Privacy Policy

INTRODUCTION

This Privacy Policy describes how Frenchy Digital, L.L.C. ("we," "us," "our," or "the Company") collects, uses, discloses, stores, and protects information about you when you visit our website at frenchydigital.com (the "Site"), use our Services, or otherwise interact with us.

BY ACCESSING OR USING OUR SITE, MAKING ANY PAYMENT, OR ENGAGING WITH OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY AND CONSENT TO OUR COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED HEREIN.

If you do not agree with this Privacy Policy, you must immediately cease all use of our Site and Services.

This Privacy Policy is incorporated into and is subject to our Terms and Conditions. Capitalized terms not defined in this Privacy Policy have the meanings set forth in our Terms and Conditions.

1. INFORMATION WE COLLECT

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

a) Contact Us or Request Information:

• Full name
• Email address
• Phone number
• Company name and position
• Mailing address
• Nature of inquiry or project requirements
• Budget information
• Timeline and deadline information
• Any other information you choose to provide

b) Create an Account or Register:

• Username and password
• Profile information
• Account preferences
• Communication preferences

c) Make a Payment or Enter into a Contract:

• Full legal name and business name
• Billing address and shipping address
• Email address and phone number
• Payment information (credit card, debit card, bank account details)
• Tax identification numbers (EIN, VAT number)
• Purchase history and transaction details
• Contract and Work Statement information
• Project specifications and requirements

d) Apply for Employment:

• Resume/CV
• Cover letter
• Educational background
• Work history
• References
• Portfolio or work samples
• Social Security Number or other government identification (where legally required)

e) Participate in Surveys, Contests, or Promotions:

• Contact information
• Demographic information
• Preferences and opinions
• Any other information requested in the survey or promotion

f) Submit Content or Feedback:

• Comments, reviews, or testimonials
• Project files, documents, or media
• Feedback or suggestions
• Bug reports or support requests

1.2 Information Automatically Collected

When you visit our Site, we automatically collect certain information about your device and your interaction with our Site:

a) Device Information:

• IP address
• Browser type and version
• Operating system
• Device type (desktop, mobile, tablet)
• Device identifiers (device ID, advertising ID)
• Screen resolution
• Language preferences
• Time zone settings

b) Usage Information:

• Pages viewed and content accessed
• Time and date of visits
• Time spent on pages
• Click-through rates
• Navigation paths through the Site
• Links clicked
• Scroll depth and engagement metrics
• Search queries entered on the Site
• Referring website or source
• Exit pages

c) Location Information:

• General geographic location (country, state, city)
• Precise geolocation (if you grant permission)
• Location derived from IP address

d) Communication Information:

• Email open rates
• Email click-through rates
• Response times
• Communication preferences

1.3 Cookies and Tracking Technologies

We and our third-party partners use various technologies to collect information automatically:

a) Cookies:

Cookies are small text files stored on your device that help us recognize you and remember your preferences.

Types of Cookies We Use:

Essential Cookies:

• Required for the Site to function properly
• Enable core functionality like security, authentication, and accessibility
• Cannot be disabled without affecting Site functionality

Analytics Cookies:

• Help us understand how visitors use our Site
• Collect aggregated and anonymous information
• Track metrics like page views, bounce rates, and session duration
• Used by Google Analytics, Adobe Analytics, and similar services

Functionality Cookies:

• Remember your preferences and settings
• Enable personalized features
• Remember your login information
• Store your language and region preferences

Advertising/Marketing Cookies:

• Used to deliver relevant advertisements
• Track effectiveness of advertising campaigns
• Enable retargeting and remarketing
• Collect information about your browsing behavior across websites
• Used by Google Ads, Meta (Facebook) Ads, and other advertising platforms

Social Media Cookies:

• Enable social media features and sharing
• Track your interaction with social media plugins
• Used by Facebook, LinkedIn, Twitter, Instagram, and other platforms

b) Web Beacons and Pixels:

• Small graphic images (also known as "pixel tags" or "clear GIFs")
• Embedded in web pages, emails, and advertisements
• Track page views, email opens, and ad impressions
• Work in conjunction with cookies

Specific Pixels We Use:

