Privacy Policy

Last updated: 2 November 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

2. Overview

FrankKi is an iOS app that lets you write real letters and send them by post. You can write letters yourself or have an AI help you phrase them. FrankKi arranges for your letter to be printed, enclosed and handed over to the relevant postal delivery service. It sends real physical letters worldwide straight from your iPhone, with no printer and no post office.

You can also prepare a letter without signing in through our website or the FrankKi connection in ChatGPT and pay for it through Stripe. Section 3.12 covers this guest option alongside the general information in this policy.

We follow the principle of data minimisation (Art. 5(1)(c) GDPR). We only process the personal data we need for our service and for the statistics described here. We do not use any advertising networks or social media plugins. Section 3.8 describes the usage statistics of the app, section 3.10 the audience measurement on our website.

3. Data processing in detail

3.1 Apple sign-in ("Sign in with Apple")

To use the app, you sign in with your Apple ID. In doing so, we receive the following data from Apple:

• Your Apple user ID (a unique, anonymous identifier)
• Your email address (or a private relay address from Apple if you choose "Hide My Email")
• Whether your email address has been verified by Apple

On this basis we create a user account and a session (JWT token, valid for 30 days). Verification is carried out via Apple's public keys (JWKS). We do not store any password.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.2 Addresses

You can save sender and recipient addresses in the app. These include: name, company if applicable, street, postal code, city and country. The addresses are needed to address your letter correctly and to transmit it to the service providers used for printing and delivery.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.3 Letter creation and AI assistance

In the iOS app, you can write letters yourself or have an artificial intelligence (AI) help you phrase them. When you use the AI feature, you describe your request in your own words. Based on this description, a language model from OpenAI generates a letter draft.

What is transmitted to OpenAI: the content you provide for letter creation. This includes your description of the request, your answers to follow-up questions, any documents you upload and, when you use the "understand a letter" feature, the image and text of the letter you scan. This content can include personal data that you provide yourself (for example names, addresses, reference numbers or contract details). We transmit it solely to create your letter or to explain a letter you received. Your technical account and sign-in data (Apple ID, email address, Stripe payment data) are not transmitted to OpenAI. Before transmission, a security filter checks the content for harmful patterns (threats, fraud, hate speech).

You review and edit the AI-generated text before it is sent. There is no automated decision-making within the meaning of Art. 22 GDPR (see section 10).

We have a data processing agreement (Data Processing Addendum) with OpenAI (OpenAI Ireland Ltd. or OpenAI, L.L.C., USA). The content may be processed in the USA. This transfer is based on the EU Commission's standard contractual clauses under Art. 46(2)(c) GDPR, which are part of the Data Processing Addendum. OpenAI processes the content only on our behalf and does not use it to train its own models. To detect abuse, OpenAI may keep the content for up to 30 days and deletes it afterwards.

For letters that business accounts send from the partner area or over MCP, OpenAI's moderation interface also checks the letter text for abuse, such as threats or fraud. The data processing agreement with the business account and the list of subprocessors (in German) apply to this.

Special categories of personal data (Art. 9 GDPR): FrankKi is not designed for the processing of special categories of personal data (e.g. health, religious, trade union or employee data). Please do not enter any such data in the AI-assisted request description. Should special categories of personal data nevertheless be processed, this is done exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time with effect for the future.

No legal services: the AI feature is a tool for drafting text in your own matter. FrankKi does not provide any legal services within the meaning of the German Legal Services Act (RDG) and no legal advice. For legal assessments we recommend consulting a lawyer.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); information obligation pursuant to Art. 13(2)(f) GDPR; additionally Art. 9(2)(a) GDPR for special categories of personal data

3.4 PDF creation and storage

In the iOS app, your letter is generated on your device as a PDF in the DIN 5008 format (client-side). For dispatch, the PDF is uploaded to our server and stored there temporarily until printing is complete. After successful processing by the fulfillment provider, the PDF is deleted.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.5 Letter dispatch via our fulfillment and delivery providers

