Privacy Notice
Version 1.1 · in force October 12, 2026
This notice explains what personal data FFP One processes — on the marketing site at ffp.one and in the product — why, on what legal basis, who receives it, and how long we keep it.
Who is responsible
FFP One, sole proprietor Randall Helms, Beckerstr. 6A, 12157 Berlin, Germany. Email: randall.helms@ffp.one.
We have no data protection officer; the size and nature of our processing does not require one.
What we process, why, on what legal basis, and for how long
Art. 6(1)(b) GDPR = performing our contract with you · (f) = our legitimate interests · (c) = a legal duty · (a) = your consent.
| What | Why | Basis | Kept |
|---|---|---|---|
| Account: email, name, country, organisation, firm name, account type, role, sign-in events (user id, email, IP address, browser details), and a record of what you agreed to and when | To give you an account and keep it secure | (b); sign-in records (f) | While the account exists. Sign-in records are not deleted on a schedule today |
| Your content: questions, chat conversations, research reports, memos, notes, and the list of companies each item is about | To provide the features you use and keep your own history | (b) | While the account exists; see "How long we keep things" |
| Chat logs and research files stored separately in Google Cloud Storage: question, answer, page, model traces | To debug, measure quality and keep a copy of your research | (f) — our interest in a service that works | Not deleted on a schedule; see "How long we keep things" |
| Exports: the file you export carries your email address ("Requested by"); we log who exported what, and in which format | To show who an export was made for and to keep the service secure | (f) | Not deleted on a schedule |
| Credit and payment records: purchases, credit movements, the payment events Stripe sends us (these include your billing address and the last four digits of your card) | To take payment, run the credit balance, and meet tax and accounting duties | (b) and (c) | Accounting records for the statutory periods (up to 10 years, § 147 AO, § 257 HGB); payment events are not deleted on a schedule |
| Trial anti-abuse: a one-way hash of your email, your card's fingerprint, IP address | To allow one trial per person and per card per year | (f) — preventing repeat free trials | Not purged on a schedule; the repeat check looks only at the last twelve months. If you delete your account the row is kept, without your user id, organisation or IP address, until that window ends |
| Website measurement on ffp.one (PostHog): which pages are visited, with no cookies and no profile | To see which pages visitors read | (a) — only if you accept the banner | Per PostHog's project settings |
| Product analytics (PostHog): pages and events tied to your account — email, organisation, plan, role | To see how the product is used and what breaks | (f) | Per PostHog's project settings |
| Error diagnostics (Sentry): crash reports and request details | To find and fix faults | (f) | Per Sentry's plan settings |
| Support and feedback: your message, thumbs and comments on answers, the page you were on and your browser and screen size, and your email address. We receive feedback by email | To answer you and improve the product | (b) / (f) | While needed to deal with it |
| Marketing list on ffp.one (Buttondown): email address | To send updates you asked for | (a) | Until you unsubscribe |
| Voice input: dictated text. Dictation is off until you turn it on and consent in the app. Your browser does the speech recognition, so where the audio goes depends on the browser — in Chrome it is sent to Google's speech service. We receive only the text | To let you dictate instead of typing | (a) | Stored like anything else you type |
Who receives your data
We use service providers to run FFP One. Those acting on our instructions are processors under Art. 28 GDPR; payment providers act largely in their own right.
AI model providers. What reaches them depends on the feature:
- Chat and Memos — your questions and the material needed to answer them go to Anthropic (US). Anthropic also writes the short titles of your chats and research runs.
- Research — you choose the provider for each run: Anthropic (the default), OpenAI (US), or GLM (Zhipu) and DeepSeek, which are China-based. A run started from a chat carries that chat's recent context to the provider you chose.
- Every research run also involves Anthropic, whichever provider you picked: an Anthropic model writes the run's title and the preview snippet, sometimes checks that a question is in scope, and rewrites a GLM run's report for readability.
- Tavily (US) receives the web-search queries the model writes during a research run, and the web addresses it asks Tavily to read.
