1. Data Controller
Anlyra is a SaaS service operated by Lena di Ipek Mikail, a sole proprietorship under Italy's simplified "regime forfetario" tax regime, registered at Piazza Gramsci 8, 41030 San Prospero (MO), Italy — VAT no. 04275010363. Contact email: contact@anlyra.com — certified email (PEC): mikail.ipek@pec.fiscozen.it.
Under EU Regulation 2016/679 (GDPR), the Data Controller is the person or entity that determines the purposes and means of processing users' personal data.
2. Types of Data Collected
Anlyra collects only the data strictly necessary to provide the Service. Here is what we collect, without omissions:
- •Account data: email address, name, organization name. Collected at registration.
- •Payment data: card numbers are handled entirely by Stripe and never pass through our servers. Anlyra receives only the Stripe transaction ID and subscription ID.
- •Identity verification (future): for Enterprise customers or anti-fraud checks, Stripe Identity may request an identity document and selfie. Verification is handled entirely by Stripe. Not active by default for Pro and Advanced plans.
- •Financial data uploaded by the user: CSV files, Excel files, manual entries. Stored on our European servers, encrypted at rest and in transit. We never use the identifiable content for any purpose other than providing the Service.
- •Usage logs: IP address, browser, operating system, in-app actions, timestamps. Required for security, anti-fraud, and technical debugging.
- •Essential cookies: session token (pro_session), language preference, theme preference. No profiling cookies, no marketing cookies, no third-party trackers.
3. Purposes of Processing
- •Service delivery: responding to your requests, generating AI insights, displaying dashboards, calculating forecasts, producing reports. This is the primary purpose — everything else comes after.
- •Product improvement: we use aggregated and anonymous data (never identifiable at the level of a single company) to understand which features work and which don't. No individual profiles.
- •Industry benchmarks: we use aggregated and anonymous data to calculate industry statistics (e.g., average SaaS margin). No data traceable to a single company is ever exposed to third parties.
- •Customer support: we read your messages to help you when you contact us. We do not use these conversations for other purposes.
- •Security and anti-fraud: monitoring suspicious activity, blocking unauthorized access, protecting your data.
- •Legal obligations: billing, anti-money laundering regulations where applicable, responding to requests from competent authorities.
4. What We NEVER Do with Your Data
Six promises with no exceptions, not even for commercial reasons:
- •NEVER sell your data to third parties, under any circumstances.
- •NEVER use your data to train third-party AI models (Anthropic, OpenAI, Google, others).
- •NEVER share identifiable data at the level of a single company with customers, partners, or investors.
- •NEVER access your bank accounts or perform operations on your behalf.
- •NEVER use marketing cookies, behavioral profiling, or third-party trackers.
- •NEVER waive these rules, even if requested by commercial partners or investors.
5. Legal basis for processing (GDPR Art. 6)
- •Contract performance (Art. 6(1)(b)): processing necessary to provide the requested Service.
- •Explicit consent (Art. 6(1)(a)): for optional marketing communications and non-essential cookies.
- •Legitimate interest (Art. 6(1)(f)): to ensure system security and prevent fraud.
- •Legal obligation (Art. 6(1)(c)): to comply with applicable tax and regulatory requirements.
6. Data Transfers to Sub-processors
Anlyra uses the following sub-processors. All are bound by GDPR-compliant agreements (SCCs or EU-US Data Privacy Framework):
- •Anthropic (USA) — Claude API: your data passes through Anthropic when you request an AI insight. Anthropic does NOT use API-received data to train its own models (Anthropic DPA). The transfer is covered by Standard Contractual Clauses (SCCs) approved by the European Commission.
- •Stripe (USA) — Payments and KYC: Stripe is PCI-DSS Level 1 certified and adheres to the EU-US Data Privacy Framework. Anlyra does not access payment card data.
- •Vercel (USA) — Application hosting: CDN and serverless infrastructure. Covered by the EU-US Data Privacy Framework.
- •Supabase (EU) — Primary database: PostgreSQL servers in Europe. Data remains in the EU.
- •Resend (USA) — Transactional emails: service emails only (account confirmation, notifications). No marketing emails. Covered by EU SCCs.
- •Anlyra does not sell, rent, or transfer Users' personal data to third parties for marketing or profiling purposes.
7. Data retention periods
- •Active account: personal data is retained for the entire duration of the contractual relationship.
- •After account deletion: all personal data is permanently deleted within 30 days of the request.
- •System logs and audit logs: retained for a maximum of 12 months from creation.
- •Encrypted backups: retained for 90 days, then permanently and irrecoverably deleted.
- •Tax and billing data: retained for the period required by Italian law (10 years).
8. Data subject rights (GDPR Arts. 15-22)
As a data subject, you have the right to:
- •Access (Art. 15): obtain confirmation and a copy of the personal data Anlyra processes about you.
- •Rectification (Art. 16): correct inaccurate or incomplete data.
- •Erasure — right to be forgotten (Art. 17): request the deletion of your personal data.
- •Portability (Art. 20): receive your data in a structured, machine-readable, interoperable format.
- •Objection (Art. 21): object to processing carried out on the basis of legitimate interest.
- •Restriction (Art. 18): request restriction of processing in specific circumstances provided for by law.
- •To exercise your rights: send an email to contact@anlyra.com with subject 'Privacy Request'. We will respond within 30 days of receipt.
9. CCPA Rights — California residents (USA)
If you reside in the State of California, the California Consumer Privacy Act (CCPA) grants you the following additional rights:
- •Right to know: request detailed information about the categories of data collected and the purposes of processing.
- •Right to delete: equivalent to the right to erasure (right to be forgotten) under GDPR.
- •Right to opt out of sale: Anlyra does not sell personal data to third parties. No active opt-out is required.
- •Right to non-discrimination: you will not face any penalty, price difference or quality reduction for exercising your CCPA rights.
- •For CCPA requests: contact@anlyra.com with subject 'CCPA Request'.
10. LGPD Protection — Users in Brazil
Anlyra is committed to complying with Brazil's Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018). Brazilian users have the right to:
- •Access and confirmation of the processing of their personal data.
- •Correction of incomplete, inaccurate or outdated data.
- •Anonymisation, blocking or deletion of data processed in non-compliance with the LGPD.
- •Portability of data to another service provider.
- •Revocation of consent at any time, without penalty.
- •For LGPD requests: contact@anlyra.com with subject 'LGPD Request'.
11. Data security
- •TLS 1.3 encryption in transit for all client-server communications.
- •AES-256 encryption at rest for databases, backups and user-uploaded files.
- •Two-factor authentication (2FA) available as an optional additional security measure.
- •Role-based access control (RBAC) to restrict data access to authorised personnel only.
- •Audit logs of access to sensitive data, retained for 12 months.
- •Periodic security reviews and vulnerability assessments of the system.
12. Changes to this Privacy Policy
Anlyra reserves the right to modify this Privacy Policy at any time. In the event of material changes, Users will be notified by email and via an in-app banner at least 30 days before the changes take effect.
Continued use of the Service after notification constitutes acceptance of the changes.
13. Contact — Privacy and DPO
For any privacy-related request, to exercise your rights, or for questions about the processing of your personal data: email contact@anlyra.com (subject: 'Privacy Inquiry') or certified email (PEC) mikail.ipek@pec.fiscozen.it.
Response guaranteed within 30 days of receipt.
You have the right to lodge a complaint with the competent supervisory authority. In Italy: Garante per la protezione dei dati personali (garanteprivacy.it).