Contact Us

Privacy Policy

Last updated:

At Frassino Studio LLC we value your privacy. This policy explains what personal data we collect through this website (https://frassino.io), how we use it, and the rights you have over it.

Data controller

The controller of your data is Frassino Studio LLC, located at 1431 Simpson Road, #1346, Kissimmee, FL, 34744, US. For privacy inquiries, contact info@frassino.io.

Data we collect

We only collect the data needed to assist you:

  • Data you provide in the contact form: name, email, phone, and your message.
  • Technical connection data (IP address, browser type) processed for the security and operation of the site.
  • Information stored via cookies (see our Cookie Policy).
  • Anonymous, cookie-free usage measurement with no persistent identifiers: we count page views and clicks on contact buttons, aggregated per day. We do not store your IP address or any data that could identify you; if your browser sends a "Do Not Track" or "Global Privacy Control" signal, we do not even count you as a distinct visitor.

How we use your data

We use your data to respond to your inquiries, provide our services, keep the site secure, and comply with legal obligations. We do not use your data for automated decisions with legal effects.

Mobile data and SMS

We only send text messages to phone numbers whose owner gave express written consent, by checking the consent box on this site's contact form. The exact text of that box appears on our messaging terms page.

  • Mobile opt-in data and phone numbers are not shared with or sold to third parties for marketing purposes.
  • Consent is never a condition of purchase, and it can be withdrawn at any time by replying STOP.
  • We keep a record of each consent (date, source, and the exact text accepted) in order to prove it.
  • Message and data rates may apply.
  • The text messages sent and received on the business's number are stored with their text for 90 days. After that the text is deleted and we keep only who wrote and when.
  • Replies of STOP, START, and HELP are recognized and recorded, so that a number that asked to stop is never messaged again.

Facebook and Instagram data

When a Facebook account is connected, the person chooses which Pages, Instagram professional accounts, and ad accounts are shared with Frassino. We request the following Meta permissions, each for the feature stated.

For identifying the person who connects (their Facebook name) and listing the Pages, Instagram accounts, and ad accounts they choose to share: public_profile, pages_show_list and business_management.

For showing the Instagram professional account profile (name, @username, bio, link, photo, and follower, following, and post counts): instagram_basic.

For receiving the comments, messages, and mentions that reach the connected accounts: instagram_basic, pages_manage_metadata, pages_read_engagement, pages_read_user_content, pages_messaging, instagram_manage_comments and instagram_manage_messages.

For replying to those comments and messages, only when a person asks for it in the app: pages_manage_engagement, pages_messaging, instagram_manage_comments and instagram_manage_messages.

For publishing and scheduling on Instagram what the person approves: instagram_content_publish.

For reading the statistics of the Instagram account and its posts (reach, views, interactions, and followers): instagram_manage_insights.

For creating, paused, in the business ad account, the campaigns prepared in Frassino and reading their results; only a person activates them or changes their budget: ads_management and ads_read.

  • What we receive and store: the comments, messages, mentions, and reactions that reach the connected accounts, and the files attached to messages (photos, videos, and audio up to 50 MB), which are copied to Frassino's private storage when the message arrives and deleted 90 days later (a shared reel is not copied: only the link to its public page on Instagram is kept); the name, @username, and profile photo of the person who writes; the profile and statistics of the connected accounts; and the posts created in Frassino.
  • The person who writes becomes a contact of the business: anyone who comments on, mentions, or sends a message to a connected account is saved as a contact and as a potential customer (lead) of the business, with their name, @username, and Instagram or Facebook identifier; the text they wrote is not copied to the contact. Instagram comments, besides arriving through Meta notifications, are also read by periodically checking the recent posts of the connected accounts. The contact and the lead are kept as a record of the business (name, @username, stage, and notes); the Instagram or Facebook identifier is not: it is deleted together with the rest of the business's Meta data, and also 30 days after the business's last Meta connection is disconnected. If the person requests it, the contact and the lead are deleted as well (see below).
  • The business's own posts and its content: when a post from one of the business's own Instagram accounts is linked to a story in its Frassino content (because it was published from Frassino or because the business adopts it), the link is saved: the post's identifier and address, the account name, and the date; the text and images of the post are not copied. That link is deleted together with the rest of the business's Meta data, and also 30 days after the connection it came from is disconnected; the story and the piece in the content are kept.
  • What happens only on request: replying, publishing, and scheduling happen ONLY when a person asks for them in the app. Jess can propose a draft reply or post, but never sends or publishes it on its own.
  • Who we share it with: only the subprocessors listed below. The text of a conversation is sent to Anthropic only when a draft reply is requested, and phone notifications (through Expo) may include the name or @username of the person who wrote.
  • This data is not sold, is not used for advertising, and is not used to train machine-learning or artificial-intelligence models.
  • How long we keep it: while the connection is active. When an account is disconnected, access is revoked and its credential is deleted immediately, its history stops being shown, and it is deleted 30 days later. What Meta sends for accounts that are not in use by any business is deleted after 30 days.
  • How it is deleted: when the account is closed in the app, or when a data deletion request is completed (https://frassino.io/delete-account), the Meta connections are revoked and all Facebook and Instagram data of the account holder's businesses is deleted, except the contacts and leads described above, which are kept without the Instagram or Facebook identifier. Anyone who wrote to a business through Facebook or Instagram can also request the deletion of their data at https://frassino.io/delete-account.

