Privacy Policy

Frascati GmbH in Switzerland runs frascati.app. We use your data to provide frascati.app, to bill your plan and to keep frascati.app secure. To create your websites, apps, presentations and videos, what you write or dictate, the material you add and the files of your project are sent to AI providers, most of them in the USA (see section 5). Our database is in the EU, in Frankfurt. We measure which of our Google ads lead to new accounts and subscriptions; in the EU, the EEA, the UK and Switzerland only with your consent (see section 15). You can delete your account at any time in the settings.

The controller for the processing described here is Frascati GmbH, Binningerstrasse 95, 4123 Allschwil BL, Switzerland (registered seat: Auf der Wacht 18, 4104 Oberwil BL). Email: support@frascati.app. This policy covers frascati.app, the website builder, the frascati iPhone app and the emails we send. Sites that users publish with frascati.app are the responsibility of their owners (see section 13).

Account data: your email address and your password, which we store only as a hash. If you sign in with GitHub, Google or Apple, we receive basic profile data from that service, such as your name, email address and profile picture. With Apple, you can hide your email address; we then receive an address of Apple's relay service, which forwards our emails to you. Billing data: your plan, the status of your subscription, and your payments and invoices. You enter card details directly at Stripe, so we do not receive your full card number. If you buy a plan or credits in the frascati iPhone app, Apple handles the payment: we receive from Apple the details of the purchase (the product, its transaction number, the dates of purchase, renewal and expiry, its status, refunds and the country of the App Store) and a random code our app gives Apple to link the purchase to your account, never your payment details. So that each person can use the free trial only once, we keep the fingerprint Stripe gives the card or bank account used for a trial (a code that recognizes the same card again but does not reveal its number) and a one-way code of your email address and, if you pay with Link, of your Link email address (it recognizes the same address again but cannot be turned back into it), linked to your account, for as long as we offer the trial. Project data: your chat messages with the AI (your prompts are stored with your project), the generated files and versions, content you upload such as images, your published sites, and your presentations and videos with the material you add and the pictures, clips, music and voices made for them (see the section «Presentations and videos»). Connections of your sites: the webhook addresses you set, with the secrets their calls are signed with, which we keep encrypted (a webhook set up with the earlier version of Connections also keeps its earlier unencrypted copy for two weeks after we take it over, so the previous version of frascati.app can be restored, and then we delete that copy), and the log of each delivery to them, with the data sent, for 30 days (see section 16); and the API keys you create, of which we keep only a one-way code (a hash) from which the key cannot be read back, with its name, its permissions and when it was last used; with a key, the services you give it to can read the entries of your sites if you allow it, but orders are never available through the API. Usage data: the credits you use and, for each AI request, the number of tokens, the cost and the model, without the content of your messages. Recordings: when you dictate with the microphone button, your voice recording, which we turn into text and do not keep (see section 5). Technical data: your IP address, browser, device and time of access, and error reports. If you use the frascati iPhone app, we store a sign-in token for each device (only as a hash), the type of device and when it was last used; signing out in the app deletes it. Referral data: who invited whom, so we can add the referral credits. Advertising data: where you came from, that is the click ID of a Google ad, the campaign and search term of the link, and the first page you visited (see section 15). Communication: what you write to us by email or through our contact form, with its attachments, and our replies (see section 9). Problem reports: if you report a problem in the iPhone app (by shaking the phone or in the account screen) or on frascati.app, we store your description, the screenshot or picture you include, the screen or page you were on and the open project, the app and system version, the device model or browser, your language and time zone, and the last technical log lines of the app: warnings, errors and failed requests with their address, status and duration, never the content of your messages or projects.

