1. Who we are
Froko is an AI-powered front-office assistant for small and local businesses, operated by Froko Technologies, Inc. ("Froko", "we", "us", "our"). We are the data controller for the personal data of visitors to our website, of the business owners and team members who have an account, and of our billing records — meaning we decide why and how it's processed.
For the personal data inside the communications you connect to Froko (your callers, and the people who write to you), the business using Froko is the controller and we act as its processor: we process that data only to provide the service, on your instructions, as described in this policy and in our Terms of Service.
This policy covers both our marketing website (froko.eu) and our application (the Froko dashboard used by business owners and their customers' contacts).
2. Data we collect
We collect the following categories of personal data:
- Identity data — your name, and where relevant, the names of your customers or contacts stored in your conversations.
- Contact data — email address and phone number, for you and for the contacts you communicate with through Froko.
- Business data — company name, industry, and other details you provide when setting up your account or assistant.
- Communications content — the calls, SMS, and email messages processed through the platform, so we can display, categorise, and (where enabled) auto-respond to them on your behalf.
- Customer notes — short, factual notes the assistant keeps about your contacts (for example a name and a one-line summary of the matter), so a repeat customer is handled consistently. You can read, edit and delete them.
- Call transcripts — only if you switch this option on. The caller is told at the start of the call that a text record of the conversation is saved. Card numbers, passwords and similar details are masked before saving. By default a transcript is kept for 12 months (you can set 3 to 24 months) and is then deleted automatically; you can delete one transcript or all of them at any time.
- Usage data — login activity, feature usage, appointment and conversation history, and similar operational data needed to run the service.
- Payment data — handled directly by our payment provider and merchant of record; we do not store full card numbers ourselves.
- Connected account data — if you choose to connect Gmail, Outlook, Google Calendar, Google Contacts, Google Meet, Microsoft Teams, or Zoom, we access the data in those accounts (e.g. email and calendar content, meeting recordings and transcripts, or contacts) only as needed for the specific feature you've enabled, and store the access credentials required to keep that connection working.
3. Why we collect it
We only process personal data where we have a valid legal basis to do so under GDPR Article 6:
- Performance of a contract — to create your account, run the assistant, and deliver the core service you've signed up for.
- Consent — for the waitlist/early-access forms on our marketing site, and for any optional communications you opt into.
- Legitimate interests — to keep the service secure, diagnose issues, and improve the product, balanced against your right to privacy.
- Legal obligation — where we're required to retain certain records (e.g. billing) by law.
A core part of the service is AI-assisted processing: message content may be sent to our AI providers to categorise conversations and, where you've enabled it, draft or send automatic replies. This only happens for accounts that have those features turned on.
The assistant does not make decisions that have legal or similarly significant effects on a person: it answers, drafts and books within the rules you set, and hands over to you when it is unsure. People who call are told at the start that they are speaking with an automated assistant, and if asked, the assistant says honestly that it is an AI. We also send you service emails, for example appointment notices, daily summaries and warnings when you approach a usage limit.
4. Third-party services we use
We use a small number of trusted processors to run Froko. Each only receives the data it needs to perform its specific function, under a data processing agreement.
Database, authentication, and file storage for your account and conversation data.
Payment processing, subscription billing and sales tax handling, as our merchant of record. We never see or store your full card number.
Hosting of the servers that run the Froko web application and the phone assistant.
Storage of archived email message bodies and of our encrypted database backups.
Provides the phone number that forwards calls to the AI phone assistant, for accounts that enable it — call routing and call metadata pass through this provider.
Product analytics inside the Froko application (for example which setup steps people complete), so we can improve the product. Not used on the marketing website.
AI-based categorisation of incoming messages, AI-drafted auto-reply generation (used only on accounts that enable this feature), the onboarding chat, and — on accounts with AI phone answering enabled — real-time processing of live call audio.
An alternative AI provider used for some of the same message categorisation and reply-drafting processing described above.
Phone calls and SMS text messages, for accounts that enable AI phone/SMS handling — call audio, call metadata, and text message content pass through this provider to reach our systems.
Voice generation for the phone assistant, on accounts using that configuration.
For accounts that connect Gmail, Google Calendar, Google Contacts, or Google Meet: reads and sends email, manages calendar events, reads your contacts, and reads meeting recordings and transcripts, to power the assistant's inbox, scheduling, and meeting-summary features.
For accounts that connect an Outlook/Microsoft 365 mailbox or Microsoft Teams: reads and sends email, and reads Teams calendar events and meeting transcripts — the same inbox and meeting-summary features as our Google integration, for accounts that use Microsoft instead.
For accounts that connect Zoom: reads your cloud meeting recordings and transcripts, to summarise customer calls and meetings.
Delivery of transactional email — appointment confirmations, notifications, and account emails sent by Froko.
4b. Named service providers
These are the providers behind the categories above, with what they do for you. The retention of data sent to the AI and voice providers is set by their own terms: TODO (owner): confirm and write the exact period for each before publishing.
- OpenAI (USA, Standard Contractual Clauses): speech recognition and the language model that writes the assistant's answers.
- Mistral AI (France, EU): the assistant's synthetic voice.
- Twilio (USA, Standard Contractual Clauses): the phone line.
- Supabase (EU): database and sign-in.
- OVH (EU): the servers the application runs on.
- Lemon Squeezy: payments and invoices.
5. Where your data is stored
Our primary database runs on infrastructure hosted in the EU region, so your account and conversation records are stored within the EU by default. The servers that run the application are also hosted in the EU.
Some processing is performed by the US-based providers listed in Section 4 — our AI language processing providers, and, for accounts that choose to connect them, providers like Google, Microsoft, and Zoom. Where personal data is transferred outside the EEA for this purpose, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards recognised under GDPR Chapter V.
6. How long we keep your data
We keep account and conversation data for as long as your account is active. If you delete a conversation, it moves to a recycle bin and is permanently erased after 14 days unless you restore it sooner. You can permanently delete your entire account and everything in it yourself, at any time, from Settings — this takes effect immediately and cancels any active subscription, except where we're legally required to retain billing records for longer.
For disaster recovery we keep encrypted daily backups of our database for up to 30 days. Data you delete may therefore remain in those backups until they expire, after which it is permanently gone.
7. Your rights under GDPR
If you are located in the EEA/UK (or covered by an equivalent law), you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — delete your personal data yourself at any time from Settings, or ask us to do it for you, subject to legal exceptions.
- Restriction — ask us to limit how we use your data in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests, including profiling.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
- Complain — lodge a complaint with your local data protection supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu).
To exercise any of these rights, contact us using the details in Section 12.
8. Cookies
Our marketing website does not use analytics or advertising cookies. Because we don't use non-essential cookies here, there's no cookie consent banner to show you.
Our application uses essential session cookies to keep you signed in securely. These are required for the app to work and cannot be turned off while using the service.
9. How we protect your data
We use industry-standard safeguards including encryption in transit (TLS), encrypted storage at rest, and access controls that limit who inside Froko can view customer data — restricted to what's needed for support and engineering work. Our staff can open the content of your messages only with a stated reason (for example a support request or abuse), and every such access is logged.
10. Children's privacy
Froko is a business tool intended for use by adults operating a business. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we'll delete it.
11. Changes to this policy
We may update this policy as our product or legal obligations evolve. Material changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review it periodically.
12. Contact us
For any question about this policy, or to exercise your data rights, contact us at hello@froko.eu. We aim to respond to all data requests within 30 days, as required by GDPR.