Depending on the destination country and availability, LetterXPress GmbH(Germany) or Pingen AG (Switzerland) handles physical printing, enclosing and handover to the postal delivery service. Letters within Germany are generally processed through LetterXPress; we use Pingen for letters sent abroad. If LetterXPress is unavailable, Pingen may also be used as a fallback for German letters. Postal delivery is carried out by Deutsche Post AG or the respective delivery service of the destination country. For this purpose, we transmit the following data to the provider used:

• The PDF of your letter
• The sender and recipient addresses (name, company if applicable, street, postal code, city, country)
• The chosen shipping method (e.g. standard letter, registered letter by deposit, registered letter with handover)
• Print options (colour/black and white, letter format)

LetterXPress and Pingen process this data exclusively on our behalf. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with each fulfillment provider. If Pingen is used and data is transferred to Switzerland, the transfer takes place on the basis of the EU Commission's adequacy decision for Switzerland (Art. 45 GDPR).

After printing, we receive status updates (printed, sent, delivered) from the providers used, which we display to you in the app.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); Art. 28 GDPR (processing on behalf); Art. 45 GDPR (adequacy decision for Switzerland)

3.6 Payment processing (Stripe)

In the iOS app, each letter is paid for directly. Per letter, without tokens or a subscription. Payment processing is handled by Stripe, Inc. (USA). Stripe provides the payment form and processes your payment data (credit card, Apple Pay). We receive from Stripe:

• A Stripe customer ID (created once for your account)
• The PaymentIntent ID and charge ID of each transaction
• The payment status and timestamp

We do not receive any card data (credit card number, security code, bank details). This remains exclusively with Stripe. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework as well as additional standard contractual clauses (Art. 46(2)(c) GDPR). You can find Stripe's privacy policy at stripe.com/privacy.

For paid iOS app orders, we create an invoice PDF when requested (§19 UStG, small-business scheme) with a sequential invoice number (FK-YYYY-NNNN). The invoice is stored on our servers and made available to you on request. Statutory retention obligation: 10 years (§147 AO).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); Art. 46(2)(c) GDPR (SCCs for Stripe/USA)

3.7 Push notifications

With your explicit consent we send you push notifications via the Apple Push Notification service (APNs). For this purpose we store:

• Your APNs device token (an anonymous, device-specific identifier)
• The app version and the environment (production/sandbox)

We send you notifications about: status updates of your letters (printed, sent, delivered), completion of the AI letter creation and confirmation of payments. You can disable push notifications at any time in the iOS settings.

Legal basis: Art. 6(1)(a) GDPR (consent)

3.8 Usage statistics

We measure how the app is used so we can see where people get stuck on their first letter and fix those spots. There are two ways, and we run both ourselves. We do not use Google Analytics, Firebase or advertising networks.

Events to our server. The app sends events such as opening a screen, creating a letter or completing a payment to backend.frankki.app. An event carries details of the action, such as the delivery option, page count, price or order number, plus the app version, iOS version, device model and a session ID that is new on every app start. If you are signed in with Apple, we store the events with your user ID.

Revtrail in the app. The app also sends usage events to Revtrail, our own analytics service on Cloudflare Workers. An event records which screen you open, which step of your first letter you reach, when you start checkout, whether the payment goes through, is cancelled or fails, whether the letter was sent, and how you answer the prompt for notifications, location or the camera. Each upload carries the app version, build number, iOS version, device model, language and region setting, and an install ID. The install ID is a random identifier that the app creates on every start and keeps only in memory, so every launch gets a new one. The app stores nothing for Revtrail on your device.

When the app starts, it asks Apple for an Apple Ads attribution token and sends it to Revtrail. Revtrail passes the token to Apple, which answers whether the install came from an Apple Ads campaign. Revtrail derives your country, region and city from the IP address of the request. It does not store the IP address.