We process personal data in line with the Swiss Federal Act on Data Protection (DSG). If you are in the EU, the EEA or the UK, the GDPR also applies, and we rely on these legal bases. To provide frascati.app, including your account, projects, AI requests, publishing, downloads and support: performance of our contract with you (Art. 6(1)(b) GDPR). For billing and accounting: the contract and our legal obligations (Art. 6(1)(b) and (c) GDPR). For security, preventing abuse, fixing errors, recording usage and measuring visits without cookies: our legitimate interest in a secure, stable and correctly billed service (Art. 6(1)(f) GDPR). To measure our Google ads: your consent in the EU, the EEA, the UK and Switzerland (Art. 6(1)(a) GDPR), elsewhere our legitimate interest in knowing which ads work (Art. 6(1)(f) GDPR). For up to three emails to people who signed up but did not start a trial: our legitimate interest in helping you get started (Art. 6(1)(f) GDPR). To meet legal obligations and to defend legal claims: Art. 6(1)(c) and (f) GDPR. To use frascati.app, you must give us an email address and add a payment method. Without them, you cannot use frascati.app. Besides the providers named in this policy, we pass on personal data only where you ask us to, for example form messages to a site owner, or where the law requires it.

To create and change your website, we send your chat messages, the files of your project and, if you paste a web address, text we read from that page to OpenRouter (OpenRouter, Inc., USA). OpenRouter passes each request on to a company that runs the AI model: for Claude, our main model, to Anthropic or to a cloud provider that runs Claude, today Amazon Web Services, Google Cloud or Microsoft Azure; when Claude is not available, to OpenAI's GPT, which OpenAI, Microsoft Azure or Amazon Web Services run. All of them are US companies. OpenRouter chooses the provider for each request, so we cannot promise which one handles it, and depending on the provider it is handled in the USA, in the EU or in another country where that provider runs the model. Dictation: when you use the microphone button, your recording goes to OpenRouter, which has it turned into text by OpenAI (USA), or, if that fails, by Groq or DeepInfra (both USA), which run OpenAI's open speech model Whisper. We keep neither the recording nor the text; only what you then send is stored, like any message. Presentations and videos: to write slides and video scripts, your messages, the material you add, such as texts, PDFs, spreadsheets and the text of web pages you name, and, when you build from one of your websites, its files go to Claude in the same way. If you have scenes made by AI for a video, OpenRouter passes the description of each scene to GPT Image by OpenAI (USA), which draws a still image, together with one of your photos when you choose one; the still image, the description and, if you animate one of your photos, that photo then go to Hailuo by MiniMax (Nanonoble Pte. Ltd., Singapore), which makes the clip. A Gemini model by Google (USA) checks each still image and clip. For music, only a description of the mood goes to Lyria by Google (USA), never your content. For voices in presentations and videos, the text to be spoken goes to MAI-Voice by Microsoft (USA). Replies to form messages: if you click «Draft with AI» under a message in Messages, the message, your earlier replies to it and your website's content, its tables and your notes for the AI chat go to Claude in the same way, to write a draft that only you see; nothing is sent until you send it. For each request, we record the number of tokens, the cost and the model used, but not the content of your messages. Please do not enter sensitive personal data, such as health data, into the chat or a recording. The AI chat that site owners can switch on for their visitors, and the AI features that sites and phone apps build into their own pages, also run through OpenRouter and these providers (see section 13); for the AI features, an owner can instead use their own key with OpenRouter or OpenAI. «Ask frascati» in our docs (frascati.app/docs), in the questions on our home page and in the Publish window of the editor sends your question, the conversation so far and the page you are on to OpenRouter and these providers to write the answer. In the Publish window it also sends where your app stands: the step, the state of the build and of Apple's review, and what is still missing, never your keys, the review access or your address. We keep the question and the page, without your name, IP address or account, to improve the docs, and the number of tokens and the cost of the answer. We do not keep the answer. If you click «Send to frascati», we receive your question, the answers and where your app stands by email, with your name and email address, so we can answer you.

If you paste a web address into the chat, or add one as material for a presentation, our own server loads that page and reads its text. No other service is involved. The operator of that website sees a request from our server, not from your device. We then send the text to the AI together with your request (see section 5).

