Privacy Policy

1. Summary

2. Who we are

franchie.ai ("franchie", "we", "us") is provided by DCBA Danismanlik Limited Sirketi, a limited liability company registered in Istanbul, Turkiye (MERSIS no. 0272119252700001), with its registered address at Esentepe Mah. Buyukdere Cad. Ferko Signature No: 175 Ic Kapi No: 7, Sisli, Istanbul, Turkiye.

You can reach us about anything in this policy at hi@franchie.ai.

EU representative (GDPR Art. 27): [EU representative to be appointed before EU launch]
UK representative (UK GDPR Art. 27): [UK representative to be appointed before UK launch]

3. Scope and our role

franchie is an AI sales platform for franchise brands ("customers"). It answers, calls, scores and follows up with people who apply to open a franchise ("leads"). Our role depends on whose data it is:

• We are the controller for personal data of website visitors, people who request a demo or join our early access list, people who contact us, and the users of customer accounts (account owners and team members).
• We are a processor for the lead data our customers bring into or collect through franchie. The customer decides why and how that data is used, and our Data Processing Addendum governs our processing. If you are a lead of one of our customers, please contact that brand first. We will help them respond to you.

4. Data we collect

• Website and demo: name, email, phone number, company, franchise stage, the message you send us, your consent choices, and the call recording and transcript if you ask our AI agent to call you as a demo.
• Account data: name, work email, phone, role, password (stored only as an Argon2 hash), MFA settings, login history and audit logs.
• Billing data: billing name, email and address. Payments are handled by Polar, our merchant of record. We do not receive or store card details.
• Technical data: IP address, browser and device information, error logs (with personal data stripped) and the cookies and similar technologies described in our Cookie Policy.
• Communications: emails and support messages you send us.

5. How we use data and legal bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Lead scores in franchie are suggestions for our customers' sales teams, who make the final decision.

6. AI and your data

• Before conversation content is sent to an AI model, names, phone numbers and email addresses are replaced with pseudonyms. The model never sees them.
• Our AI providers are contractually barred from using this content to train their models.
• We do not use customer data or lead data to train our own or anyone else's models.
• AI output can be wrong. Customers can review conversations and correct their agents' knowledge at any time.

7. Phone calls, SMS and voice

• Outside Turkiye, calls and SMS are carried by Twilio. Speech synthesis and transcription are provided by the subprocessors listed on our Subprocessors page.
• The AI agent states at the start of every call that it is an AI assistant. Calls may be recorded and transcribed, and the person is told so where the law requires.
• If a customer clones a voice for its agent, the voice sample is used only to create that customer's voice, with the speaker's consent.
• Anyone can ask not to be contacted again. We add them to a do-not-contact registry that blocks further calls and messages for that brand. Details are in our AI Calling & Consent Policy.

8. Who we share data with

We share personal data only with:

• Service providers (subprocessors) who help us run franchie, under written contracts. The full list is on our Subprocessors page.
• Polar, which acts as merchant of record for purchases and processes billing data under its own privacy policy.
• The customer you applied to, if you are a lead. Your data is only visible to that brand and its team.
• Authorities, where we are legally required to, and professional advisers under confidentiality.
• A buyer or successor in a merger or acquisition, who will be bound by this policy.

9. International transfers

Our platform is hosted on Google Cloud in the United States, and most of our subprocessors are in the United States. We are based in Turkiye. This means your data may be processed outside the country where you live.

For personal data from the European Economic Area, we use the European Commission's Standard Contractual Clauses. For the United Kingdom, we use the UK International Data Transfer Addendum to those clauses. We apply additional safeguards such as encryption in transit and at rest, field-level encryption and pseudonymisation before AI processing. You can ask us for a copy of the relevant safeguards.

10. Security

• Encryption in transit (TLS) and at rest, plus field-level encryption for names, phone numbers, emails and conversation content.
• Strict separation of each customer's data.
• Multi-factor authentication for administrators, Argon2 password hashing and role-based access.
• Audit logs, error monitoring with personal data stripped, and regular backups.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

11. Retention

• Account data: while the account is active, then deleted or anonymised after closure, except what we must keep for legal reasons.
• Lead data: for the retention period each customer sets (minimum 30 days). After that it is anonymised automatically. Customers can also delete data at any time.
• Demo requests and recordings: up to 12 months, unless you become a customer or ask us to delete them sooner.
• Billing records: as long as tax and commercial laws require.
• Do-not-contact entries: kept for as long as needed to honor the request.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing.

California residents may also have the right to know, delete and correct their information and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising.

To use your rights, email hi@franchie.ai. We will reply within one month (or the period your law sets) and may need to verify your identity. If you are a lead of one of our customers, we will forward your request to that brand. You also have the right to complain to your local data protection authority.

13. Children

franchie is a business service and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

14. Reporting a vulnerability

If you find a security issue, please email hi@franchie.ai with the details. Please give us reasonable time to fix it before disclosing it publicly. We will not take action against good-faith research that avoids harm to users and data.

15. Changes to this policy

We may update this policy as our product and the law change. The version date at the top of this page shows the latest version. If a change is material, we will tell customers by email or in the app before it takes effect.

Version history

• October 18, 2026 · First draft for the global site.