Privacy Policy

1. Who We Are

1.1. The data controller for personal information described in this policy is Ankra UK LTD, a company incorporated and registered in England and Wales under company number 14779238, whose registered office is at 124 City Road, London, EC1V 2NX, United Kingdom.

1.2. For any privacy question or to exercise your rights, contact us at[email protected]. For security matters, contact [email protected].

2. Scope: Controller and Processor Roles

2.1. This policy covers personal information for which Ankra is the controller: data about visitors to our website, people who contact us or attend our events, users of Ankra accounts, and job applicants.

2.2. Where our customers use the Ankra platform to process data that contains personal information (for example inside their clusters, logs, or repositories), the customer is the controller and Ankra is a processor acting on the customer's instructions, as set out in our Terms of Service. A data processing agreement is available on request from[email protected].

3. Information We Collect

3.1. Account information. When you create an account we collect your name, email address, organisation, and authentication details. If you sign in with an OAuth provider (GitHub, Google, or Microsoft), we receive the profile information that provider shares, such as your name, email address, and avatar. Authentication is handled by our identity provider, Auth0.

3.2. Billing information. Payments are processed by Stripe. We receive billing contact details, subscription status, and transaction records; full card numbers are held by Stripe, not by Ankra.

3.3. Usage and device information. We automatically collect information about how you use the website and platform, including IP address, browser type, operating system, pages viewed, and actions taken in the product. Analytics on the website only runs after you consent; see ourCookie Policy.

3.4. Platform and integration data. The Ankra control plane stores cluster, stack, and organisation metadata, encrypted credentials, and audit events. If you connect third-party services such as GitHub, GitLab, Bitbucket, or a cloud provider, we process the data those integrations make available in order to provide the service. Details of what the control plane stores, and what never leaves your cluster, are on ourtrust page.

3.5. Communications and forms. When you contact us, book a demo, register for an event, or submit a partner or contact form, we collect the details you provide, typically your name, work email, company, and message. We manage these contacts in our internal CRM.

3.6. Job applications. If you apply for a role, we collect your name, contact details, links you share (such as LinkedIn or GitHub), and your CV if you attach one. We use this information only for recruitment.

4. How We Use Your Information and Our Legal Bases

4.1. Under UK and EU data protection law we need a legal basis for each use of personal information. We rely on the following:

• Performance of a contract: creating and managing your account, providing the platform, processing payments, and giving customer support.
• Legitimate interests: securing the service, preventing abuse, improving the product, responding to enquiries, business-to-business marketing to work contacts, and running our recruitment process. Where we rely on legitimate interests we balance them against your rights.
• Consent: analytics cookies on the website and any marketing you have opted in to. You can withdraw consent at any time.
• Legal obligation: keeping accounting and tax records, and responding to lawful requests from authorities.

4.2. We do not use your personal information for purposes incompatible with the ones described here without telling you first.

5. AI Features

5.1. The platform includes AI features powered by large language models. When you use them, the context needed to answer your request (for example cluster metadata, configuration, or log excerpts you ask about) is sent to a model provider for processing. With platform-managed keys, requests are routed through our AI sub-processors listed on the trust page.

5.2. If your organisation configures its own model provider API keys (bring your own key), those requests go directly to the provider you chose under your agreement with that provider.

5.3. We do not use your data to train our own models, and we do not permit our AI sub-processors to use it to train theirs.

6. Cookies and Analytics

We use necessary cookies to run the website and platform, and analytics (PostHog, hosted in the EU) to understand how the website is used. Analytics only runs after you accept it in the cookie banner, and you can change your choice at any time. Full details, including cookie types and durations, are in ourCookie Policy.

7. How We Share Information

7.1. We do not sell your personal information.

7.2. We share personal information with sub-processors that help us run the service, such as hosting, identity, payments, analytics, error monitoring, email, and AI model routing. The current list is published on our trust page. Each sub-processor is bound by contract to protect your information and process it only on our instructions.

7.3. We may also disclose information where required by law, to protect the rights, property, or safety of Ankra, our customers, or others, or as part of a corporate transaction such as a merger or acquisition, in which case this policy will continue to apply to your information.

8. International Transfers

8.1. Our control plane and primary data stores are hosted in the European Union, and our identity and analytics providers run EU-hosted instances for us.

8.2. Some sub-processors process data outside the UK and EEA. Where that happens we rely on an appropriate safeguard: a UK adequacy regulation or EU adequacy decision, or the applicable standard contractual clauses (with the UK International Data Transfer Addendum where required). You can request details of the safeguard used for a given transfer at[email protected].

9. How Long We Keep Information

9.1. We keep personal information only as long as we need it for the purposes above:

• Account data: for as long as your account is active, then deleted or anonymised within 90 days of account deletion (encrypted backups may persist for a further limited period before they rotate out).
• Billing and tax records: 6 years, as required by UK law.
• Support and sales communications: up to 24 months after the conversation ends.
• Job applications: up to 12 months after the recruitment process ends, unless you ask us to delete them sooner or agree to be considered for future roles.
• Website analytics: retained in accordance with the periods in our Cookie Policy.

9.2. Where exact periods are impractical, we use these criteria: whether we still need the data to provide the service, whether the law requires us to keep it, and whether it is needed to resolve disputes.

10. Data Security

We implement technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction, including encryption of credentials, role-based access control, and an append-only audit log. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. For the full picture of our security controls, compliance posture, and sub-processors, see our trust page.

11. Your Rights

11.1. Under the UK GDPR and, where it applies, the EU GDPR, you have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information erased;
• restrict or object to our processing, including objecting to direct marketing at any time;
• receive your information in a portable format;
• withdraw consent at any time, where processing is based on consent.

11.2. To exercise any of these rights, email[email protected]. We respond within one month. Exercising your rights is free of charge.

11.3. You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you can complain to your local data protection authority. We would appreciate the chance to address your concern first.

12. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. AI features in the platform act on your infrastructure only as configured and approved by your organisation, as described in our Terms of Service.

13. Children

The Ankra service is intended for business use and for people aged 16 or over. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

14. Links to Third-Party Websites

Our website and product may link to third-party websites. Their privacy practices are their own; we encourage you to read their privacy policies. This policy does not cover third-party sites.

15. Changes to This Policy

When we change this policy we will post the new version here and update the date at the top. If a change materially affects how we use your personal information, we will notify you by email or through the platform before it takes effect.

16. Contact Information

If you have any questions about this Privacy Policy or how we handle your information, contact us at[email protected], or write to Ankra UK LTD, 124 City Road, London, EC1V 2NX, United Kingdom.