Vercel (USA) hosts frascati.app and the sites published with it. To deliver the pages, Vercel processes technical data such as your IP address. Our database is operated by Neon, a US company, and located in the EU, in Frankfurt, Germany. It stores accounts, projects, chat messages, generated files, versions, published sites, form messages with the replies you send from Messages, your reply templates and signatures, page view counts and the messages to our support, and, for published sites, entries in Cloud tables, bookings (also of places in classes and events, and their waitlists), orders, contact requests from the AI chat, the accounts of people who sign in on them, and the log of the deliveries to their webhooks. We use Vercel Web Analytics and Vercel Speed Insights to see which pages of frascati.app are visited and how fast they load. Both work without cookies, and they run only on the pages of frascati.app itself: never on sites published with frascati.app, on their booking and payment pages, on shared previews or on other pages for their visitors.

Stripe (Ireland and USA) processes all payments, whether you pay by card, Apple Pay, Link or another method that Stripe offers. Stripe receives your payment details, your email address and your billing details. Stripe also processes some data as a separate controller, for example to prevent fraud and to comply with financial regulations. For this, Stripe's own privacy policy applies. Purchases in the frascati iPhone app are processed by Apple (Apple Distribution International Ltd., Ireland, for most countries) as a separate controller under Apple's own privacy policy. Apple tells us about each purchase, renewal, cancellation and refund, so that we can provide your plan or credits; we keep these records like our other billing records (see the section «How long we keep data»).

Resend (USA) sends our emails. These are account emails, such as confirmation emails, password resets and a welcome email. If you signed up but did not start a trial, we send you at most three emails to help you get started, each with a link to unsubscribe with one click. Resend also delivers messages sent through contact forms on published sites, which we forward to the site owner, and the emails we send to visitors of published sites and to the users of phone apps made with frascati.app in the name of their owners: sign-in codes, confirmations, reminders and cancellations of bookings, confirmations of orders, and the replies site owners write in Messages to the people who contacted them. Copies of problem reports can also reach our team this way. Resend processes the email addresses and the content of these emails. Support: when you write to an address @frascati.app, such as support@frascati.app, Resend receives the email for us and passes it to our support inbox, which keeps it with its sender, recipients, subject and attachments, and with whether it passed the checks that show where an email really comes from (SPF, DKIM and DMARC). Messages you send through the contact form on frascati.app arrive in the same inbox. We store the messages in our database (section 7) and their attachments in our file storage at Vercel. If your email address belongs to an account of frascati.app, our team sees its plan, its credits and its latest projects next to your message. To answer faster, someone on our team can have an AI model suggest a reply: the conversation, our documentation and these account details then go to OpenRouter and the providers named in section 5, or directly to Anthropic (USA). A person reads every suggestion, changes it where needed and sends it; nothing is sent on its own. We send our replies through Resend, and our team is told of new messages by email, with the sender, the subject and the beginning of the message. Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR), and our contract with you when you write about your account (Art. 6(1)(b) GDPR). How long we keep these messages is in the section «How long we keep data».

We use Sentry (Functional Software, Inc., USA) to find and fix errors. Our Sentry account stores its data in the EU, in Frankfurt, Germany, and our pages send it through our own address frascati.app/monitoring. When an error happens on a page of frascati.app or on our servers, Sentry receives an error report: the error and where in our code it happened, the address of the page without the part after the question mark, the browser and device, the time, and the last steps before the error, such as pages opened, buttons clicked and requests to our servers. A report contains no IP address and no cookies, and we do not add your name, your email address or what you write; only an error message itself can, rarely, quote a piece of content. We do not use Sentry's session replays, performance traces or visit statistics. Sentry does not run on sites published with frascati.app, on their booking and payment pages, on shared previews or on other pages for their visitors. Legal basis: our legitimate interest in a working and secure service (Art. 6(1)(f) GDPR).