Everyone else:
| Provider | What it does |
|---|---|
| Supabase | Accounts, organisations, conversations, notes, billing records |
| Railway | Hosts the backend and its cache. Its logs can contain your email address |
| Vercel | Hosts the websites |
| Google Cloud Storage | Chat logs, research files, archived content from deleted accounts, and backup copies of our database (United States) |
| Sign-in with Google, if you use it. Separately, if you dictate in Chrome, Google's speech service transcribes your audio | |
| Stripe (and PayPal where you choose it for a credit pack) | Payments, the billing portal and invoices. Card details are entered on their pages, not ours. They also act for their own purposes |
| Resend (with Amazon SES) | Sends our email: sign-in links, password resets, trial and service messages |
| Cloudflare | Turnstile, the check on our sign-in forms; receives your IP address and browser signals |
| CallMeBot / WhatsApp | Sends the founder a notification when you submit feedback, including your email address and the first part of your message, and when an organisation's credit balance runs low (with the organisation's name) |
| PostHog | Product analytics (United States) |
| Sentry | Error reports (United States) |
| Buttondown | The mailing list on the marketing site |
| MotherDuck | The market and filings database. It holds no user accounts or content; filing-search text you type, and queries the chat model writes, are run against it |
We do not sell your data, and we do not use your content to train AI models. The model providers' own API terms govern their side.
Transfers outside the EU
Most of the providers above are in the United States. We rely on the European Commission's standard contractual clauses and, where a provider is certified under it, the EU–US Data Privacy Framework.
GLM (Zhipu) and DeepSeek are China-based, and there is no EU adequacy decision for China. Your content goes to them only for a research run where you actively choose that provider, and we treat that choice as your explicit consent to the transfer (Art. 49(1)(a) GDPR). You can simply choose another provider.
Cookies and similar storage
The marketing site at ffp.one measures which pages are visited with PostHog only if you accept in the banner; you can change your mind at any time with Analytics settings in the footer. It uses no cookies, does not identify you and builds no visitor profile; while you accept, PostHog still receives the usual connection data, such as your IP address.
Inside the product, PostHog is tied to your account and stores identifiers in your browser (local storage and a cookie). The product also uses cookies and browser storage to keep you signed in (Supabase), a short-lived cookie that correlates a sign-in (24 hours), and storage for a few settings and for passing a question you typed from one page to the next. We treat this storage as necessary to operate and secure the signed-in product (§ 25 Abs. 2 Nr. 2 TDDDG), so we do not ask for consent for it. If you object to the analytics, write to us.
How long we keep things
While your account is open we keep your account and content so the service works. Afterwards we keep what the law requires us to keep — invoices and accounting records in particular.
Several stores are not yet on an automatic deletion schedule. That includes the chat logs and research files in cloud storage, sign-in records, payment events, and conversations you have deleted in the app (deleted conversations are hidden from you but not yet purged). If you ask us to delete your data, we do it by hand and confirm within one month (Art. 12(3) GDPR). There is no self-service account deletion in the app yet.
Backups. We copy our database every six hours and keep each copy for 30 days, and Supabase keeps its own daily backups for about 7 days. Data we delete from the service can therefore remain in a backup until that backup expires, at most 30 days later.
Do you have to give us this data?
Your email address and payment details are necessary to enter into and perform our agreement with you; without them we cannot give you an account or take payment. Everything else — dictation, what you ask the product — is up to you (Art. 13(2)(e) GDPR).
Your rights
You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to processing, and to receive it in a portable form. Where processing rests on consent, you can withdraw it at any time with effect for the future.
Write to randall.helms@ffp.one. We answer within one month.
You can also complain to a supervisory authority — for us, the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.
Automated decisions
We do not make decisions about you by automated means that produce legal effects. A refused trial — where the same card or email address has already had one, or the address is on a list of disposable email domains — is an automated check with that one consequence; write to us and we will look at it.
Children
FFP One is not for people under 18.
Changes
We update this notice when the service changes. This page shows its version and the date it came into force, and we tell you about significant changes in the app.