• OpenAI Ads Measurement Pixel (oaiq, Pixel ID NxVBsgHsRqbwrgjmqNsF3D): Measures conversions from sponsored placements shown in ChatGPT. Detailed in Section 1.8 below
• Google Pixel/Google Tag Manager: Tracks conversions, user behavior, and enables remarketing
• Meta Pixel (Facebook Pixel, ID 410323133371326): Tracks user actions, measures ad effectiveness, and enables custom audiences
• LinkedIn Insight Tag: Tracks conversions and enables retargeting on LinkedIn
• Twitter Pixel: Tracks conversions and enables tailored audiences
• TikTok Pixel: Tracks user actions and enables ad optimization (if applicable)

Advertising and analytics technologies on this Site are gated on your cookie consent choices and are not loaded until you permit the relevant category. See Section 1.9 and our Advertising & Measurement Policy.

c) Local Storage:

• HTML5 local storage
• Session storage
• IndexedDB
• Similar technologies that store data on your device

d) Software Development Kits (SDKs):

• Third-party code libraries integrated into our mobile applications
• Collect usage data, crash reports, and analytics
• Enable third-party services and features

e) Server Logs:

• Automatically generated records of server activity
• Contain IP addresses, timestamps, requested resources, and HTTP response codes
• Used for security, troubleshooting, and analytics

1.4 Information from Third-Party Sources

We may receive information about you from third-party sources:

a) Business Partners and Affiliates:

• Referral information
• Joint marketing initiatives
• Co-branded services

b) Social Media Platforms:

• Profile information when you connect via social media
• Information you make publicly available on social platforms
• Friend lists and connections (with your permission)

c) Data Brokers and Marketing Partners:

• Demographic information
• Professional information
• Interest and behavior data
• Contact information for marketing purposes

d) Public Databases and Records:

• Publicly available business information
• Professional profiles and credentials
• Government records

e) Service Providers:

• Payment processors
• Fraud prevention services
• Identity verification services
• Credit reporting agencies

f) Analytics and Advertising Partners:

• Google Analytics demographics and interests data
• Cross-device tracking information
• Advertising network data

1.5 Information About Others

If you provide us with information about other individuals (such as employees, team members, or references), you represent and warrant that:

• You have obtained necessary consents
• You have authority to share their information
• You have informed them of how their information will be used
• You are responsible for any consequences of unauthorized disclosure

1.6 Sensitive Personal Information

We generally do not collect sensitive personal information such as:

• Social Security Numbers (except where required for employment or tax purposes)
• Financial account numbers (beyond payment processing)
• Health or medical information
• Biometric data
• Genetic data
• Precise geolocation (unless you explicitly consent)
• Information about children under 13 years old

If we need to collect sensitive information for specific purposes, we will obtain your explicit consent and explain the purpose clearly.

1.7 Automated Social Media and Content Delivery Pipeline

Frenchy Digital operates an automated content creation and publishing pipeline that powers our social media presence, our free builder resources, and our follow-up engagement. This section transparently discloses every data flow involved so you can make informed decisions about interacting with our content.

a) Free Resource Email Capture (/resources pages)

When you submit your email on any page under frenchydigital.com/resources/ to receive a free downloadable resource (such as our prompt libraries, playbooks, or system prompt templates), we collect and process:

• The email address you provided
• The keyword or resource slug identifying which resource you requested
• A SHA-256 hash of your IP address (not the raw IP) for abuse prevention
• Your browser user agent string and HTTP referer
• A Cloudflare Turnstile challenge token (privacy-preserving captcha, no PII)
• The timestamp of the submission

Purpose: to deliver the resource you requested via transactional email, to prevent abuse of the form, and to occasionally send you related educational content. We do NOT sell, share, or trade your email with any third party outside the processors listed below.

Storage: submissions are stored in our Supabase database (resource_leads table) hosted in the United States. Access is restricted to authenticated administrators via row-level security policies.

Retention: your email is retained until you request removal by emailing hello@frenchydigital.com or by clicking the unsubscribe link in any email we send.

b) Instagram and Facebook Comment-to-DM Automation

Our Instagram and Facebook carousels sometimes include engagement calls-to-action such as "Comment 'KEYWORD' below and I'll DM you [resource]." When you comment a matching keyword on one of our posts, an automated worker processes the comment and sends you a reply (either a Direct Message via the Instagram Private Reply API, or a public comment reply when DM is not available).

What is collected from Instagram/Facebook:

• Your Instagram/Facebook username (as provided by the Meta Graph API)
• The ID and text of the comment you made on our post
• The timestamp of the comment
• The ID of our media post the comment was made on
• Delivery metadata for our reply (message ID, public reply ID, success status)

Purpose: to auto-respond to public engagement with the specific resource you requested via your comment keyword, and to prevent sending you duplicate replies for the same comment.