If you sign in with GitHub, Google or Apple, you log in at that service. It confirms your identity and passes basic profile data to us. GitHub, Google and Apple process your data under their own privacy policies. If you signed in with Apple and delete your account, we also revoke the sign-in at Apple.

Sites, presentations and videos made with frascati.app can show photos and video clips from Pexels (Pexels GmbH, Germany). To find them, our server sends only English search words to Pexels. Photos then load directly from Pexels' servers in the browser of anyone who views a preview, a published site or a presentation, so Pexels receives these visitors' IP addresses, and Pexels' network provider Cloudflare may set the technical cookies __cf_bm and _cfuvid. Video clips for your videos are loaded through our server. Generated sites, presentations and videos load their fonts from Bunny Fonts (BunnyWay d.o.o., Slovenia), which also receives the viewer's IP address. Sites published before our relaunch on 25 September 2026 that use Google Fonts get these fonts from frascati.app: our server fetches them from Google and keeps them, so Google does not receive the visitors' IP addresses. These older sites still load their program libraries from the public networks unpkg, cdnjs and jsDelivr, and some show pictures from Unsplash and pravatar.cc; these services receive the visitors' IP addresses. The pages of frascati.app itself use self-hosted fonts; only where you design presentations, videos, app icons and store pictures do the fonts of your design load from Bunny Fonts. Some of our help pages show our own tutorial videos from YouTube (Google Ireland Limited, Ireland). Until you click such a video, the page shows a picture from frascati.app and nothing is loaded from YouTube. When you click it, the video plays from youtube-nocookie.com: Google then receives your IP address and information about your browser and device, and YouTube may store cookies or similar data in your browser. Whether a video plays is your choice each time (Art. 6(1)(a) GDPR).

