Legal & Compliance
Privacy Policy
Questions: hello@anku.app
1. Overview
Anku is built on data minimization. It requests read-only access to your PostHog instance, processes event data in memory during diagnosis, and stores only the deliverables it produces for you — never your raw telemetry or your end-users' identities.
2. What We Collect
Account information (your email address, sign-in records); integration data (your PostHog region and project id, and, only if you opt in, your Personal API Key, encrypted at rest); case data (the derived case file's findings, the plays you approve, and their receipts); analysis briefs (computed metrics and the prescribed change); outreach records keyed to hashed, non-reversible identifiers; and email subjects of messages the service sends for you. If you open a case from a URL at the door, we also receive that website URL and the optional email address you submit.
3. Key Encryption & Deletion
Your PostHog key is encrypted at rest with AES-256-GCM — a fresh 128-bit IV and authentication tag per row — and you can delete it at any time in Settings → Disconnect.
4. Zero PII to LLMs
Zero PII to the LLM: only a strict field allowlist — computed numbers and classification fields, never raw telemetry or identifiers — is ever sent to the synthesis model.
5. Email Activity
Sends you approve are dispatched exactly once, through your connected channel, with every recipient re-checked against the suppression window before dispatch. The only other email Anku sends is your own weekly digest, only while your opt-in schedule is active. You can turn it off anytime in Settings, which stops scheduled runs.
6. Retention Windows
Anku retains what it stores only as long as it serves you: outreach records for 12 weeks and email records for 12 weeks. Public URL scan records are held for up to 30 days to protect server resources, or until purged. Older records are deleted automatically by weekly maintenance runs.
7. Deleting or Exporting Your Data
You can delete your account anytime directly in Settings by typing DELETE. When you delete your account, your encrypted credentials, case plays and receipts, diagnostic briefs, email logs, and cached scan records are deleted immediately and permanently erased from our database and cache with zero residual copies. For an export of the records we hold about you, use the Export button in Settings or email hello@anku.app.
8. Subprocessors
Anku uses a small set of providers to run the Service: PostHog (your telemetry source, accessed read-only), Google Gemini (synthesis; never receives raw telemetry — only scrubbed, allowlisted fields), Supabase (authentication and encrypted database), Vercel (application hosting), Resend (delivery of your own weekly digest), Polar (payments — our Merchant of Record processes your subscription; card data never touches Anku systems), and Upstash (rate limiting and short-lived caching of public URL scan records). No provider is permitted to use your data to train models.
10. Why We Process Your Data (Legal Basis)
Contract: we process your account data and integration data because you asked us to run diagnostics — it's the service itself. Legitimate interests: security logs and abuse prevention keep the service safe for everyone. Consent: scheduled weekly scans run only while you've opted in, and turning them off in Settings withdraws that consent. We don't sell your data, and we don't process it for any other purpose than the ones above.
11. Controller & International Transfers
The data controller is Anku. Reach the controller at hello@anku.app for any privacy matter. Anku runs on US-hosted infrastructure (Vercel, Supabase); where providers serve EU/UK users they rely on Standard Contractual Clauses or equivalent safeguards, documented in their Data Processing Agreements.
12. Your Privacy Rights (US States & GDPR)
Depending on where you live, you may have rights to access, correct, delete, or port your data, and to opt out of any targeted advertising (we do none). You can exercise all of them yourself: §7 covers export and deletion without emailing anyone first. If anything requires a human — corrections you can't make in Settings — email hello@anku.app and we'll handle it within 30 days. GDPR/UK users get the same rights through the same mechanics.
13. Contact
Questions, privacy requests, or security reports: hello@anku.app. We'll respond within 48 hours.