Storage: the comment ID, username, keyword, and delivery metadata are stored in a private automation repository (dm_log.json) used solely for deduplication. No comment content is archived beyond what is needed to match the keyword.

Retention: 90 days maximum, after which records are rotated out of the deduplication log. You can always delete your comment on Instagram or Facebook directly.

Third parties: Meta Platforms, Inc. processes all comment data and messaging via the Instagram Graph API and Facebook Graph API. Your interactions with Meta's platforms are governed by Meta's own privacy policy at facebook.com/privacy/policy.

c) LinkedIn Integration (Company Page and Personal Profile)

We use the LinkedIn Marketing API and LinkedIn Posts API to publish educational content to the Frenchy Digital Company Page and to the personal LinkedIn profile of Chris Machetto (Founder). This is an outbound-only integration: we publish content, we do not collect data about members who view or interact with our LinkedIn posts beyond the public engagement metrics LinkedIn makes available to page administrators.

What is processed:

• OAuth access tokens and refresh tokens for Chris Machetto and any other authorized Company Page administrators
• Our own post content (text, images, carousel slides) submitted to LinkedIn for publishing
• Post IDs and permalinks returned by LinkedIn after publishing
• Aggregate engagement metrics (impressions, clicks, reactions) made available by LinkedIn to page administrators

LinkedIn scopes we request: openid, profile, email, w_member_social, and (pending approval) w_organization_social for Company Page posting. We do NOT request permissions to read your LinkedIn connections, messages, or profile beyond the authorized admin.

Your interactions with LinkedIn (viewing posts, reacting, commenting) are governed by LinkedIn's own privacy policy at linkedin.com/legal/privacy-policy.

d) Google Business Profile Integration

We use the Google Business Profile API to publish "What's New" posts to our Los Angeles business listing. This is also an outbound-only integration.

What is processed:

• OAuth tokens scoped to https://www.googleapis.com/auth/business.manage and held only by the authorized Frenchy Digital administrator
• Our own post content, images, and call-to-action metadata submitted to Google
• Post IDs and URLs returned by Google
• Aggregate Business Profile engagement metrics made available by Google

Your interactions with our Business Profile in Google Search and Maps are governed by Google's own privacy policy at policies.google.com/privacy.

e) AI-Assisted Content Generation (Anthropic Claude API)

The daily educational carousels and associated copy that we publish to Instagram, Facebook, LinkedIn, and Google Business Profile are drafted by Anthropic's Claude large language model via the Anthropic API, grounded in tech news aggregated from publicly-available RSS feeds (TechCrunch, The Verge, Ars Technica, MIT Technology Review, VentureBeat, Hacker News) and our own brand guidelines.

Important: we never send end-user personal data to Anthropic. Specifically:

• Email addresses submitted on resource pages are NOT sent to Anthropic
• Instagram/Facebook comment data from users is NOT sent to Anthropic
• LinkedIn member profile data is NOT sent to Anthropic
• Website visitor data is NOT sent to Anthropic
• Only public news headlines, our own brand guidelines, and our own content prompts are sent

Anthropic's processing of our API calls is governed by their privacy policy at anthropic.com/privacy and their commercial terms which prohibit using our API inputs for model training.

f) Complete List of Third-Party Data Processors

The following third-party processors are involved in operating our social media automation and resource delivery pipeline. Each is bound by their own data processing terms and privacy policies linked below:

• Supabase, Inc. — database, storage, and edge function hosting for resource leads and email delivery. supabase.com/privacy
• Resend, Inc. — transactional email delivery for resource downloads and follow-ups. resend.com/legal/privacy-policy
• Cloudflare, Inc. — R2 object storage for social media slide images (no PII), Turnstile captcha (privacy-preserving bot detection, no PII). cloudflare.com/privacypolicy
• Anthropic, PBC — Claude API for AI-assisted content drafting (no end-user PII sent). anthropic.com/privacy
• Meta Platforms, Inc. — Instagram and Facebook Graph API for publishing posts and processing comment-triggered auto-replies. facebook.com/privacy/policy
• LinkedIn Corporation — Posts API and Marketing Developer Platform for publishing to our Company Page and authorized personal profile. linkedin.com/legal/privacy-policy
• Google LLC — Business Profile API for publishing local business posts. policies.google.com/privacy
• Vercel Inc. — website hosting and content delivery (no PII processing beyond standard web server logs). vercel.com/legal/privacy-policy
• GitHub, Inc. (Microsoft) — GitHub Actions runner executes our daily automation pipeline in the cloud. No end-user PII is processed by the runner; only our own code and secrets. github.com privacy statement