If you visit a site that someone built and published with frascati.app, the owner of that site is responsible for it. We host the site and process your data on the owner's behalf, under our Data Processing Agreement (frascati.app/dpa). Visitor statistics: for each page view, we store only the site, the domain of the website the visitor came from and the time. We do not store IP addresses or use cookies for these statistics. We run no page statistics or error tracking of our own on these sites; if our servers fail while delivering one, their error report contains no IP address or cookies of the visitor (see section 10). Forms and entries: if you send a message or an entry through such a site, for example a reservation request, we store the fields you filled in and email them to the site owner. Replies: the site owner can answer your message from frascati.app. The reply comes from our sending address under the site's name, with the site owner's own address to answer to, so your answer goes to them; we keep the reply with your message and add no tracking to it. To write such a reply, the site owner can have an AI model suggest one: your message, the site's content and earlier replies then go to OpenRouter (USA), which has Claude write the suggestion through Anthropic or a cloud provider that runs Claude (see section 5); the site owner reads it and decides what is sent. Accounts: if a site lets you sign in, you sign in with your email address and a six-digit code that we send you by email; there is no password. We store your email address, a name if you give one, when you signed up and when you were last seen, and what the site keeps in your account for you, such as favorites or a plan. We keep a code only as a one-way code (hash); it is valid for 10 minutes, and we delete it within a day. Your browser keeps a sign-in key in its local storage, on the site's own address; we keep only a one-way code of it. The sign-in ends when you sign out, after 30 days without a visit, or when the site owner signs you out or deletes your account. Entries and bookings you send while signed in are linked to your account. The site shows you your own entries and bookings, also bookings made earlier with the same email address, and the content the site owner shows to everyone who is signed in; it never shows you the entries of other people. The site owner sees the list of accounts with email address, name and dates, and which entries came from which account. Where the site offers it, you can delete your account yourself; this deletes what is kept in it, while the entries and bookings you sent stay with the site owner, without the link to your account. Otherwise, ask the site owner to delete it. Bookings: if you book a time, or a place in a class or an event, or join its waitlist, we store your name, email address, phone number, your note, your answers to the questions the site owner added to the booking form, the person you booked with and the booking, send you a confirmation, reminders before it at the times the site owner chose, and a link to view or cancel it, email you when a place from the waitlist becomes yours, and inform the site owner. The site owner can see who booked a class or an event in a private calendar of their own. Orders: if you buy something, you pay on a payment page of Stripe that belongs to the site owner's own Stripe account; we do not receive your card details. After the payment, we receive your name, email address, shipping address, the items and the amount from that Stripe account, keep them for the site owner and send you an order confirmation. AI chat: if you write to the chat assistant of a site, your questions and the content of the site are sent to OpenRouter (USA), which has Claude write the answers through Anthropic or a cloud provider that runs Claude (see section 5). We do not keep the conversation. If you ask to be contacted, we store your contact details and your request and pass them to the site owner. AI features: if a site lets you use an AI in its own pages, for example a chat, a text generator or a translator, it tells you that the answers come from an AI. Phone apps built with frascati.app can have such AI features too, for example a helper that answers questions about the business or recognizes a plant on a photo. What you enter there and the conversation so far are sent with the owner's instructions for that feature to OpenRouter (USA), which has Claude write the answer through Anthropic or a cloud provider that runs Claude (see section 5); for some features the content of the site or app goes along. You can add a photo to a question. On a site, your browser makes the photo smaller before it is sent, and our server removes its hidden data, such as the place where it was taken, passes it to the AI with your question and does not keep it. In a phone app, the photo first goes to our server, which makes it again without its hidden data; it goes to the AI with your question and is deleted once the answer has come, and at the latest after a day, unless you also send it with an entry. Some owners use their own key with OpenRouter or OpenAI for these features. Then what you enter, the conversation so far and a photo you add go through our server, with the owner's key, to that provider, under the owner's own agreement with it: to OpenRouter (USA), which has Claude answer as described in section 5, or to OpenAI (OpenAI, L.L.C., USA), which under its own rules does not use these data to train its models, unless the owner allows it, and keeps them for up to 30 days to detect misuse. We do not keep the conversation. For each answer we record the number of tokens, the cost and the model, without the content: for the owner's credits or, with an own key, to show the owner what the key used. To prevent misuse, we count requests per page view and per IP address, in memory only and for at most a day, without storing them. Please do not enter sensitive personal data there, and photograph other people only with their consent. Connections: a site owner can have new messages, contact requests from the AI chat, entries, bookings and orders sent on to services they choose, such as Zapier, Make or n8n, and can let such services add entries and bookings to the site with an API key; we send no emails to the people of bookings added this way. We keep a log of each delivery to these services, with the data sent, for 30 days, so the site owner can see and resend it, and delete it then. Notifications in phone apps: if you turn on notifications in a phone app built with frascati.app, we store a push address for your phone on the app owner's behalf, encrypted: an Expo push token in the version from the App Store or Google Play, or your browser's push subscription in the version on the home screen. If you are signed in to the app, it is linked to your account. The app owner can then send you notifications. In the version from the App Store or Google Play, we pass them for the app owner to the push service of Expo (650 Industries, Inc., USA), which the app owner uses with their own Expo account; Expo passes them on to Apple's or Google's push service and deletes them once they are passed on. In the version on the home screen, they go through the push service your browser uses (Apple, Google, Mozilla or Microsoft), which receives them encrypted and cannot read them. When you turn notifications off in the app, we delete the push address. The owner of the site or app is the controller for all of this data. If you have questions about your data or want to exercise your rights, please contact the owner.

frascati.app only uses the cookies that login needs, such as the session cookie that keeps you signed in. These cookies are strictly necessary, so we do not ask for consent. We also use your browser's local storage for small conveniences, for example to keep a prompt you typed before signing up. To measure our ads, Google Ads sets the cookies _gcl_aw, _gcl_au and _gcl_gb and we set the cookie fa_click, each for 90 days, and local storage notes that a conversion was already reported, so it is not counted twice. In the EU, the EEA, the UK and Switzerland this happens only if you allow it. The cookie fa_consent keeps your choice for 180 days, and you can change it at any time under Cookie settings at the bottom of our pages (see section 15). When you pay at Stripe, sign in with GitHub or Google, or play one of our videos from YouTube, those services use their own cookies.

