1. Who we are
Frank is operated by 18009619 Canada Inc., operating as Frank ("Frank", "we", "us"), an online platform that helps consumers compare vehicles, see real payment and pre-approval numbers, value a trade-in, and connect with dealers and lenders on their own terms. Our registered address is 347 Jane St, Toronto, ON M6S 3Z3, Canada. For privacy questions, contact our privacy officer at privacy@drivefrank.ca or call 647-360-8580.
2. Definitions
2.1 “personal information” means information about an identifiable individual, as defined under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
2.2 “de-identified” or “aggregated” data means data that has been altered so it can no longer reasonably identify you.
2.3 “service provider” means a third party that processes personal information on our behalf under contract, listed in our List of Subprocessors.
2.4 “consent” means your agreement — express, or implied where permitted by law — to a specific collection, use, or disclosure of your personal information.
3. Information we collect
We collect the following categories of information:
- Account & contact information — your name, mobile phone number (verified by one-time code), and optionally your email and preferred language.
- Identity verification, including biometric data — when you choose to verify your identity, our verification provider (Stripe Identity) collects and checks government ID and a selfie. The selfie is used to perform a biometric comparison against your ID photo. We collect this only with your express consent, use it solely to verify your identity, and receive a pass/fail result and limited verified attributes back — not your raw ID images or a biometric template we can independently re-use.
- Financial information — if you link a bank account (via Plaid) or add a payment method (via Stripe), we receive tokens and limited account details to enable pre-approval and payments. We do not store full bank credentials or full card numbers.
- Vehicle & deal information — vehicles you save, trade-in details you provide, photos you upload, and the quotes and comparisons you build.
- Lease-transfer information — if you list or take over a lease, the lease document you upload and the details it contains (remaining term, payment, mileage allowance, payoff).
- Profile & preferences — your onboarding answers (goals, timeline) and the settings that personalize your experience.
- Usage & device information — log data, device and browser information, and product analytics about how you use Frank, including any browser extension you install.
4. How we use your information
- Provide, operate, and improve the Frank platform.
- Verify your identity and, with your consent, prepare and route credit pre-approval requests to lenders.
- Process payments, deposits, and applicable fees.
- Show you accurate pricing, incentives, and trade-in estimates.
- Communicate with you about your account, deals, and offers (including by SMS to your verified number).
- Detect, prevent, and respond to fraud, abuse, and security issues.
- Comply with legal and regulatory obligations.
5. Automated estimates
Some of what Frank shows you is generated automatically rather than by a person — for example, a pre-approval likelihood, an estimated payment, or a trade-in value (“Frank Value”). These are estimates built from the information available to us and general market data; they are not a credit decision, an appraisal, or a guarantee. A lender, not Frank, makes the actual credit decision, and a dealer makes the actual trade-in offer. You can ask us how a specific automated estimate was generated for you — see Personal Rights Request Form.
6. Marketing communications & CASL consent
6.1 If you opt in to receive marketing messages — for example, about a saved vehicle or a new offer — we send them by SMS or email to the contact information on your account, consistent with Canada’s Anti-Spam Legislation (CASL).
6.2 Every marketing message identifies Frank and includes a working way to unsubscribe — reply STOP for SMS, or the unsubscribe link in an email. We honour opt-outs within the statutory period.
6.3 Account and transactional messages — like one-time verification codes, deal updates, or appointment confirmations — aren’t marketing, and continue even if you opt out of marketing, as permitted by CASL.
6.4 You can manage your communication preferences in your account settings or by contacting us.
7. How we share your information
We do not sell your personal information. We share it only as needed to run the service:
- Dealers and lenders — only with your consent and on your terms. You stay anonymous to dealers until you choose to reply; pre-approval requests go to lenders only when you ask us to submit them.
- Lease-transfer matches — if you list a lease, your identity and lease details are shared with the matched dealer only when a takeover is accepted, per the Lease-Takeover Listing Terms. Your listing stays anonymous until then.