When you pay for a letter, the app sends the install ID with the order to our server. We attach it to the payment at Stripe. Stripe then reports the payment to Revtrail with the amount, currency, Stripe customer ID and, if there is one, the email address for the payment receipt. That shows us which path through the app led to a payment, and it ties the events of that app launch to the payment.

Letter text, subject lines, AI descriptions, addresses, names, documents, photos and recipient data never go to Revtrail. The app reads no advertising identifier and does not track you across other apps or websites. Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, processes the Revtrail data for us under its data processing addendum with EU standard contractual clauses, and is certified under the EU-US Data Privacy Framework. We keep the raw Revtrail data for up to 24 months.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in making the app, and the first letter in particular, easier to use)

3.9 Feedback

You can voluntarily send us feedback through the app. In doing so, your message is stored together with your user ID so that we can get back to you with any follow-up questions. Providing this is voluntary.

Legal basis: Art. 6(1)(a) GDPR (consent)

3.10 Website

Our website (frankki.app) provides information about the app and contains a blog. We do not use tracking cookies, advertising networks or social media plugins. No external fonts (e.g. Google Fonts) are loaded. Revtrail measures audience on the public pages. In the partner area it measures only the pages for sign-up, sign-in, setup, balance top-up and the letter wizard. On every other page of the partner area your browser sends nothing to Revtrail.

Our own analytics (Revtrail). Revtrail is our own analytics service, which we run on Cloudflare Workers. The processor is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. We have a data processing addendum with Cloudflare that includes EU standard contractual clauses, and Cloudflare is also certified under the EU-US Data Privacy Framework. We record the address of the page visited, the referrer, UTM parameters, browser, operating system, device type, country, region and city (derived from the IP address), clicks on marked buttons and on links to other websites, the steps you reach in the letter form (form filled in, preview seen, checkout started or cancelled), errors in that flow (a price that could not be loaded, a rejected attachment, an error when starting the payment), downloads of a template file, and the time spent on the page. In the partner area we also record clicks on "Create account", the setup steps, the top-up form, the choice of a template, the start of a send and clicks on connecting an AI agent. From these pages Revtrail stores only the path, and the path contains no IDs. For all events we store only fixed short values such as the step, the role you picked at sign-up, or the reason for the error. Letter content, subject lines, recipients, addresses, names, email addresses, prices, search terms, clients (Mandanten) and account data never go to Revtrail. We do not store the IP address itself. It is combined with the user agent and a salt that changes every day into a hash, so a visit cannot be linked to the same person on another day. This measurement sets no cookies and stores nothing on your device, so no consent is required (§ 25 TDDDG does not apply). We keep the raw data for up to 24 months. If you pay for a letter on the website, your browser sends that day's visitor ID with the order to our server. We attach it to the payment at Stripe. Stripe then reports the payment to Revtrail with the amount, the currency and, if present, the email address for the payment confirmation. This shows us which page led to a payment. The same applies to a balance top-up in the partner area.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding which pages and channels work)

For the internal administration area we use a technically necessary session cookie ("admin_session", valid for 7 days, HttpOnly, SameSite=Lax). This cookie is exempt from the consent requirement pursuant to § 25(2) TDDDG, as it is technically strictly required for the operation of the service.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest); § 25(2) TDDDG

3.11 Server log data

Each time our servers are accessed, the following data is automatically stored in log files:

• IP address of the requesting device
• Date and time of access
• Endpoint accessed and HTTP method
• User agent (browser/app identifier)
• HTTP status code and request ID

This data is used to ensure operation, to detect misuse and for rate limiting (max. 60 requests/minute). It is not combined with other data sources.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security)

3.12 Guest letters through the website and ChatGPT

For a guest letter, we process the subject and letter text, sender and recipient addresses, any attachments uploaded on the website, language, delivery method and print options. We store the draft and addresses in our database and the resulting PDF in object storage. The service gives you a draft token and a tracking token. We store hashes of those tokens in the database. Preview pages use links that expire. Anyone who has one of these links or tokens can access the data it permits, so keep them private.

