Privacy Policy & Data Protection Notice

1 Statutory Framework & Scope

This Privacy Policy and Data-Use Notice governs the processing of digital personal data by FRANK Think (hereinafter "FRANK Think", "we", "us", or "the Platform"). This policy is formulated in direct compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules) enacted by the Parliament of India.

Under the DPDP Act, you are recognized as a Data Principal — the individual to whom the personal data relates — and FRANK Think operates as the Data Fiduciary determining the purpose and means of processing your digital personal data.

2 Data Fiduciary & Grievance Redressal Officer

Pursuant to Section 8(9) and Section 13 of the DPDP Act, 2023, FRANK Think has designated an official Grievance Redressal Officer and Data Protection Office for addressing inquiries, rights requests, and privacy grievances:

If you are unsatisfied with the resolution provided by our Grievance Redressal Officer, you possess the statutory right under Section 13(3) of the DPDP Act to submit an appeal to the Data Protection Board of India (DPBI).

3 Categories of Personal Data Collected

Based on the actual operational architecture of FRANK Think, we collect and process only the minimum digital personal data strictly required to deliver real-time communication services:

4 Purposes of Processing & Legal Bases

In accordance with Chapter II of the DPDP Act, personal data is processed under distinct, legally grounded bases. We distinguish strictly between core contractual processing and optional consent-based activities:

5 Storage, Retention & Staged Account Erasure

Your personal data is securely stored within our production relational database (PostgreSQL) hosted in secure cloud infrastructure. Uploaded media and documents are stored in protected server storage with strict access authorization filters.

Retention Schedule: Personal data is maintained only for as long as your account remains active, or as required by statutory retention exceptions under Section 8(7) of the DPDP Act (such as compliance with legal obligations or dispute defense).

6 AI Model Processing & Third-Party Disclosures

FRANK Think integrates conversational intelligence capabilities through the Google Gemini API for users who actively utilize the "Smart Conversation" feature. In complete accordance with DPDP transparency mandates:

• No Training on Your Conversations: Message content is transmitted strictly for real-time inference over TLS and is never used to train or fine-tune public foundation models.
• Automated Data Minimization: Before transmission to the AI provider, text is sanitized to redact detected emails, phone numbers, and credentials.
• Consent Withdrawal Protection: If you withdraw consent for AI processing in your Privacy Dashboard, the platform automatically halts AI transmissions and falls back to our local, on-premise deterministic NLP algorithms.

Authorized Third-Party Service Providers:

7 Security & Encryption Architecture

FRANK Think implements rigorous technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction:

• Transport Encryption: 100% of network traffic, HTTP APIs, and WebSocket streams are encrypted using industry-standard TLS 1.3.
• Cryptographic Password Hashing: Passwords are hashed using salted PBKDF2-HMAC-SHA256 with 100,000 rounds. Plaintext passwords are never recorded in logs or database tables.
• Token Authentication: Sessions are secured through cryptographically signed HS256 JWT tokens with automatic expiration.
• Authorization Controls & Insecure Direct Object Reference (IDOR) Protections: Backend APIs enforce multi-tier participant verification on all chat threads and document downloads. Users cannot access unauthorized conversations or attachments.
• Accurate Architectural Statement: In strict compliance with regulatory honesty, FRANK Think stores messages in its database to support multi-device synchronization and document collaboration; we do not make false claims of proprietary end-to-end encryption.

7B Cookies & Local Storage Governance

FRANK Think utilizes browser local storage and cookies strictly in accordance with purpose limitation and transparency requirements under the DPDP Act, 2023:

8 Data Principal Rights & How to Exercise Them

Under Chapter III of the DPDP Act, 2023, you enjoy statutory rights regarding your digital personal data. FRANK Think provides direct self-service tools inside your account settings to exercise these rights:

9 Age Verification & Protection of Children

Under Section 9 of the DPDP Act, 2023, Data Fiduciaries must observe strict duties before processing any personal data of children (defined as individuals under 18 years of age):

• Service Intended for Adults: FRANK Think is designed for users aged 18 years and above. During registration, users are required to confirm their age.
• Verifiable Parental Consent: If an individual under 18 registers, processing of their data requires verifiable parental consent pursuant to DPDP Rules.
• No Detrimental Processing or Tracking: FRANK Think strictly prohibits behavioral tracking, targeted profiling, or any processing that could cause detrimental effects on the well-being of a child.
• Privacy-Preserving Verification: In compliance with data minimization principles, FRANK Think does not collect government ID documents solely for general age verification without a demonstrated legal necessity.

10 Personal Data Breach Management & Notification

Under Section 8(6) of the DPDP Act, in the event of a personal data breach impacting confidentiality, integrity, or availability:

1. Identification & Containment: Incidents are immediately registered in our internal breach management register and assigned to the incident response team.
2. Impact Assessment: Forensic review determines the nature of the breach, affected systems, and number of potentially impacted Data Principals.
3. Statutory Notification to DPBI: Notice is provided to the Data Protection Board of India in accordance with the timelines and format prescribed under the DPDP Rules.
4. Notice to Affected Data Principals: Directly affected users are notified without unreasonable delay with clear remediation steps and recommended protective measures.

11 Legal Phasing & Commencement Schedule

The DPDP Act, 2023 was notified in August 2023, and the subordinate DPDP Rules, 2025 operate on a phased commencement schedule. FRANK Think continuously maintains compliance across: