bases.

6.1. Account creation and management

Purpose: to create, verify and manage your account, authenticate access and maintain your user profile.

Legal basis: performance of a contract or pre-contractual measures.

6.2. Provision of the service

Purpose: to provide Frankly’s property analysis tools, generate and store reports, enable access to reports and manage service functionalities.

Legal basis: performance of a contract or pre-contractual measures.

6.3. Payments, billing and tax obligations

Purpose: to manage purchases, payment status, subscriptions, refunds, receipts, invoicing and related records.

Legal basis: performance of a contract and compliance with legal, tax and accounting obligations.

6.4. Security and fraud prevention

Purpose: to protect the platform, prevent abuse, detect unauthorised access, manage technical incidents and ensure the integrity of the service.

Legal basis: Frankly’s legitimate interest in maintaining a secure and reliable service.

6.5. Product improvement and service analytics

Purpose: to understand how users use the platform, improve the service, monitor performance and develop new functionalities.

Legal basis: Frankly’s legitimate interest in improving and maintaining the service. You may object to this processing based on legitimate interests as described in section 15.

Frankly applies minimisation and retention controls to reduce the impact of this processing on users.

6.6. Customer support and communications

Purpose: to respond to enquiries, manage support requests, send service notifications and handle privacy rights requests.

Legal basis: performance of a contract, legitimate interest in managing user communications, and compliance with legal obligations where applicable.

6.7. Partner consultation requests

Purpose: to manage consultation or referral requests submitted by the user in relation to a property, including sharing the user’s contact details and the relevant listing context with the real estate agency or partner agent identified at the point of collection, so that they can contact the user and manage the consultation.

Legal basis: user consent. You may withdraw this consent at any time, without retroactive effect, using the channels described in section 15.

Frankly will only share this information where the user has given specific consent through a separate, unticked checkbox. Where Frankly asks for consent to share additional preference, behavioural or inferred data, that consent will be requested separately.

6.8. Legal compliance and claims

Purpose: to comply with legal obligations and to establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations and Frankly’s legitimate interest in protecting its legal position.

6.9. Legitimate interest assessment

Where Frankly relies on legitimate interests, it has carried out a balancing assessment to ensure that such interests are not overridden by the rights and freedoms of affected individuals.

You may request further information about this assessment by contacting privacy@frankly.es.

7. Commercial and service communications

Frankly may send users service-related communications necessary for the operation of the platform, including account verification, password reset, report availability, payment, subscription, security and account notices.

Frankly may also send users information about Frankly’s own services, functionalities, updates, improvements or related initiatives, where permitted by applicable law or where the user has given consent, as applicable.

Users may object to or unsubscribe from commercial communications at any time by using the unsubscribe mechanism included in the communication or by contacting privacy@frankly.es.

Frankly will not send commercial communications relating to third-party products or services unless it has an appropriate legal basis.

8. Cookies and similar technologies

Frankly uses strictly necessary cookies, cookieless analytics (Plausible) and — only with your consent — analytics and advertising cookies from Google Analytics and Google Ads. Detailed information on the cookies and similar technologies used by Frankly, including their purpose and duration, is available in our Cookie Policy.

Non-essential cookies (analytics and advertising) are set only after you accept them via our cookie banner, using Google Consent Mode. You can reject them or withdraw your consent at any time as described in the Cookie Policy.

9. Recipients and service providers

Frankly may share personal data with service providers that help operate the platform, including:

• hosting and database providers;
• backup and storage providers;
• transactional email providers;
• payment providers;
• authentication providers;
• address autocomplete providers;
• privacy-friendly analytics providers;
• cookieless analytics providers;
• consent-based analytics and advertising / measurement providers (Google); and
• AI providers used for property-related processing.

These providers may include Railway, Cloudflare R2, Resend, Stripe, Google, Mistral AI and Plausible Analytics, depending on the service used. These providers process personal data on Frankly’s behalf and under its instructions, except where they act as independent controllers or joint/independent controllers under their own terms, such as certain payment providers.

Where you expressly consent to a partner consultation or referral, Frankly may share your contact details and the relevant listing context with the real estate agency or partner agent identified at the point of collection. That recipient will process the data as an independent controller for the purpose of managing the consultation and any subsequent relationship with you.

