Privacy Statement

Version 1.1, effective from 23 October 2026.

This statement tells you exactly what data we collect, why we need it, how long we keep it, and what rights you have over it.

1. Who We Are

We are Frank Finance Ltd ("Frank", "we", "us"), a company registered in England and Wales under company number 16227004, whose registered office is at 22a, St James’s Square, London SW1Y 4JH, England.

Frank is a controller of the personal data we use for the purposes described in this statement. This statement covers our website at https://www.heyfrank.ai, our mobile application and the Founding 1000 Programme for product research and feedback. The Founding 1000 Participant Terms are at https://www.heyfrank.ai/founding-1000-terms.

Frank’s services are not intended for use by anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete it.

For data protection support, contact: data@heyfrank.ai.

2. What Data We Collect

The personal data we collect falls into four categories, described below.

2.1 Data you give us directly

• Your name, date of birth and address

• Your email address

• Contact and identity information we need when you apply for our services and/or as part of your application for an account with Keel Money Ltd

• Financial data (if applicable), including your international bank account number (IBAN), account balance, transaction history and source of wealth / source of funds

• Professional information, including your employer and job title

• Family information, including marital status

• Identification documents (including the document type, number and expiry date), a photograph or short video of your face, and biometric data derived from that photograph or video (for example, a facial scan)

• Any other information you share with us through forms, surveys, support messages or otherwise

• If you apply to or take part in the Founding 1000 Programme: your application, feedback, survey answers and session responses, recordings (audio, video and screen) of sessions you take part in, and records of your participation

2.2 Data we collect automatically

When you use our website or app, we automatically collect certain technical data to keep things running smoothly and securely:

• Device and browser information (type, version, operating system)

• Your IP address and internet service provider

• Pages visited, links clicked, and session timestamps

• Language preferences

• Verification data to confirm you are a human being

2.3 Cookies and similar technologies

We use cookies and similar technologies to operate and protect our website. We ask for your consent before using non-essential cookies or similar technologies unless a specific legal exception applies. We use PostHog in cookieless mode to produce aggregate statistics about how our website is used so that we can improve it.

You can manage or withdraw your cookie consent and object to analytics covered by the statistical-purposes exception through https://www.heyfrank.ai/privacy-statement#cookie-preferences. Strictly necessary technologies are used only where needed to provide or protect the service you request. Disabling other technologies may affect the features that depend on them. For the technologies we use, their purposes and durations, see our Cookie Policy at https://www.heyfrank.ai/cookie-policy.

2.4 Data we receive from other sources

• The outcome of your identity verification check (for example, whether it was successful, and any risk score or flags associated with it).

• From Cifas and other fraud-prevention databases or screening providers, the results of fraud-prevention screening.

3. Purposes of processing

We use your personal data for the purposes below. For each purpose, we explain the lawful basis on which Frank relies. Other organisations acting as controllers explain their own processing in their privacy notices.

• Setting up your Frank services and carrying out identity checks necessary to enter into or perform our contract with you (taking steps at your request before entering into a contract, or performing that contract, depending on the stage of your application). Checks required by law are addressed separately below.

• Biometric identity verification. Where we use biometric data to identify you uniquely, this is special category data. In addition to the relevant lawful basis above or below, we rely on Article 9(2)(g) of the UK GDPR and substantial public interest under Schedule 1, Part 2 of the Data Protection Act 2018. This processing is necessary for preventing unlawful acts and preventing fraud.

• Delivering and managing the services to you (performance of our contract with you)

• Communicating with you about your account (performance of our contract with you)

• Carrying out identity and anti-money-laundering checks and keeping associated records (compliance with legal obligations).

• Screening for politically exposed persons and sanctions (compliance with our legal obligations)

• Detecting and preventing fraud or security threats, including bot checks on our sign-up forms (our legitimate interests in preventing fraud and protecting our systems and customers)

• Improving the website and our services using technical and usage information (our legitimate interests in understanding how our services perform and improving them). Programme feedback, responses and recordings are used for research on the separate consent basis described below.

• Sending you service updates and important notices (performance of our contract with you)

• Sending marketing emails and promotional offers (your consent)

• Registering you on our waitlist and sending the waitlist communications you agree to receive (your consent).

• Assessing your job application and communicating with you about it (taking steps at your request before entering into an employment contract); and administering a fair and consistent recruitment process (our legitimate interests in recruiting suitable candidates).

• Founding 1000 Programme: assessing applicant eligibility, selecting participants, running sessions, tracking participation and providing perks (our legitimate interests in running a fair and suitable research programme, performance of our contract with you). Collecting and using your feedback, survey answers, session responses and audio, video and screen recordings to research and develop our products and services (our legitimate interest in improving our service). Withdrawal ends your future participation in the research programme but does not affect processing carried out before withdrawal.

• Running and moderating our Discord community, responding to messages and investigating reports, using your Discord username, posts, support tickets and moderation records (our legitimate interests in maintaining a safe and useful programme community). We use community contributions for programme research only on the research-consent basis described above.

• Resolving technical issues and maintaining the platform (our legitimate interests in maintaining a secure and functioning platform)

4. Data Retention

We keep your personal data for no longer than necessary for the purposes described in this statement, taking into account our legal and regulatory obligations. In particular:

• Identity-verification and transaction records that Frank must retain: normally five years from the end of the business relationship.

• Marketing consent records: for as long as you are subscribed, then two years after you unsubscribe, so that we can demonstrate your choices. We retain a minimal suppression record of your objection for as long as needed to ensure that we do not send you marketing you have declined.

• Technical, device and analytics data: up to 12 months from collection, unless a shorter period applies to the particular technology as set out in our Cookie Policy.