We advertise frascati.app with Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To see which of our ads lead to new accounts, trials and paid subscriptions, and not to spend more on advertising than it brings in, frascati.app loads the Google tag. It is never loaded on sites published with frascati.app, on booking and payment pages or on shared previews. The tag reports to Google Ads when you create an account, start a trial (with the monthly price of the plan) or build your first website. If you allow it, it sets the cookies _gcl_aw, _gcl_au and _gcl_gb, which keep for 90 days which of our ads you clicked, and when you start a trial it sends your email address in hashed form (converted with SHA-256 into a code from which the address cannot be read back), so that Google can match the trial to an ad click (enhanced conversions). In our own cookie fa_click we keep, also for 90 days, the click ID that Google adds to the link of an ad, the campaign and search term of the link and the first page you visited, and we store them with your account when you sign up. When the first payment of your subscription goes through, we send Google this click ID and your hashed email address together with the amount and the time, again only to match the payment to an ad click. Google does not receive your name or your projects, and we use none of this for personalized advertising or remarketing. We keep the click data with your account and delete it together with your account. Legal basis: in the EU, the EEA, the UK and Switzerland your consent (Art. 6(1)(a) GDPR), which you give or refuse in the banner and can withdraw at any time under Cookie settings at the bottom of our pages. We store your choice in the cookie fa_consent for 180 days. Without your consent, the tag sets no cookies and sends no email address, we store no click data and report no payment, and Google only receives signals without cookies, from which it estimates conversions. Elsewhere, measurement is on from the start, without personalized advertising, and you can switch it off the same way. Google Ireland may transfer data to Google LLC in the USA, which is certified under the EU-US and Swiss-US Data Privacy Framework (see section 16).

Vercel, OpenRouter, Anthropic, OpenAI, Amazon Web Services, Google, Microsoft, Groq, DeepInfra, Resend and Stripe process data in the USA. Expo, the push service that app owners use with their own Expo account for the notifications of their phone apps (see section 13), also processes data in the USA. Where site and app owners use their own key with OpenRouter or OpenAI for their AI features (see section 13), these providers process the data in the USA under the owner's own agreement with them. Through OpenRouter, an AI request can also be handled in the EU or another country where the chosen provider runs the model (see section 5). Neon and Sentry are US companies, so access from the USA is possible although they store our data in Frankfurt. The USA offers adequate data protection only for companies certified under the Data Privacy Framework. Where applicable, we rely on this certification under the Swiss-US or EU-US Data Privacy Framework, or on the standard contractual clauses of the European Commission. Pexels and Bunny Fonts are in the EU. Switzerland and the EU recognize each other's data protection as adequate. MiniMax (Nanonoble Pte. Ltd.), which makes the clips of scenes made by AI, is in Singapore, and through OpenRouter a clip can be made in Singapore or another country where MiniMax runs its model. Neither Switzerland nor the EU recognizes Singapore as adequate. We pass data to MiniMax only when you have such clips made, because it is needed to make what you ask for (Art. 49(1)(b) GDPR, Art. 17(1)(b) DSG). If you do not want this, do not have clips made by AI, and animate photos of people only with their consent (see our terms). The OpenStreetMap Foundation, which runs the place search Nominatim used by Find clients, is in the United Kingdom, which Switzerland and the EU also recognize as adequate. Contact us for more information about these safeguards.

