Privacy policy

Last updated: 18 August 2026

1. Data controller

The controller responsible for processing the personal data collected through Fren by Vinces is VINCES Consulting, S.L., based in Spain. For any privacy-related matter you can write to us at fren@vincesconsulting.com.

2. Data we process

  • Account data: email, name, organization, areas of interest.
  • Usage data: the queries you make to the platform, date and time.
  • Billing data: if you subscribe to a paid plan (managed by Stripe).
  • Technical data: IP, browser, device (for security and diagnostics).
  • Access data via the MCP connector: if you use Fren from Claude, your email and user identifier, obtained from the access token issued by our identity provider.

3. Purpose of processing

  • Provide the Fren service: answer your queries with AI, both on the platform and through the MCP connector.
  • Manage your account and billing.
  • Communicate relevant changes to the service.
  • Comply with legal and tax obligations.

4. Legal basis

We process your data on the basis of the performance of the contract you accept when you register (Terms of Service) and the consent you grant when enabling specific features.

5. Retention

We retain your account data for as long as your account remains active and, after cancellation, during the applicable legal periods (typically 4-6 years for tax data). Your history of queries and answers is retained for as long as your account is active, so we can provide the service and show you your history; you can request its deletion at any time.

6. Rights

You can exercise your rights of access, rectification, erasure, portability, restriction and objection at any time by writing to us at fren@vincesconsulting.com.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

7. Data processors

We do not transfer personal data for commercial purposes. We share only what is strictly necessary with technology providers that act as data processors, under contract and GDPR compliance:

  • Google Cloud / Firebase — hosting, authentication and database (EU).
  • Amazon Web Services — hosting and infrastructure (EU / USA).
  • Auth0 (Okta) — identity management and authentication (EU).
  • Anthropic — AI processing, MCP connector (USA).
  • OpenAI — AI processing (USA).
  • ElevenLabs — AI processing (USA).
  • Twilio SendGrid — transactional email delivery (USA).
  • Stripe — payment processing, PCI DSS compliant (EU / USA).
  • Google Analytics / Google Ads — usage analytics and campaign measurement, only with your consent (EU / USA).
  • Comitium Analytics — aggregate behavioural analytics, only with your consent.
  • Microsoft Clarity — behavioural analytics, heatmaps and session recording (with masking of sensitive content), only with your consent (EU / USA).

The web application uses Firebase Auth as its access system; the MCP connector uses Auth0. They are two independent access paths, with different identity providers.

8. MCP connector: using Fren from Claude

Fren offers an MCP connector that lets you query Fren from Claude, Anthropic's assistant. Using it is entirely optional: if you do not enable the connector, nothing in this section affects you.

If you enable it:

  • What travels to Anthropic: the query you write and the answer Fren returns, because both are part of your conversation in Claude.
  • What we receive from Anthropic: an access token, from which we extract your user identifier and your email to handle the query.
  • OAuth credentials: Anthropic holds the OAuth client credentials needed to complete the connector's authorization flow.
  • Anthropic's privacy: Anthropic's processing of your conversation in Claude is governed by its own policy (anthropic.com/legal/privacy).
  • Revoking access: you can disconnect the connector from Claude's settings and, additionally, by writing to us at fren@vincesconsulting.com.

9. International transfers

Some of our processors are located outside the European Economic Area, in particular in the United States (for example, Anthropic, OpenAI, ElevenLabs, Twilio SendGrid, Google and Microsoft). These international transfers are carried out with the safeguards provided for in Chapter V of the GDPR, by means of the data processing agreements signed with each provider.

10. Cookies

Fren uses cookies that are strictly necessary for the platform to function (session, authentication), which are always active, and analytics, measurement and session-recording cookies (Google Analytics, Google Ads, Comitium and Microsoft Clarity) that are only activated if you accept them in the consent banner and which you can reject or revoke at any time. See the details in our Cookies Policy.

11. Changes to this policy

We may update this policy to reflect legal or service changes. We will notify you by email of any substantial change.