When we create a checkout link, we limit requests using a hash of the caller's IP address. Stripe collects your email address, billing address and payment details in Checkout. We send Stripe the price, selected language, technical draft identifiers and a short description with the recipient's name and town. The description does not include the street address or letter text. After Checkout, we store your email address, its hash, the payment identifier and order status. We do not receive full card details.

A local content check may refuse a letter or hold it for a person to review. For a review, we store the letter text, the reason for review and the decision. We do not send the letter to the print provider before approval. After approval, the print and postal provider handling the order receives the PDF and the address and order details needed for dispatch. Pingen or LetterXPress handles the printing and dispatch. We send order, review and delivery messages to your Checkout email address. Our email provider Resend may process those messages. After capture, we email the invoice PDF to the same address. Alerts in the internal admin area may contain order identifiers and your email address. Review alerts sent to Telegram include the order ID, amount, destination country, rule IDs and an internal admin link. If a guest email fails, Telegram receives the order ID and a masked email address. We do not send the letter subject, text or full email address to Telegram.

If you use the ChatGPT connection, ChatGPT receives the results of the tools you call. These may include addresses, draft and tracking tokens, preview links, checkout links and order status. FrankKi does not itself call an OpenAI model to write or screen letters in these guest tools. FrankKi is the controller for all data its MCP server receives and stores. OpenAI is a separate controller for your ChatGPT conversation and what it does with tool results. FrankKi does not decide how OpenAI stores or uses conversations. See OpenAI's privacy policy.

We process letter text and addresses under Art. 6(1)(b) GDPR. Local screening, human review, IP hashes, rate limits and security logs rely on Art. 6(1)(f) GDPR. They protect a service anyone can use without an account from abuse and fraud. We keep order and invoice records under Art. 6(1)(c) GDPR with section 147 AO and section 257 HGB.

An unpaid draft expires after 24 hours. A held review extends that period to at least eight days; approval may add another 48 hours. Each hour we delete expired drafts without a checkout link or order, including their PDFs. If a draft has a checkout link but never becomes a paid order, we remove its text, addresses and PDF 30 days after expiry. We delete orphan PDFs with no draft, letter or order reference after nine days.

For a guest order, we erase letter text, addresses and PDF from the letter record, draft versions and review case 120 days after the order reaches a final status. We keep the order number, amount, currency, date, payment identifier, billing country, status and invoice for the ten-year tax period. Review rules, status and decision history stay for twelve months. We erase the content of rejected or never-paid reviews 30 days after the decision. We remove the checkout IP hash after 30 days and its email hash with the letter content after 120 days. We delete account-link tokens 30 days after expiry. We anonymize unlinked guest accounts three years after their last order. If an invoice still needs the email address, we keep only that address until its ten-year retention period ends.

We use Stripe for payment, Pingen or LetterXPress for printing, and Resend for email. Our object storage runs MinIO; a server managed with Coolify hosts the application. Axiom receives operational logs if configured, and Telegram receives operator alerts. Provider copies, logs and backups follow each provider's retention rules. We cannot give one period for those copies.

You can exercise the rights in section 7 without an app account. Write to datenschutz@frankki.app. If possible, include your order number or the email address you used at Checkout so we can find your order.

3.13 Business accounts and connecting an AI assistant

With a FrankKi business account you can connect FrankKi to an AI assistant, for example Claude by Anthropic or ChatGPT by OpenAI. The connection uses the Model Context Protocol (MCP) at mcp.frankki.app. You sign in through a FrankKi window and confirm which permissions the assistant gets.

What we store when you connect: the name and callback address the assistant registers with, the permissions you granted and the time. The assistant gets an access key that is valid for one hour and a refresh key that expires 90 days after it was last used. You can disconnect in your assistant or ask us to revoke the keys.