We keep your account and project data as long as your account exists. When you delete your account in the settings, we delete your projects and data, including the images you uploaded and the other files kept for your projects in our file storage at Vercel. When you delete a single project, we delete the files kept for it as well, unless another of your projects still uses them. We keep presentations and videos, with the files made for them, until you delete them or your account; uploaded PDFs are deleted as soon as the presentation is saved. We do not keep recordings you dictate. Form messages with the replies to them, entries in Cloud tables, bookings, orders and visitor statistics of a published site are deleted when the site owner deletes them or the site, and at the latest when the site owner deletes their account. The same goes for the accounts of people who sign in on a published site, which they can also delete themselves where the site offers it; a sign-in code is deleted within a day, and a sign-in ends after 30 days without a visit. The log of a site's webhook deliveries, with the data sent, is deleted after 30 days, and earlier with the webhook address or the site. The push address of a phone that turned on an app's notifications is deleted when the person turns them off, when a push service reports that the phone no longer has the app, and with the app; the notifications the app owner sent stay in the app's history until the app is deleted. If you connect your Expo account, we keep its access token, encrypted, until you disconnect it or delete your account. If you add your own key with OpenRouter or OpenAI for the AI features of your sites and apps, we keep it, encrypted, until you remove it or delete the site, the app or your account. A photo that someone adds to a question to the AI of a phone app is deleted once the answer has come, and at the latest after a day, unless they also send it with an entry; a photo added to a question on a site is not kept. We keep accounting records, such as invoices, for 10 years, as Swiss law requires (Art. 958f of the Swiss Code of Obligations). Backups, server logs and error reports are kept only as long as operation and security require, and are then deleted automatically. Problem reports and their screenshots are deleted 12 months after you send them, and earlier together with your account. Questions to «Ask frascati», in our docs and on our home page, are deleted 12 months after they were asked. Messages to our support, by email or through our contact form, our replies and their attachments are deleted 2 years after the last message of the conversation, and messages we marked as spam after 30 days. How long Find clients keeps the data of businesses is in the section «If your business was found through Find clients».

With every paid plan from Starter, Find clients helps you research businesses around a place and prepare website drafts and first letters or emails (see the section «Find clients» of our terms). When you use it, we process your searches (the place, the radius, the kind of business and the filters), the businesses found with what our website check read about them, your sender details (your name, company, postal address and email and, if you add them, your phone number, website and the address of your privacy page), and your drafts, texts, notes, the status of each business and your do-not-contact list. Your name or company appears in the line across each of your drafts and on the page where a business can remove its draft, and your sender details go under each letter and email you prepare. A place we do not know is looked up once at Nominatim, the place search of the OpenStreetMap Foundation in the United Kingdom, which receives the text you typed. Texts, drafts and the helper's answers are written by the AI providers in section 5. When you accept the Find clients terms, we keep the version you accepted and the time with your account. Find clients sends no email and makes no call for you. For what you take from Find clients, such as lists, exports and notes, and for your contacts with businesses, you are the controller. Legal basis: our contract with you (Art. 6(1)(b) GDPR), and for keeping your acceptance, our legitimate interest in being able to show it (Art. 6(1)(f) GDPR).