If you wish to exercise any data subject right (access, deletion, rectification, portability, objection, restriction) with respect to any data processed through the pipeline described in this section, email hello@frenchydigital.com and we will respond within 30 days. See Sections 11 and 14 of this Privacy Policy for your full California (CCPA/CPRA) and EU/UK (GDPR) rights.

1.8 AI Advertising and Conversion Measurement (OpenAI Ads)

We advertise on AI platforms, including sponsored placements shown inside ChatGPT through OpenAI Ads. To understand which campaigns produce real enquiries, we operate conversion measurement technology on this Site. This section describes it in full. A plain-language overview is in our Advertising & Measurement Policy.

a) The OpenAI Ads Measurement Pixel

We deploy the OpenAI Ads measurement pixel (the oaiq SDK, served from bzrcdn.openai.com) under Pixel ID NxVBsgHsRqbwrgjmqNsF3D. Where you have permitted the Advertisement cookie category, it collects and transmits to OpenAI:

• OpenAI's privacy-preserving click identifier (oppref), read from the landing-page URL and stored in a first-party cookie named __oppref
• Event names describing what you did — for example page_viewed, lead_created, appointment_scheduled, registration_completed, order_created
• The URL of the page on which the event occurred, and a timestamp
• Where the event is a transaction, the amount and currency
• Your IP address and browser user-agent

Automatic advanced matching.This pixel operates with OpenAI's "automatic advanced matching" feature enabled (it is switched on by OpenAI by default at the pixel level). Where it is enabled, the pixel may automatically detect identifiers you enter into forms on this Site — most commonly an email address — and transmit them to OpenAI as an irreversibly hashed (SHA-256) value in order to match a conversion to an ad click. The raw value is not transmitted, and we do not receive any identity back from OpenAI as a result. This occurs only where you have permitted the Advertisement cookie category. If you would prefer that no such identifier be transmitted at all, refuse that category before submitting a form, or contact us at privacy@frenchydigital.com.

b) Server-Side Conversion Events (Conversions API)

We also transmit the same conversion events from our own servers to OpenAI's Conversions API, so measurement stays accurate when a browser blocks scripts. Each conversion carries a single shared event identifier, so the browser report and the server report are recognised as one conversion rather than two. Server-side events may additionally include your email address in irreversibly hashed (SHA-256) form only, where you have provided it to us. We apply the identical approach to Meta's Conversions API.

c) Limits We Place on This Sharing

• We do not transmit raw (unhashed) email addresses, phone numbers, or names to OpenAI or Meta
• We do not transmit the content of your enquiries, messages, documents, project specifications, or contracts to any advertising platform
• We do not transmit special-category or sensitive personal information for advertising purposes
• We do not attempt to re-identify any privacy-preserving identifier provided by an advertising platform
• Our server-side conversion reporting is gated on the same consent as the browser pixels — we do not report from the server what we would not report from the browser

d) OpenAI's Role and What We Receive

OpenAI, L.L.C. acts as our advertising measurement provider for this data and processes it under its own privacy policy, available at openai.com/policies/privacy-policy. OpenAI has stated that it does not share individual users' conversations or behavioural profiles with advertisers. We do not receive your ChatGPT conversations, prompts, or any profile of you from OpenAI. What we receive is aggregate campaign reporting: how many people clicked, and how many converted.

e) Legal Basis and Retention

Where the GDPR or UK GDPR applies, our legal basis for this processing is your consent (Article 6(1)(a)), which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal. Under the CCPA/CPRA this processing may constitute "sharing" of personal information for cross-context behavioural advertising, and you have the right to opt out (Sections 7.4 and 11). We retain advertising measurement data for no more than 24 months, after which it is deleted or aggregated so it no longer identifies an individual.

