Política de Privacidade

1. Introduction

Franko ("we", "our", or "Franko") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our energy offer comparison service.

By using Franko, you agree to the collection and use of information in accordance with this policy. We process your data in compliance with the European Union's General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Data provided by you

Comparison data: contracted power, estimated annual consumption, tariff type, and other information necessary to calculate your savings.
Account data: email, name (if you create an account to receive alerts).
Contract data: start and end dates of your current contract, current retailer (if you opt to receive reminders).

2.2 Automatically collected data

Usage data: pages visited, time on site, actions performed.
Technical data: IP address, browser type, operating system, device used.
Cookies: we use essential and analytics cookies. See section 7.

2.3 Browser Fingerprinting

To protect our service from fraud and abuse, we collect browser fingerprinting data:

What we collect: Browser type, screen resolution, timezone, and language preferences combined into a unique identifier.
What we DO NOT collect: Hardware identifiers, installed fonts, or canvas fingerprints.
Purpose: Rate limiting and fraud prevention under Legitimate Interest (GDPR Article 6(1)(f)).
Retention: 90 days, then permanently deleted (hard delete, no anonymization).
Your rights: You can request deletion or use a privacy-focused browser to minimize fingerprinting.

2.4 Security Event Logging

We log security-related events to investigate abuse and protect our users:

Events logged: File validation failures, email validation failures, rate limit triggers.
Data captured: Timestamp, IP address, user agent, event type, and relevant identifiers.
Purpose: Security investigation and fraud prevention.
Retention: 90 days, then permanently deleted.

2.5 Third-Party Data Sources

The energy offer information we compare comes from licensed public sources. We do not collect personal data from third parties for our comparison service, only public offer data:

ERSE (Regulatory Entity for Energy Services): Registered offers from electricity and natural gas retailers for residential and small business consumers.
OMIE (Iberian Energy Market Operator): Wholesale energy prices used to calculate indexed price offers.
Storage of comparison results: If you don't create an account, your comparison results are stored for 7 days for later review, after which they are removed. If you create an account to receive alerts, we maintain your comparison history while your account remains active.

3. How We Use Your Data

We use your data to:

Provide personalized energy offer comparisons
Send better price alerts (if authorized)
Send contract expiry reminders (if authorized)
Improve our service through aggregated analytics
Comply with legal obligations

3.1 Legal basis for processing

Consent: for sending alerts and newsletters.
Contract performance: to provide the comparison service.
Legitimate interest: to improve the service and prevent fraud.
Legal obligation: to comply with applicable legislation.

4. Data Sharing

We do not sell your personal data. We share data only with essential service providers:

Resend (email service): Name and email address for sending verification codes, alerts, and enrollment instructions.
Cloudflare Turnstile (bot protection): IP address and browser data for security verification during forms.

Analytics and Experience Improvement (both optional):

Google Analytics 4: Website usage data (pages visited, time on site, interactions). Your IP address is anonymized before being sent to Google. This data is aggregated and does not personally identify you.
Microsoft Clarity: Heatmaps, session recordings, and behavioral metrics to understand how you interact with the site. This includes mouse movements, clicks, and navigation. We use this information solely to improve user experience and identify where users struggle.

All our providers are bound by data protection agreements and comply with GDPR. You can disable analytics cookies at any time in your cookie preferences.

5. Your Rights

Under GDPR, you have the following rights:

Access: know what data we have about you.
Rectification: correct incorrect data.
Erasure: request deletion of your data.
Portability: receive your data in a common format.
Objection: object to certain processing.
Withdraw consent: at any time, without affecting the lawfulness of previous processing.

To exercise these rights, access your account settings or contact us through the email below.

6. Data Retention

Comparison data: deleted after 30 days if you don't create an account.
Account data: kept while the account is active, plus 2 years after closure for legal obligations.
Analytics data: anonymized and aggregated after 26 months.
Fingerprint data: permanently deleted after 90 days.
Security event logs: permanently deleted after 90 days.
Comparison results (anonymous users): deleted after 7 days.

7. Cookies

We use the following types of cookies:

7.1 Essential cookies

Necessary for website operation. Cannot be disabled.

7.2 Analytics cookies

We use analytics tools to understand how the site is used and improve our services. These cookies are optional and you can disable them.

Google Analytics 4

We use Google Analytics 4 to collect aggregated data about site usage, including pages visited, time on site, and interactions. Data is anonymized and does not identify individual users. For more information, see Google's Privacy Policy.

Microsoft Clarity

We use Microsoft Clarity in partnership with Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session recordings, with the goal of improving our products and services. Website usage data is captured through first and third-party cookies and other tracking technologies to determine service popularity and online activity. Additionally, we use this information for site optimization and fraud/security prevention. For more information about how Microsoft collects and uses your data, see Microsoft Privacy Statement.

You can manage your cookie preferences through the banner that appears on your first visit or in your browser settings.

8. Security

We implement technical and organizational measures to protect your data:

Encryption in transit (HTTPS/TLS)
Encryption at rest for sensitive data
Need-based restricted access
Continuous security monitoring

9. Minors

Our service is not intended for minors under 18 years old. We do not intentionally collect data from minors.

10. Changes to This Policy

We may update this policy periodically. We will notify about significant changes through the site or by email.

11. Contact

For questions about this policy or to exercise your rights:

Email: [email protected]

You also have the right to file a complaint with the National Data Protection Commission (CNPD) if you believe your rights have not been respected.