What the assistant sends us: whatever you give it for your letter, for example letter text, recipient and sender addresses, templates, uploaded PDFs or your website address, from which we read your logo and colours. We process this data the same way as letters from the dashboard (sections 3.2 to 3.5). Before sending, the letter text goes through OpenAI's abuse check (section 3.3). The assistant receives our tools' answers, such as page images, prices and delivery status.

What we log: for every tool call we store an entry with the tool, the time, the result, the cost, the order number and a checksum of the inputs. The inputs themselves are not stored there. If the assistant sends a short reason for the call, the entry includes it. The entries cannot be changed and serve as proof of which connection triggered which letter.

What the assistant itself does with your input is up to its provider, under its own responsibility: Anthropic for Claude, OpenAI for ChatGPT. Letters from a business account are also covered by the data processing agreement you sign during setup. For questions, write to datenschutz@frankki.app.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 28 GDPR (processing on behalf)

4. Recipients and processors

The following overview describes the iOS app. Section 3.12 names the recipients of guest data:

Apple acts as an independent controller within the meaning of the GDPR for authentication, not as our processor.

5. Transfers to third countries

Data may be transmitted to recipients in Switzerland and in the USA:

• Switzerland (Pingen): if Pingen is used for letter dispatch, the transfer takes place on the basis of the EU Commission's adequacy decision for Switzerland pursuant to Art. 45 GDPR. Separate safeguards are not required.
• USA (Stripe, Cloudflare, Apple): the transfer takes place on the basis of the EU Commission's adequacy decision for the EU-US Data Privacy Framework (DPF) pursuant to Art. 45 GDPR. Stripe, Cloudflare and Apple are certified under the DPF. In addition, standard contractual clauses (SCCs) pursuant to Art. 46(2)(c) GDPR are in place with Stripe and Cloudflare as an additional safeguard.
• USA (OpenAI): the transfer takes place on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR, which are part of the Data Processing Addendum with OpenAI.

6. Retention period

The following periods describe use of the iOS app. Section 3.12 covers guest letters:

7. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15 GDPR): you have the right to find out which data we have stored about you.
• Rectification (Art. 16 GDPR): you can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): you can request the deletion of your data, provided no statutory retention obligations stand in the way.
• Restriction of processing (Art. 18 GDPR): under certain conditions you can request the restriction of processing.
• Data portability (Art. 20 GDPR): you have the right to receive your data in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR): you can object at any time to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR): insofar as processing is based on your consent (e.g. push notifications), you can withdraw it at any time. The lawfulness of processing carried out up to the withdrawal remains unaffected.

To exercise your rights, write to datenschutz@frankki.app.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

9. Account deletion

You can delete your user account at any time:

• In the app under Profile → Delete account
• By email to datenschutz@frankki.app

When you delete your account, all of your data is irreversibly deleted: user account, addresses, letters, orders, tracking, Stripe payment data, device token and stored feedback. Your letter PDFs are also removed from storage. Invoices are subject to the statutory retention obligation (§147 AO, 10 years) and therefore cannot be deleted immediately.

10. Automated decision-making

FrankKi uses AI (OpenAI) to assist with letter creation. The AI creates a text draft based on your description. You review, edit and approve the text before a letter is sent. This is not a decision based solely on automated processing within the meaning of Art. 22(1) GDPR, as a substantive review by you always takes place.

Before dispatch, letter content passes an automated screen for abuse patterns (such as imitations of authorities or banks and threatening phrasing). Borderline cases and incoming abuse reports are additionally sighted by us, which means we read the letter content concerned. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and in meeting our obligations under Art. 16 DSA). We sight within 48 hours and decide within 7 days; every decision is logged. Reports go to missbrauch@frankki.app or the form at frankki.app/missbrauch.

11. Changes to this privacy policy

We reserve the right to adapt this privacy policy in order to align it with changes in the legal situation or changes to our service. The current version is always available at frankki.app/app/privacy (German, legally binding). In the event of material changes, we will inform you by push notification or in the app.