1.9 Consent Gating of Tracking Technologies

We use a CookieYes consent management platform to collect and record your cookie choices. Advertising and analytics technologies on this Site are conditioned on those choices as follows:

• The OpenAI Ads pixel and the Meta Pixel load only where you have permitted the Advertisement category. Until then the pixel software is not downloaded at all, rather than downloaded and silenced
• Google Analytics loads only where you have permitted the Analytics category, and runs under Google Consent Mode v2 so your choices are transmitted to Google as consent signals
• If you withdraw consent, we signal the withdrawal to the relevant platform and cease sending further events
• If our consent management platform fails to load for any reason, advertising and analytics technologies remain disabled

Where the law requires opt-in consent, these categories are off by default until you choose otherwise. Where the applicable law operates on an opt-out basis, the banner reflects that default and you may opt out at any time. We honour Global Privacy Control (GPC) browser signals as a valid opt-out of sharing for cross-context behavioural advertising.

You can review or change your choices at any time through the cookie preferences control on this Site.

2. HOW WE USE YOUR INFORMATION

We use the information we collect for various business purposes:

2.1 Providing and Improving Services

a) Service Delivery:

• Process and fulfill service requests
• Deliver contracted Services according to Work Statements
• Create and manage user accounts
• Provide customer support and respond to inquiries
• Send service-related communications and updates
• Process payments and manage billing
• Deliver project deliverables and work product

b) Service Enhancement:

• Analyze usage patterns and trends
• Identify areas for improvement
• Develop new features and services
• Test and optimize Site functionality
• Conduct research and development
• Enhance user experience and interface design

c) Personalization:

• Customize content and recommendations
• Remember your preferences and settings
• Provide personalized communications
• Tailor Services to your needs and interests

2.2 Marketing and Advertising

a) Direct Marketing:

• Send promotional emails and newsletters
• Provide information about new Services and offerings
• Share company news and updates
• Invite you to events and webinars
• Send special offers and discounts

b) Digital Advertising:

• Display targeted advertisements on third-party websites and platforms
• Conduct retargeting and remarketing campaigns
• Measure advertising effectiveness and ROI
• Optimize advertising spend and strategy
• Create lookalike audiences for customer acquisition

c) Advertising Platforms We Use:

Google Ads:

• Display ads on Google Search, Display Network, and YouTube
• Use Google Remarketing to show ads to past visitors
• Track conversions and user behavior with Google Pixel/Tag Manager
• Create custom audiences based on Site visitors and customer lists
• Use Google Analytics data for advertising purposes

Meta Ads (Facebook and Instagram):

• Display ads on Facebook, Instagram, Messenger, and Audience Network
• Use Meta Pixel to track user actions and conversions
• Create Custom Audiences from customer lists and Site visitors
• Create Lookalike Audiences to reach similar users
• Retarget visitors who did not complete desired actions
• Track cross-device behavior

LinkedIn Ads:

• Display ads to professionals on LinkedIn
• Target based on job titles, industries, and company information
• Use LinkedIn Insight Tag for conversion tracking
• Retarget website visitors on LinkedIn

Other Advertising Platforms:

• Twitter Ads
• Reddit Ads
• TikTok Ads (if applicable)
• Programmatic advertising networks
• Native advertising platforms

2.3 Analytics and Performance Tracking

a) Website Analytics:

• Monitor Site traffic and usage patterns
• Analyze user behavior and engagement
• Track conversion rates and funnel performance
• Identify popular content and features
• Measure Site performance and load times

b) Analytics Tools We Use:

• Google Analytics (including GA4)
• Google Tag Manager
• Meta Analytics and Facebook Analytics
• LinkedIn Analytics
• Mixpanel, Amplitude, or similar tools
• Heatmap and session recording tools (Hotjar, Crazy Egg)
• Custom analytics platforms

2.4 Communication and Customer Service

• Answer questions about Services
• Provide technical support
• Address billing inquiries
• Handle complaints and disputes
• Provide project updates
• Send transactional communications (order confirmations, invoices, receipts)

2.5 Security and Fraud Prevention

• Verify user identity
• Detect and prevent unauthorized access
• Monitor for suspicious activity
• Implement multi-factor authentication
• Detect and prevent fraudulent transactions
• Protect against cyber attacks and security threats

2.6 Legal and Compliance

• Comply with applicable laws and regulations
• Respond to legal process (subpoenas, court orders, warrants)
• Cooperate with law enforcement investigations
• Enforce our Terms and Conditions
• Protect our intellectual property rights
• Exercise our legal rights and remedies

3. HOW WE SHARE YOUR INFORMATION

We may share your information with third parties in the following circumstances:

3.1 Service Providers and Business Partners

We share information with trusted third-party service providers who perform services on our behalf:

a) Technology and Infrastructure Providers:

• Web hosting providers (e.g., AWS, Google Cloud, Vercel)
• Content delivery networks (CDN)
• Email service providers
• Cloud storage providers
• Database management services

b) Payment Processors:

• Stripe
• PayPal
• Bank and credit card processors
• Fraud detection services

c) Analytics and Advertising Providers:

• Google LLC: Google Analytics, Google Ads, Google Tag Manager, YouTube
• Meta Platforms, Inc.: Facebook, Instagram, Facebook Pixel, Audience Network
• LinkedIn Corporation: LinkedIn Ads, LinkedIn Insight Tag
• Twitter, Inc.: Twitter Ads, Twitter Pixel
• Other advertising networks and platforms

d) Marketing and Communication Tools:

• Email marketing platforms (Mailchimp, SendGrid, Constant Contact)
• CRM systems (Salesforce, HubSpot)
• Marketing automation tools

Contractual Protections:

• Service providers are contractually obligated to protect your information
• They may only use information for specified purposes
• They must comply with applicable privacy laws
• They must implement appropriate security measures

3.2 Social Media Platforms

When you interact with social media features on our Site:

• Social media platforms receive information about your visit
• They can track your interaction with their plugins
• They may associate this data with your social media profile
• Platforms include: Facebook, Instagram, LinkedIn, Twitter, YouTube

3.3 Business Transfers

In the event of a corporate transaction, your information may be transferred:

• Merger or acquisition
• Sale of all or substantially all assets
• Bankruptcy or insolvency proceedings
• Corporate reorganization or restructuring

3.4 Legal Requirements and Protection of Rights

We may disclose your information when required by law or to protect our rights:

• Comply with subpoenas, court orders, or legal process
• Respond to government or regulatory requests
• Comply with law enforcement investigations
• Enforce our Terms and Conditions
• Protect the safety and security of users
• Prevent harm to persons or property

3.5 Aggregated and De-Identified Information

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with business partners, industry organizations, and the general public.

4. DATA RETENTION

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

4.1 Retention Periods

• Account Information: Duration of account plus 7 years after account closure
• Transaction and Payment Information: 7-10 years after transaction
• Contract and Project Information: Duration of project plus 7-10 years
• Marketing and Communication Data: Until you opt out or 3 years of inactivity
• Website Analytics and Usage Data: 26-50 months
• Advertising and Cookie Data: 30 days to 2 years
• Customer Support Records: 3-7 years after last interaction
• Security and Fraud Prevention Data: 7 years or as required by law

4.2 Secure Deletion

When retention periods expire, information is securely deleted or anonymized using industry-standard methods. Aggregated and anonymized data may be retained indefinitely.

5. DATA SECURITY

We implement comprehensive security measures to protect your information:

5.1 Technical Security

• Encryption: SSL/TLS encryption for data in transit, AES-256 encryption for sensitive data at rest
• Access Controls: Role-based access control (RBAC), multi-factor authentication, strong password requirements
• Network Security: Firewalls, intrusion detection systems, DDoS protection
• Application Security: Secure coding practices, regular security updates, protection against OWASP Top 10 vulnerabilities

5.2 Payment Security

• We comply with Payment Card Industry Data Security Standard (PCI DSS)
• Use certified payment processors (Stripe, PayPal)
• Tokenization of payment information
• Do not store complete credit card numbers

5.3 Security Limitations

WE CANNOT AND DO NOT GUARANTEE THAT INFORMATION TRANSMITTED THROUGH THE INTERNET OR STORED IN OUR SYSTEMS WILL BE COMPLETELY SECURE. ANY TRANSMISSION OF INFORMATION IS AT YOUR OWN RISK. WE ARE NOT RESPONSIBLE FOR CIRCUMVENTION OF ANY SECURITY MEASURES OR PRIVACY SETTINGS.

5.4 Security Incidents

If you suspect unauthorized access to your account, change your password immediately and contact us at legal@frenchydigital.com.

6. YOUR RIGHTS AND CHOICES

6.1 Access and Portability Rights

You have the right to request:

• Confirmation of what personal information we hold about you
• Copies of your personal information
• Details about how we use your information
• Information about who we share your data with

How to Request: Email legal@frenchydigital.com with subject line "Data Access Request"

6.2 Correction and Update Rights

You have the right to correct inaccurate or update incomplete personal information. Email legal@frenchydigital.com to request corrections.

