Privacy Policy

Who is responsible for your data

FRANWORLD is operated by [entity to be confirmed], registered at [entity to be confirmed]. That entity is the controller of the personal data described here — it decides why the data is held and what happens to it. Privacy questions and rights requests go to privacy@franworld.com.

FRANWORLD is offered in English, Spanish, Arabic and Chinese to people in the European Union, the United Kingdom, the Gulf states, Asia and the Americas. We therefore treat the GDPR (including Art. 3(2), which applies to us because we offer services to people in the EU wherever we are established), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA as all applying to this service. An EU Art. 27 representative has not yet been appointed; that appointment is part of the outstanding legal review noted above.

What we collect

• Account details — name, email address, and optionally phone, country, company and job title, when you create an account or a brand owner is provisioned one.
• Enquiry and pre-qualification answers — the country, budget, category, ownership type, liquid share, timeline, funding position, decision authority, territory and experience you choose when you enquire about a brand or talk to Maya, our AI advisor. These are choices from a list, not free text, except where a page offers a note field.
• Sign-in codes — a six-digit code is emailed to you and checked as a signature; the code itself is never stored in our database.
• What you upload — photographs and logos a brand owner adds to a listing, held in our brand-media store.
• Messages — what you write in the contact form, an enquiry note, or a conversation with Maya.
• Subscriptions — the email address and criteria you give for brand alerts or the newsletter.
• Basic technical data — your IP address, used to rate-limit forms and sign-ins so the site is not flooded, and the language you are reading in.
• Anonymous usage counts, only if you agree — if you allow measurement in the banner, a random identifier stored in your browser lets us count which pages and brands are reached. It carries no name, no email and no IP address, it is never linked to your account, and it is deleted from your browser the moment you withdraw. Say no and nothing is counted.
• Error reports — when a page breaks, the error message and the page address (without anything after a "?") are sent to us so we can fix it. No identifier and no IP address are attached, email addresses are removed from the message before it is stored, and reports are deleted after 30 days.

We do not ask for, and do not want, your net worth, credit history, criminal record or employment history. Our business verification checks a company against public registers; it is not a background check on a person and is never used as one.

Who else receives your data — read this one

This is the service, not a side effect: an enquiry that never reaches the brand is an enquiry that does nothing for you. But it is your decision, and it is made per enquiry — we do not sell your details to brands you did not ask about. Each enquiry goes to one brand and is never resold, syndicated or re-marketed to a competitor; that commitment is set out in full in our no-resale guarantee.

How to stop it. You may tell us not to sell or share your personal information, at any time and without giving a reason, by emailing privacy@franworld.com with the subject Do Not Sell or Share. You may also simply not send an enquiry: browsing, searching, saving a shortlist and using the calculators send nothing to any brand. Opting out never costs you access to anything else on the site.

We do not sell your data to advertisers, data brokers or list resellers, and we run no advertising network on this site.

Why we are allowed to hold it

• To do what you asked (GDPR Art. 6(1)(b), performance of a contract) — creating your account, sending your enquiry to the brand you chose, delivering a report you requested.
• Because we have a legitimate interest (Art. 6(1)(f)) — keeping the service secure, rate-limiting forms, preventing fraudulent listings, and understanding in aggregate which parts of the site are used. Balanced against your interests, and you can object at any time.
• Because you agreed (Art. 6(1)(a)) — newsletters, brand alerts, anonymous usage measurement, and business verification, each of which only runs after you have been shown the words and said yes. Consent can be withdrawn without affecting anything done before, and we keep a dated record of the answer so we can show we had it.
• Because the law requires it (Art. 6(1)(c)) — keeping records of payments and of consent.

The companies that process data for us

These providers hold or handle personal data on our instructions. We use no others.

• Supabase — the database and file storage where accounts, enquiries and uploads live (Singapore/US regions).
• Vercel — hosting and the servers that run the site.
• Resend — sending email: sign-in codes, enquiry copies, alerts and reports.
• Anthropic — the model behind Maya, our AI advisor. What you type to Maya is sent to Anthropic to produce a reply. Do not type anything to Maya you would not want stored.
• Wix — a mirror copy of contact records used for internal reporting. Passwords and session tokens are deliberately never mirrored.
• Stripe — card payments, when a paid plan or lead purchase is made. Card numbers go to Stripe directly and are never seen or stored by FRANWORLD.
• OpenStreetMap / Overpass — used by the territory and white-space map tools. These receive the area you searched, not who you are.

Some of these operate outside your country, so your data may be transferred internationally. Where that involves personal data leaving the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. The specific transfer mechanism per provider forms part of the outstanding legal review noted at the top of this page.

How long we keep things

• Accounts — while the account is open, and for 24 months after it goes quiet, then deleted.
• Enquiries and leads — 36 months, because a franchise decision commonly takes one to three years and both you and the brand may need the record of what was agreed.
• Payment records — 7 years, as tax and accounting law requires.
• Sign-in codes — 10 minutes. Sessions expire after 12 hours.
• Newsletter and alert subscriptions — until you unsubscribe, which is one click and needs no login.
• Uploaded images — while the listing is live; images no longer attached to any listing are swept and permanently deleted.

Your rights

Wherever you live, we will honour these. You do not need to cite a law, and we never charge for it or treat you differently for asking.

• See it — a copy of what we hold about you.
• Correct it — anything wrong or out of date.
• Delete it — subject only to records we are legally required to keep, such as payments.
• Take it — your data in a portable, machine-readable file.
• Stop it — object to processing based on legitimate interests, withdraw consent, or opt out of sale and sharing as described above.
• Limit it — ask us to restrict processing while a dispute is resolved.
• Complain — to your national data protection authority. In the EU that is the supervisory authority where you live; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency. You may complain to them without coming to us first, though we would rather you gave us the chance.

Write to privacy@franworld.com. We answer within 30 days. An authorised agent may act for you; we will ask for proof of that authority, and for enough information to be sure we are not handing your data to someone else.

How your account is protected

Signing in sends a six-digit code to your email address, which expires in ten minutes. There is no password to be reused or leaked. Your session is held in a cookie your browser will not let any script read, and it expires after twelve hours. Every write to a brand listing is re-checked in the database against who owns it, so a stolen session still cannot reach someone else's brand. Tables holding enquiry data are closed to the public key by default.

No system is perfect. If we ever discover a breach that puts you at risk, we will tell the relevant regulator within 72 hours and tell you without undue delay.

Children

FRANWORLD is a business service and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

Cookies and what your browser stores

We set one strictly necessary cookie and we run no advertising trackers and no third-party analytics. We do count anonymous page views in our own database, and only after you say yes — refusing takes the same single click as agreeing, and the site works identically either way. The detail, including what is kept in your browser's own storage and how to clear it, is on the cookies page.

Changes to this policy

When this page changes materially we will update the date at the top and, where the change affects how your data is shared, tell registered users by email. We will not quietly widen what we do with data you have already given us.