• Customer support correspondence: up to two years after the enquiry or complaint is closed.

• Founding 1000 Programme research data and session recordings: until the earlier of six months after Frank first makes accounts available to the wider public or two years after your last research session. If you withdraw your participation earlier, we stop the research processing and delete or anonymise the relevant personal data, except for information we are required by law to retain. We may retain research findings that have been anonymised so that you cannot be identified.

• Unsuccessful Founding 1000 applications: the earlier of two years after we communicate the selection outcome, or the date you request that we remove your application data.

• Recruitment applications and related records: the earlier of two years after the recruitment process ends, or the date you request that we remove your application data. If you join Frank, relevant records are transferred to your personnel file and covered by the staff privacy notice.

Other organisations acting as independent controllers, including Discord, retain personal data under their own policies. You can contact them directly to exercise your rights in relation to their processing. Our service providers page at https://www.heyfrank.ai/service-providers identifies their roles and links to their privacy information.

5. Marketing Communications

We will only send you marketing emails or promotional content if you have given us your explicit consent to do so. You can opt out at any time by:

• Clicking "unsubscribe" in any marketing email

• Updating your preferences in your account settings

• Emailing us at support@heyfrank.ai with the subject line "Unsubscribe"

Withdrawing consent for marketing will not affect the delivery of your core services. You can object to our use of your personal data for direct marketing at any time, and we will stop using it for that purpose.

6. Who We Share Your Data With

We do not sell your personal data. We share it only where necessary for the purposes explained in this privacy statement or to meet a legal obligation.

We work with carefully selected providers for services including identity verification, digital onboarding, IT infrastructure, hosting, platform maintenance and service improvement. Where a provider acts as our processor, it is bound by a data processing agreement and may process personal data only on our documented instructions. Other organisations may act as independent or joint controllers for particular activities, as explained below. A current list of our service providers, their purposes, controller or processor roles, processing locations, applicable transfer arrangements and relevant privacy notices is at https://www.heyfrank.ai/service-providers.

Keel Money Ltd. We share all contact, identity, and financial data with Keel Money Ltd as the Account issuer. For this processing, Keel acts as processor role and Frank acts as controller. Keel’s privacy notice is available at https://keel.money/privacy-policy/.

Discord. The Founding 1000 Programme community runs on a Frank server on Discord, and you need a Discord account to participate in that community. Discord Inc is responsible as a controller for its own use of your information under its Terms of Service at https://discord.com/terms and Privacy Policy at https://discord.com/privacy. Discord is based in the United States. Questions or rights requests about Discord’s own processing should be directed to Discord.

Frank is responsible for its own use of information from the server. We use your Discord display name, profile picture, posts, messages, support tickets and moderation records for the community purposes. If you leave the Founding 1000 Programme or are removed, we remove your founder role and access to founder channels. Your posts may remain visible unless deleted. You can ask us to delete personal data we control; we will assess your request under the applicable rights and explain any limitations. We keep moderation records for up to six months after you leave, then delete them.

Bot checks. We use Cloudflare Turnstile to check that website sign-ups come from people rather than automated programs. It processes technical information about your device and connection, including your IP address and browser details. Cloudflare processes this information on our behalf to provide the check and as a separate controller to improve Turnstile’s bot detection. Its Turnstile Privacy Addendum is at https://www.cloudflare.com/en-gb/turnstile-privacy-policy/.

We may share your data with law enforcement, regulators or other authorities where we are legally required to do so, or to investigate suspected fraud or illegal activity.

Some recipients process personal data outside the UK. For transfers for which we are responsible, we rely on a UK adequacy regulation where applicable, including the UK Extension to the EU-US Data Privacy Framework for eligible transfers to participating certified organisations. Otherwise, we use appropriate safeguards, such as the EU Standard Contractual Clauses together with the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, or the UK International Data Transfer Agreement.

7. Automated Decision-Making

We use automated processing to help verify identity, screen for fraud, money laundering and sanctions risk, and manage accounts. Before we refuse an application or restrict, suspend or close an account on the basis of automated screening, a suitably trained member of our team assesses the relevant information and has authority to change the proposed outcome. Where a service proposes an action for you to authorise, we explain the action and you decide whether to proceed. This authorisation step is separate from any automated assessment that may affect you.

If we make a decision about you based solely on automated processing, including profiling, that produces a legal or similarly significant effect, we will provide information about that decision, enable you to make representations, obtain human intervention and contest it.

8. Your Rights

You have rights over your personal data under UK data protection law. We respond without undue delay and normally within one calendar month. Where the law permits an extension because of the complexity or number of requests, we may take up to two additional months and will explain the extension within the initial month. We will tell you if we need information to verify your identity or clarify your request, and how this affects the applicable time limit.

To exercise your rights or withdraw consent or make a complaint about how we handle your personal data, contact data@heyfrank.ai. Using the subject line "Personal Data Request" helps us route an email but is not required. You do not need to use a particular form or legal wording.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we have not handled your personal data properly. Information about contacting the ICO and making a complaint is at https://ico.org.uk/make-a-complaint/.

9. Amendments

We may update this Privacy Statement from time to time to reflect changes in our services, legal requirements or best practice. The current version will always be available at https://www.heyfrank.ai/privacy-statement. If we intend to use your personal data for a new purpose, we will provide the relevant privacy information before that processing begins. Where fresh consent is required, we will ask for it before proceeding.

10. Links

Our website may contain links to third-party websites not operated by Frank. We are not responsible for the content or privacy practices of those sites, and this statement does not apply to them. We recommend reading the privacy notice of any website you visit.