6.3 Deletion Rights (Right to be Forgotten)

You may request deletion of your personal information in certain circumstances. Email legal@frenchydigital.com with subject line "Data Deletion Request".

Limitations on Deletion: We may retain information when required by law, necessary for legal claims, for contract enforcement, or for fraud prevention.

6.4 Marketing Opt-Out

• Click "unsubscribe" in any marketing email
• Email legal@frenchydigital.com with "Unsubscribe" in subject line
• We will process opt-out requests within 10 business days
• You will still receive transactional emails (receipts, invoices, service notifications)

6.5 Complaint Rights

If you believe we have violated your privacy rights, contact us first at legal@frenchydigital.com. If not satisfied, you may contact your local privacy regulator or data protection authority.

7. ADVERTISING AND TRACKING OPT-OUT

7.1 On This Site

The most direct control is the cookie preferences control on this Site: refusing the Advertisement category stops the OpenAI Ads pixel and the Meta Pixel from loading, and stops the corresponding server-side conversion reporting. Refusing the Analytics category stops Google Analytics. You can change these choices at any time, and withdrawal takes effect immediately. See Section 1.9.

We honour Global Privacy Control (GPC) browser signals as a valid opt-out of the sharing of personal information for cross-context behavioural advertising. You can also adjust cookie settings in your browser, block third-party cookies, and use privacy-focused browsers.

7.2 Platform-Specific Opt-Outs

• OpenAI / ChatGPT: Manage ad personalization and data controls in your ChatGPT account settings, and see openai.com/policies/privacy-policy
• Google Ads: Visit myadcenter.google.com
• Google Analytics: Install the Google Analytics opt-out browser add-on
• Meta (Facebook): Visit facebook.com/ads/preferences
• LinkedIn: Visit linkedin.com/psettings/enhanced-advertising

7.3 Industry Opt-Out Tools

• Network Advertising Initiative: optout.networkadvertising.org
• Digital Advertising Alliance: optout.aboutads.info
• European Users: youronlinechoices.eu

7.4 Do Not Sell/Share (California Residents)

We do not sell personal information for money. However, our use of advertising pixels (including the OpenAI Ads and Meta pixels described in Section 1.8) may constitute "sharing" of personal information for cross-context behavioural advertising under the CCPA/CPRA. California residents may opt out of that sharing.

To opt out: refuse the Advertisement category in our cookie preferences control, send a Global Privacy Control signal from your browser, or email legal@frenchydigital.com with the subject line "Do Not Sell/Share My Personal Information". We will not discriminate against you for exercising this right.

8. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to, stored, and processed in:

• United States (primary data center location)
• Other countries where we or our service providers operate
• Cloud infrastructure spanning multiple regions

Transfers are conducted using appropriate legal mechanisms including standard contractual clauses and other approved transfer mechanisms.

9. CHILDREN'S PRIVACY

Our Site and Services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at legal@frenchydigital.com.

9.2 International Service Providers

We use service providers located in various countries: United States, European Union, United Kingdom, Canada, and other jurisdictions as necessary for Services. These providers are required to implement appropriate safeguards, comply with applicable privacy laws, and protect your information according to our standards.

9.3-9.5 Privacy Shield, SCCs, and Transfer Rights

Privacy Shield frameworks have been invalidated; we use Standard Contractual Clauses (SCCs) approved by the European Commission and implement supplementary measures. You may request information about international transfers or object to transfers by emailing legal@frenchydigital.com with subject "International Transfer Inquiry."

10. CHILDREN'S PRIVACY

Our Services are not directed to children under 13. We do not knowingly collect information from children under 13 or sell information of children under 16. If we learn we have collected such information without parental consent, we will delete it promptly. Parents may contact legal@frenchydigital.com with subject "Children's Privacy Request."

11. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

California residents have rights to: know what personal information we collect, request deletion, correct inaccuracies, opt-out of sale/sharing, limit use of sensitive personal information, and not be discriminated against. Submit requests to legal@frenchydigital.com with subject "California Privacy Rights Request." We respond within 45 days (may extend to 90 days).

12-13. NEVADA AND OTHER STATE PRIVACY RIGHTS

Residents of Nevada, Virginia, Colorado, Connecticut, Utah, and other states with privacy laws may have additional rights including: confirmation of processing, access, correction, deletion, data portability, and opt-out rights. Submit requests to legal@frenchydigital.com with subject "[State] Privacy Rights Request."