- Service providers who process data on our behalf under contract, including: Stripe and Stripe Identity (payments and identity verification), Plaid (bank linking), Inovatec/Propel and participating lenders (credit routing), Twilio (SMS verification), PostHog (product analytics), Sentry (error monitoring), Cloudflare (security and storage), and our cloud hosting and database providers. The full list is in our List of Subprocessors.
- De-identified & aggregated data — we may create and use data that has been de-identified or aggregated so it no longer reasonably identifies you (for example, to build market pricing insights or improve valuation accuracy). We do not attempt to re-identify de-identified data.
- Legal and safety — when required by law, or to protect the rights, safety, and property of Frank, our users, or others.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.
8. Your choices and rights
Subject to applicable law (including Canada’s PIPEDA and, for Quebec residents, Quebec’s Act respecting the protection of personal information in the private sector), you may request to access, correct, or delete your personal information, and withdraw consent where processing relies on it. You can opt out of marketing messages at any time. To make a request, use our Personal Rights Request Form or contact privacy@drivefrank.ca or call 647-360-8580. We will respond within the timeframes required by law.
If you’re not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or, if you’re a Quebec resident, to the Commission d’accès à l’information du Québec.
9. Data retention
We keep personal information only as long as needed for the purpose it was collected, then delete or de-identify it. In practice, that means:
- Account & profile data — kept while your account is active, and for a limited period after your last activity in case you return, unless you ask us to delete it sooner.
- Identity verification & credit pre-approval records — kept longer, in line with the record-keeping obligations lenders and financial regulators place on credit transactions (typically several years), even after account deletion.
- Deal, payment, and transaction records — kept as long as needed to resolve disputes and meet our own accounting and tax obligations.
- De-identified or aggregated data — may be kept indefinitely, since it no longer identifies you.
10. Security & breach notification
10.1 We use technical and organizational safeguards — including encryption in transit, scoped access controls, and audit logging — to protect your information. No method of transmission or storage is perfectly secure, but we work to protect your data.
10.2 We maintain an internal record of security incidents that affect personal information, as required by PIPEDA and, for Quebec residents, Law 25.
10.3 Where a breach creates a real risk of significant harm, we will notify affected individuals and the applicable regulator — the Office of the Privacy Commissioner of Canada, and Quebec’s Commission d’accès à l’information for Quebec residents — without unreasonable delay.
11. International transfers
Several of our service providers — including Stripe, Twilio, Sentry, and our application hosting and database providers — are based in or process data in the United States. Where that happens, your information may be accessible to US authorities under US law, and we take contractual and technical steps to ensure a comparable level of protection to what PIPEDA requires in Canada.
12. Cookies
We use cookies and similar technologies to run the platform and understand how it’s used. See our Cookie Declaration for the current list and how to manage them.
13. Quebec residents
If you are a Quebec resident, Quebec’s private-sector privacy law (Law 25) applies in addition to PIPEDA. In particular:
- Our privacy officer, reachable at privacy@drivefrank.ca or call 647-360-8580, is responsible for ensuring compliance with this policy and applicable privacy law.
- We maintain an internal register of confidentiality incidents involving personal information.
- Where we collect biometric data (the identity-verification selfie described in §3), we do so only with your express consent and use it solely to verify your identity.
- You have the right to be informed of, and to obtain an explanation of, any decision based exclusively on an automated process that has a significant effect on you, and to have personal information used to render that decision corrected.
14. Children
Frank is not intended for anyone under the age of majority in their province or territory. We do not knowingly collect information from minors.
15. Changes to this policy
We may update this policy from time to time. Material changes will be posted here with an updated date, and where appropriate we will notify you.
16. Contact us
Questions or requests? Email our privacy officer at privacy@drivefrank.ca or call 647-360-8580, or write to us at 347 Jane St, Toronto, ON M6S 3Z3, Canada.