YouTube data

Frassino uses YouTube API Services to connect the business's YouTube channel. When a channel is connected, we request these permissions from Google and no others: openid and email, for knowing which Google account is connected; youtube.readonly, for reading the channel, its figures, its playlists, its videos, and the comments on its videos; youtube.force-ssl, for changing the channel details, editing and deleting its videos and playlists, and replying to and moderating comments, when a person asks for it in the app; yt-analytics.readonly, for reading the YouTube Analytics reports of the channel (views, minutes watched, subscribers, traffic source, device, country, and how many times each thumbnail was shown) to show them to the owner; they are not combined with data from other platforms and are not sold. And, only when the business has uploading videos from Frassino enabled: youtube.upload, for uploading videos to the channel when a person asks for it in the app.

In addition to this policy, the Google Privacy Policy applies to that data: http://www.google.com/policies/privacy.

  • What we read: the channel details (name, @handle, description, keywords, language, image, trailer, and sections), its figures (subscribers, views, and number of videos), its playlists, and its uploaded videos (title, description, tags, image, date, duration, and visibility). The comments on its videos: their text, their date, and the name, picture, and channel of the person who wrote them. With the permission to measure, also the YouTube Analytics reports of the channel and its videos (views, minutes watched, average view duration, subscribers gained and lost, likes, comments, shares, traffic source, device, and country) and how many times each thumbnail was shown and how many people tapped it. And the figures (views, likes, and comments) of the videos the business linked to its posts.
  • What we store: the channel details and figures, and the email address and identifier of the Google account that connected it. The access credential is stored encrypted. Of the videos and playlists: title, image, date, duration, and visibility, and the description of each playlist (the description and tags of a video are read when the screen asks for them and are not stored). Of the comments: their text, their date, and the name, picture, and channel identifier of the person who wrote them, plus the replies written from Frassino. Of a video being uploaded: the text of its draft (title, description, tags, and settings). The video file goes from the device straight to YouTube: it never passes through Frassino and is not stored. Of uploaded captions, only which track it is, not the file. The YouTube Analytics reports, the thumbnail figures, and the daily figures of the linked videos are stored as figures, without titles or texts.
  • What happens only on request: changing the channel, editing or deleting a video or a playlist, replying to or moderating a comment, uploading a video, setting its thumbnail or its captions happens ONLY when a person asks for it in the app. Jess does not change, publish, or reply to anything on YouTube on its own. When a person asks Jess to suggest a reply to a comment, or a title and description for a video, the text of that comment thread or of the script is sent to the language model provider listed among the subprocessors, in order to write the draft that the person then edits.
  • This data is not sold and is not used for advertising. It is not shared with third parties, except the subprocessors listed below, or when required by law.
  • How to revoke access: by disconnecting the channel in the app, or on the Google security settings page: https://security.google.com/settings/security/permissions.
  • How long we keep it: while the connection is active. Everything that is not a figure (the channel texts, video and playlist titles and images, comment texts, and the name and picture of the people who commented) is read again from YouTube at least every 30 days; what cannot be read again is deleted. An upload draft left untouched for 30 days is deleted. When the channel is disconnected, access is revoked and the credential is deleted immediately, along with the comment texts and the data of the people who wrote them, the video and playlist titles and images, and the upload drafts; the remaining stored channel data is deleted 7 days later. If the permission is lost and the channel is not connected again, the stored data is deleted after 30 days. When the Frassino account is closed, access is revoked and everything is deleted immediately.