Frankly may also share personal data with public authorities, courts, regulators or other third parties where required by law or necessary for the establishment, exercise or defence of legal claims.

10. International transfers

Some of Frankly’s service providers may process personal data outside the European Economic Area, including in the United States.

In particular, this may occur in connection with the following providers:

• Resend, which provides transactional email services. Where personal data is transferred to the United States, Frankly relies on Resend’s participation in the EU-U.S. Data Privacy Framework and, where applicable, on the Standard Contractual Clauses included in Resend’s data processing terms.
• Stripe, which provides payment processing, fraud prevention and related payment services. Stripe generally provides services to European customers through Stripe Payments Europe Ltd., established in Ireland. Where, in connection with those services, personal data is transferred to Stripe, LLC or other Stripe group entities located outside the European Economic Area, Frankly relies on Stripe, LLC’s participation in the EU-U.S. Data Privacy Framework and, where applicable, on the Standard Contractual Clauses included in Stripe’s data protection terms.
• Google, which provides Google Sign-In, Google Maps address autocomplete and — subject to your consent — Google Analytics and Google Ads analytics and advertising-measurement services. Where personal data is transferred to the United States, Frankly relies on Google LLC’s participation in the EU-U.S. Data Privacy Framework and, where applicable, on the Standard Contractual Clauses included in Google’s data protection terms.

Frankly keeps records of the applicable data processing terms and transfer safeguards for each provider. You may request further information about the safeguards applicable to international transfers by contacting privacy@frankly.es.

11. AI tools

Frankly may use AI tools to support property-related analysis and service functionalities. Frankly does not use your personal data to train AI models.

12. Retention periods

Frankly retains personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required by law or needed for security, fraud prevention or the establishment, exercise or defence of legal claims.

Frankly applies the following retention criteria:

• Account data: while the account remains active and for up to 30 days after an account deletion request, unless further retention is required by law or for claims.
• Email verification tokens: until verification is completed and, in any event, for a maximum of 7 days.
• Password reset or magic-link tokens: only for the short technical period needed for authentication.
• Usage and event data: up to 12 months, then deleted.
• Property views: linked to the user for up to 12 months; after that, retained only in anonymised form for up to 24 months.
• Reports: while the account remains active and deleted when the account is deleted, unless further retention is required by law or for claims.
• Public property checks linked to reports: while the related report remains in the account.
• Billing data: 5 years from the relevant transaction, unless a longer period is required by law.
• Backups: for a limited recovery period, currently up to 30 days.

Where possible, data is deleted or anonymised once it is no longer needed.

13. Account deletion

You may request deletion of your account.

When your account is deleted, Frankly deletes account-linked data such as:

• user account data;
• favourites;
• authentication tokens;
• reports;
• public property checks linked to reports;
• buyer profile data;
• consultation requests.

Some data may be retained where required by law, tax or accounting obligations, security purposes or the establishment, exercise or defence of legal claims.

Payment records may also remain available through the payment provider where that provider is required to retain them under applicable law.

14. Security

Frankly applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include, where appropriate, access controls, secure authentication, password hashing, encryption or equivalent protection measures, encrypted backups, restricted administrative access, logging and monitoring controls, retention and deletion procedures, and incident-response processes.

Frankly also applies data minimisation measures so that personal data is processed only where necessary for the relevant purpose.

Frankly takes reasonable steps to protect personal data and to respond appropriately to any security incident that may affect it.

15. Your rights

You may exercise the following rights under applicable data protection law:

• access your personal data;
• request rectification of inaccurate data;
• request deletion of your data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability, where applicable;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with a supervisory authority.

To exercise your rights, contact privacy@frankly.es.

Frankly will respond within one month, or within any extended period permitted by law where requests are particularly complex or numerous.

You may also lodge a complaint with the Spanish Data Protection Authority: Agencia Española de Protección de Datos (AEPD), www.aepd.es.

16. Changes to this Privacy Policy

Frankly may update this Privacy Policy from time to time to reflect changes in the service, legal requirements or data processing activities.

Where changes are material, Frankly will notify registered users by email or through a prominent notice in the service.

17. Contact

For any questions about this Privacy Policy or how Frankly processes personal data, please contact privacy@frankly.es.