This section is for businesses and the people who run them. Users of frascati.app can look for businesses around a place that have no website or an outdated one, and offer them their services. Where the data come from: the business's name, kind, address, phone number, website and, where listed, email address come from Overture Maps Places, an open data set of the Overture Maps Foundation with data from Meta, Microsoft, Foursquare, BrightQuery and AllThePlaces. Our website check, which names itself frascatibot, then reads the business's home page, its legal notice and its contact page, at most one request per second, and keeps to robots.txt. From these pages it takes the email addresses written out on them, the name and role of the owner or managing director, opening hours and register numbers, and notes why the website looks outdated. It never decodes an address that a business protects from robots. In France, the manager's name can come from the public company register (Recherche d'entreprises). Every fact is stored with its source and date. Who sees it: only the account that ran the search. That user decides whether and how to contact the business, does it in their own name and is responsible for it, and every first letter and email prepared with frascati.app names its sender. We contact no business ourselves and do not sell these data. Drafts: a user can have frascati.app build a draft website for a business from the facts above. It has an address without the business's name, is hidden from search engines, says in a line on top whose draft it is and that it is not the official website, has no forms, and goes offline by itself after 30 days. «Remove this draft» in that line takes it offline at once. Views of a draft are counted as for any published site (see section 13). Businesses that do not want to be contacted: if your website says that you do not want advertising, Find clients leaves your business out. If you remove a draft, a user records that you asked not to be contacted, or you write to us, your business goes on our list of businesses that asked not to be contacted: no account of frascati.app finds it again, and no draft, letter or email is made for it with frascati.app, unless you are already in touch with that user. On this list we keep only one-way codes of your business's map entry, domain, email addresses, phone numbers and name with town, from which these details cannot be read back, together with the reason and the date, for as long as it is needed to respect your wish. How long: a business nothing came of is deleted from the user's account 6 months after it was found, together with its draft. A user's own do-not-contact list keeps the business's domain, email address, phone number and map entry for as long as the user's account exists. Your rights: you can object at any time. Use «Remove this draft», reply to the sender, or write to us at support@frascati.app. You also have the rights in the section «Your rights». To keep our website check away from your website, add the lines «User-agent: frascatibot» and «Disallow: /» to your robots.txt. Legal basis: our legitimate interest in providing Find clients and in respecting the wish of businesses not to be contacted, and our users' legitimate interest in offering their services to businesses (Art. 6(1)(f) GDPR). For their own lists and contacts, the users are the controllers (see the section «Find clients»).

When you make a presentation, you can add material: texts, PDFs, spreadsheets, web addresses and websites you made with frascati.app. PDFs go from your browser straight to our file storage at Vercel (section 7). Our server reads the material and sends it to the AI providers in section 5 to write the slides. We delete uploaded PDFs as soon as the presentation is saved, and the presentation keeps only the names, kinds and sizes of its sources, not the material. Web pages you name are loaded by our own server, as described in section 6. When you make a video, we use the texts, pictures and Cloud table entries of your website, your own photos and clips, stock clips from Pexels (section 12) and, if you choose them, scenes, music and voices made by AI (section 5). Clips, still images, music and voices made by the AI are kept in our file storage at Vercel under addresses that cannot be guessed, so the video can be shown and downloaded. The finished video file is made in your browser; we do not store it. AI labels and marks: videos with scenes made by AI show the label «AI GENERATED» or «AI MODIFIED» unless you switch it off. Every downloaded video with material made by AI, and every presentation video with an AI voice, carries a machine-readable note in the file: that it contains material made by AI, which AI systems made it, the tool and the date, together with the video's title and description. We keep presentations and videos and their files until you delete them or your account. Legal basis: our contract with you (Art. 6(1)(b) GDPR).

We protect your data with technical and organizational measures, such as encrypted connections (HTTPS), hashed passwords and restricted access to our systems. No system is completely secure. If a data breach is likely to put you at high risk, we will inform you and the authorities as the law requires.

You have the right to know what personal data we hold about you, to have incorrect data corrected and to have your data deleted. You can also ask to receive the data you gave us in a common electronic format, object to processing based on our legitimate interests, and ask us to restrict processing. Where we rely on your consent, you can withdraw it at any time. You can download your sites and delete your account yourself in the settings. For everything else, email us. We answer within 30 days and may ask you to confirm your identity. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch, or, if you are in the EU, the EEA or the UK, to the data protection authority in your country.

frascati.app is not meant for children. You must be at least 18 years old to create an account. If you believe a child has given us personal data, please contact us and we will delete it.

We may update this policy when frascati.app or the law changes. The current version is always available at frascati.app/privacy. We will inform you by email about material changes.

For questions about privacy or to exercise your rights, contact Frascati GmbH, Binningerstrasse 95, 4123 Allschwil BL, Switzerland, email support@frascati.app.