Google user data (Limited Use)

When you connect a Google account, we request the minimum access needed for the feature you asked for: reading your mail so it appears in your Frassino inbox. We request exactly three permissions and no others: reading and organizing your Gmail (marking as read, archiving, and moving to trash), sending email from your address and your account email address.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

  • What we read: sender, subject, date, and labels of your messages from the last 12 months, plus messages you sent in the last 30 days.
  • What we store: that metadata. The message body is fetched only when you open a message and is kept for 14 days, after which it is deleted automatically.
  • What we never sync: spam and trash.
  • What we never do: permanently delete any message. We do not request the permission that would allow it. Sending, marking as read, archiving, and moving to trash happen ONLY when you ask for them in the app (or explicitly approve them when Jess proposes one), and every one of them is recorded.
  • We do not sell this data, we do not use it for advertising, and we do not use it to train machine-learning or generalized artificial-intelligence models.
  • We do not transfer it to third parties except to the subprocessors listed below, acting under contract and on our instructions, or when required by law.
  • You can disconnect the account at any time and ask us to delete what was synced.

Legal basis (EU/EEA users)

If you are in the European Economic Area, we process your data based on your consent (when you submit the form), our legitimate interest in responding and operating the site, and pre-contractual measures where applicable.

Who we share your data with

We do not sell your data. We may share it with providers that supply us with infrastructure and email delivery services (including the Frassino platform and its cloud providers), acting under our instructions, and with authorities when required by law.

Subprocessors

We rely on the following providers to operate the service. Each one acts under contract, on our instructions, and only for the purpose stated:

  • Amazon Web Services, Inc. — Compute and database infrastructure, file storage, site delivery, sending and receiving email, and sending SMS messages. Processing location: United States. Privacy policy: https://aws.amazon.com/privacy/
  • Stripe, Inc. — Card payment processing and management of saved payment methods. Full card data is submitted to Stripe and is not stored by Frassino. Processing location: United States. Privacy policy: https://stripe.com/privacy
  • Plaid Inc. — Connection to the bank chosen by the user to read accounts and transactions, when the user enables it. Processing location: United States. Privacy policy: https://plaid.com/legal/#end-user-privacy-policy
  • Anthropic PBC — Language model powering the platform assistant. It processes conversation text in order to respond and, when the person asks, writes drafts: a reply to a Facebook or Instagram comment or message (with the text of that conversation, the post caption, and the first name of the person who wrote), the text of an Instagram post and the profile bio (with the business details), a reply to a YouTube comment (with the text of that comment thread, without the name of the person who wrote), and the title, description, and tags of a video (with the script the business wrote). No credentials or payment methods are sent to it. Processing location: United States. Privacy policy: https://www.anthropic.com/legal/privacy
  • Google LLC — Site search metrics (Search Console) and, when the user connects a Gmail account, reading their messages through the Gmail API. Processing location: United States. Privacy policy: https://policies.google.com/privacy
  • 650 Industries, Inc. (Expo) — Delivery of notifications to the app user’s phone. A notification may include the name or @username of the person who wrote (for example, on Instagram) and the subject of an incoming email; Expo delivers it through Apple’s or Google’s notification service, depending on the phone. Processing location: United States. Privacy policy: https://expo.dev/privacy

International transfers

Your data may be processed on servers located in the United States or other countries. When this happens, we apply appropriate safeguards to protect your information under applicable law.

Data retention

We keep your data for as long as necessary for the described purposes and to meet legal obligations. You may request its deletion at any time.

Retention and deletion

We keep personal data for as long as it is needed for the purposes described in this policy, and for as long as the law requires us to.

You can request the deletion of your account and your data at https://frassino.io/delete-account. The request must be confirmed from the email address that submitted it, and we respond within 30 days.

Some records cannot be deleted on request because we are legally required to keep them — invoices and tax records in particular. In those cases we delete everything else and keep only what the law requires, for the period it requires.

Your rights

You can exercise your rights by writing to info@frassino.io. If you are in the EU/EEA, you have the right to access, rectify, erase, object to, restrict, and port your data, to withdraw consent, and to lodge a complaint with your local supervisory authority.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what data we collect, to request its deletion, and not to be discriminated against for exercising your rights. We do not sell or share personal information within the meaning of the CCPA.

Children

This site is not directed to children and we do not knowingly collect data from anyone under 16 (13 in the US). If you believe a child provided us data, contact us to remove it.

The product is not directed to children under 13, and we do not knowingly create accounts for them. If we learn that an account belongs to a child under 13, we delete it and the data associated with it.

Security and changes

We apply reasonable technical and organizational measures to protect your data. We may update this policy; the current version will be posted on this page with its update date.