Privacy Policy
Your privacy is important to us. This policy explains how we collect, use, and protect your personal information.
Quick Navigation
1. Information We Collect
Personal Information
- Name, email address, and contact information
- Profile information and preferences
- Payment and billing information
- Communication history and messages
- Usage data and analytics
Automatically Collected Information
- IP address and device information
- Browser type and version
- Pages visited and time spent
- Cookies and similar technologies
2. How We Use Information
Service Provision
To provide and maintain our platform services, process bookings, and facilitate communications.
Communication
To send important updates, respond to inquiries, and provide customer support.
Improvement
To analyze usage patterns and improve our services and user experience.
Security
To protect against fraud, abuse, and ensure platform security.
Legal bases (GDPR Art. 6 / UK GDPR)
Where European data-protection law applies, we rely on the following legal bases for each purpose:
| Purpose | Legal basis |
|---|---|
| Creating and operating your account; bookings, holds, offers, contracts, messages, settlements | Performance of a contract (Art. 6(1)(b)) |
| Subscription billing, deposits and payouts; tax and accounting records | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Transactional email about your account and deals | Contract (Art. 6(1)(b)) |
| Security: authentication, 2FA, breached-password screening, rate limiting, fraud and abuse prevention, audit logs | Legitimate interests (Art. 6(1)(f)) — keeping the platform and your account secure |
| Error monitoring and service diagnostics | Legitimate interests (Art. 6(1)(f)) — maintaining a reliable service |
| Touree AI assistant (processing the content you submit to it) | Contract (Art. 6(1)(b)) — you invoke the feature |
| Product analytics and performance measurement | Consent (Art. 6(1)(a)) — via the cookie banner; withdraw at any time |
| Marketing email | Consent (Art. 6(1)(a)); every message carries a one-click unsubscribe |
| Optional connections (Google Calendar, Spotify, social platforms) | Consent (Art. 6(1)(a)) — you connect and can disconnect them |
| Pre-provisioned venue and organisation profiles built from public business information | Legitimate interests (Art. 6(1)(f)) — making the directory useful; you can claim, correct, or remove a profile at any time |
3. Information Sharing
We Do Not Sell Your Data
We do not sell, trade, or rent your personal information to third parties.
Limited Sharing
We may share information only in these circumstances:
- With your explicit consent
- To comply with legal obligations
- To protect our rights and safety
- With trusted service providers (under strict agreements)
4. Data Security
Encryption
All data is encrypted in transit and at rest using industry-standard protocols.
Access Controls
Strict access controls and authentication measures protect your data.
Regular Audits
We conduct regular security audits and vulnerability assessments.
5. Your Rights (GDPR)
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data ("right to be forgotten").
Right to Portability
Request your data in a machine-readable format.
Right to Object
Object to processing of your personal data.
To exercise these rights: Contact us at privacy@ankyr.xyz.
6. Cookies & Tracking
Types of Cookies We Use
Necessary Cookies
Essential for website functionality and security.
Analytics Cookies
Help us understand how visitors use our website.
Functional Cookies
Enable enhanced functionality and personalization.
Marketing Cookies
Used for advertising and marketing purposes.
Cookie Management: You can manage your cookie preferences at any time through our Cookie Policy.
7. Third-Party Services
We use trusted third-party processors for specific functions. Each acts under a data processing agreement and only receives the data needed for its function:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase Supabase, Inc. | Database, authentication, and file storage | account, profile, content, location, security | United States |
| Vercel Vercel Inc. | Application hosting and edge network; Web Analytics and Speed Insights load only after analytics consent | usage | United States |
| Stripe Stripe, Inc. | Subscription billing, deposit and settlement payments, and payouts (Stripe Connect) | account, payments | United States |
| Anthropic Anthropic, PBC | Large-language-model inference for the Touree assistant and for extracting venue/organisation facts from public websites during account provisioning | content, profile, location | United States |
| Resend Resend, Inc. | Transactional and marketing email delivery, bounce and complaint handling | account | United States |
| Sentry Functional Software, Inc. | Error monitoring and diagnostics (secrets and tokens are redacted before sending) | usage | United States |
| Upstash Upstash, Inc. | Redis used for rate limiting and short-lived caches (keys are hashed IP / user identifiers) | security, usage | United States |
| Google (Places, Fonts) Google LLC | Venue address and business-detail lookups when provisioning venue accounts; web font delivery | location | United States |
| Google Calendar(only if you connect it) Google LLC | Two-way calendar sync when you connect your Google account | content | United States |
| Mapbox Mapbox, Inc. | Geocoding venue addresses and computing road distances for BILDR tour routing | location | United States |
| CARTO / OpenStreetMap CARTO DB, Inc.; OpenStreetMap Foundation | Basemap tiles rendered in the BILDR map (your browser requests tiles directly; map data © OpenStreetMap contributors) | usage | United States / United Kingdom |
| Have I Been Pwned Superlative Enterprises Pty Ltd | Breached-password screening at sign-up and password change. Only the first five characters of a SHA-1 hash leave our servers (k-anonymity); your password never does | security | Australia |
| Spotify and social platforms(only if you connect it) Spotify AB; Meta Platforms, Inc.; Google LLC (YouTube); TikTok Pte. Ltd. | Account connections you choose to link to display listener and follower statistics | profile | Sweden / United States / Singapore |
List last updated 2026-10-01.
Note: These services have their own privacy policies and data handling practices. We will update this list before adding a new sub-processor; if you have questions, contact privacy@ankyr.xyz.
8. Data Retention
Account Data
Retained while your account is active and for 2 years after deactivation.
Transaction Data
Retained for 7 years for tax and legal compliance.
Analytics Data
Retained for 2 years for service improvement.
Marketing Data
Retained until you unsubscribe or request deletion.
9. International Transfers
ANKYR LLC is established in the United States and our primary infrastructure (Supabase, Vercel) is hosted there, so your data is transferred to and processed in the United States. The sub-processor table in section 7 lists each provider's country. Where European or UK data-protection law applies, we rely on:
- Standard Contractual Clauses (SCCs)
- The EU-US Data Privacy Framework, where a processor is certified
- Adequacy decisions by relevant authorities
For details of the safeguard applied to a specific transfer, contact dpo@ankyr.xyz.
Users in Japan (APPI)
If you are in Japan, the Act on the Protection of Personal Information requires your consent before your personal information is provided to a third party in a foreign country. By creating an account you consent to ANKYR LLC (United States) and the sub-processors listed in section 7 processing your personal information in the countries shown there. Those countries do not have a Personal Information Protection Commission adequacy decision equivalent to the EU, except where noted; each provider is bound by contract to protect your data to a standard equivalent to the APPI, and you may request details of those measures at privacy@ankyr.xyz. You can withdraw this consent by closing your account.
10. Children's Privacy
ANKYR is a business platform. You must be at least 18 years old (or the age of majority where you live, if higher) to create an account, as set out in our Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.
11. Changes to Policy
We may update this privacy policy from time to time. We will notify you of any material changes by:
- Emailing you directly
- Posting a notice on our website
- Updating the "Last Updated" date
Current Version: October 2026
12. Contact Us
Privacy Questions
For privacy-related questions or to exercise your GDPR rights:
Email: privacy@ankyr.xyz
Data Protection Officer
For EU residents, you can also contact our Data Protection Officer:
Postal Address
ANKYR LLC
Attn: Privacy
30 N Gould St, Ste R
Sheridan, WY 82801, United States