14. EU/EEA/UK GDPR RIGHTS

If located in the EU, EEA, or UK, GDPR applies. You have rights to: information, access, rectification, erasure, restriction, data portability, object to processing, and rights related to automated decision-making. Contact our Data Protection Officer at legal@frenchydigital.com with subject "GDPR Rights Request." We respond within 30 days (may extend to 90 days). You may lodge complaints with your supervisory authority.

15-18. POLICY CHANGES, THIRD PARTIES, AND DO NOT TRACK

We may modify this Privacy Policy at any time. Material changes will be communicated via prominent notice and email. Third-party links, social media features, payment processors, and cloud services are subject to their own privacy policies. We do not currently respond to Do Not Track signals.

19. CONTACT INFORMATION

20. LEGAL DISCLAIMER AND LIMITATIONS

20.1 No Guarantees of Privacy

WE MAKE NO GUARANTEES, REPRESENTATIONS, OR WARRANTIES REGARDING:

• Absolute privacy or security of information
• Prevention of all unauthorized access
• Complete protection against all threats
• Effectiveness of all security measures

Limitations: No system is 100% secure. Determined attackers may circumvent security. Human error can compromise security. Third-party vulnerabilities are outside our control.

20.2 Third-Party Responsibility

WE ARE NOT RESPONSIBLE FOR:

• Privacy practices of third parties
• Security of third-party systems
• Third-party data breaches
• Actions of third-party service providers
• Content or practices of linked websites

20.3 User Responsibility

YOU ARE RESPONSIBLE FOR:

• Maintaining confidentiality of passwords
• Security of your devices and networks
• Reviewing privacy settings
• Exercising available opt-out choices
• Reading and understanding this Privacy Policy

20.4-20.7 Legal Compliance, Changes in Law, International Users, Limitation of Liability

We may disclose information as required by law or to protect our rights. Privacy laws change frequently and new regulations may affect our practices. For users outside the United States, information may be transferred to the U.S. where privacy laws may differ. To the maximum extent permitted by law, we are not liable for privacy breaches beyond our control, third-party data handling, or user security failures. See our Terms and Conditions for additional limitation provisions.

21. ACCEPTANCE OF PRIVACY POLICY

21.1 Agreement to Privacy Policy

BY USING OUR SITE OR SERVICES, YOU AGREE TO:

• This Privacy Policy in its entirety
• Our collection, use, and disclosure of your information as described
• Transfer of information as described
• Our use of cookies and tracking technologies
• Third-party data sharing as described

21.2 Incorporation into Terms and Conditions

This Privacy Policy is incorporated into and subject to our Terms and Conditions. Terms and Conditions govern in case of conflict. Both documents constitute the agreement. Violations may result in termination of Services.

21.3 Voluntary Disclosure

YOU ACKNOWLEDGE THAT:

• Providing information to us is voluntary
• Refusal to provide information may limit Services
• You are responsible for accuracy of information provided
• You have authority to provide information about others

21.4 Consent to Processing

BY USING OUR SERVICES, YOU CONSENT TO:

• Processing of your personal information
• International transfer of information
• Use of cookies and tracking technologies
• Receipt of marketing communications (until you opt out)
• Sharing with third parties as described

21.5 Right to Refuse

YOU HAVE THE RIGHT TO:

• Refuse to provide information (may limit Services)
• Opt out of marketing communications
• Opt out of certain data sharing
• Exercise privacy rights as described herein
• Stop using our Services

22. EFFECTIVE DATE AND VERSION

This Privacy Policy supersedes all previous versions and is effective immediately upon posting.

23. ACKNOWLEDGMENT

BY ACCESSING OR USING OUR SITE OR SERVICES, YOU ACKNOWLEDGE THAT:

IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, YOU MUST IMMEDIATELY CEASE ALL USE OF OUR SITE AND SERVICES.

© 2026 FRENCHY DIGITAL, L.L.C. All rights reserved.

IMPORTANT NOTICE: This Privacy Policy is a legal document. Please read carefully. Your use of our Site or Services constitutes acceptance of this Privacy Policy. We may update this Privacy Policy at any time. Continued use after changes constitutes acceptance of the updated Privacy Policy.

Questions or concerns? Contact us at: legal@frenchydigital.com