Account

Privacy Policy

Last updated: 7 September 2026

This policy explains what personal data Anchr Tools collects, why, who processes it, how long it is kept and what your rights are. It is written to comply with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés). It covers the site anchr.tools, the hosted brand portals and the Adobe Illustrator extension.

1. Who we are

The data controller is Anchr, SAS, 95 Rue Philippe Lamour, 30600 Vauvert, France (Anchr, we, us). For anything about your personal data, write to [email protected]. Our full details are in the legal notice.

2. Data we collect

Account

Your email address, the sign-in links we send you (valid 15 minutes), your licence keys, your plan and its status, and the identifiers Stripe assigns to your customer record and subscription.

Licence activations and trials

When you activate a licence or start a trial, the extension sends a machine fingerprint, an identifier derived from characteristics of your computer, and optionally the name of the machine. We store each activation with the date it was last seen, so that a licence is used on one machine at a time. The trial record (fingerprint, start and end date) lets a machine start one trial only. The extension keeps its licence token in your user folder on that machine.

Portal content

The brand name, colours, typography, logos, usage rules and files you publish, the portal address, its successive versions and, if you set one, the portal password, stored as a hash that cannot be reversed. If your content contains personal data of third parties (a client name, a photograph), you are the controller for that data and we process it on your behalf.

Portal visits

For each portal we record visit events consisting of an event type and a time, nothing else: no IP address, no cookie, no identifier of the visitor.

Site statistics

We measure the audience of anchr.tools with a self-hosted Plausible instance, which works without cookies: page visited, referrer, browser and operating system family, device type and country. The IP address and browser signature are hashed with a salt that changes every day and the raw IP is never stored, so a visit cannot be linked to you after that day. Requests go through anchr.tools to our instance, not to a third party.

Payments

Stripe collects your card details and billing address on its own checkout pages. We never receive your card number. From Stripe we receive your customer and subscription identifiers, the subscription status, the end of the current period and the email used at checkout.

Support

The emails you send to [email protected], with their content and attachments.

Technical logs

Like every website, our server and Cloudflare, which sits in front of it, keep access logs (IP address, time, address requested, browser signature). Our application also uses your IP address, in memory only, to limit the number of requests to sign-in and licence endpoints. Server logs are kept no longer than twelve months.

3. Why we use it and on what legal basis

  • Deliver the Service: create and access your account, activate licences, publish and serve portals, send you keys and sign-in links. Basis: the contract between us (article 6(1)(b) GDPR).
  • Billing and accounting: process payments and keep the records the law requires. Basis: the contract and our legal obligations (article 6(1)(c)).
  • Security and abuse prevention: enforce the one seat and one trial per machine rules, rate limit requests, detect and investigate incidents. Basis: our legitimate interest in protecting the Service (article 6(1)(f)).
  • Support: answer your requests. Basis: the contract and our legitimate interest in helping you.
  • Statistics: understand how the site and portals are used, in aggregate, without profiling anyone. Basis: our legitimate interest (article 6(1)(f)).

We do not sell personal data, we do not use it for advertising, we build no profiles, and we take no automated decision that has legal or similar effects on you.

4. Who receives it

We share personal data only with the processors we need to run the Service:

  • Stripe Payments Europe, Ltd. (Ireland), for payments and subscription management. Stripe is an independent controller for the data it collects on its checkout pages, under its own privacy policy.
  • Resend, Inc. (United States), for transactional email: licence keys, sign-in links and account notices, sent from its European region.
  • Cloudflare, Inc. (United States), for DNS, HTTPS, content delivery and the proxy in front of our server, and for routing email sent to [email protected] to our mailbox. All traffic to anchr.tools passes through the Cloudflare network.
  • Hosting: the application, its database, the portal files, the backups and the analytics instance run on servers operated by us, Anchr on its own server in France, behind Cloudflare, Inc. (San Francisco, USA) for DNS, CDN and email routing; the analytics instance runs on another server operated by Anchr in France.

The extension runs inside Adobe Illustrator; we send no data to Adobe. Adobe processes its own usage data under its own policy. We may also disclose data when the law requires it, and to a successor of our business, with notice to you.

Stripe, Resend and Cloudflare may process some data in the United States. Those transfers rely on the safeguards the GDPR provides: an adequacy decision such as the EU-US Data Privacy Framework, or the European Commission’s standard contractual clauses.

5. How long we keep it

Account data
As long as your account exists, then deleted, except what we must keep by law.
Billing records
10 years, as French accounting law requires.
Licence keys and activations
For the life of the licence.
Trial records
As long as we need them to enforce one trial per machine.
Sign-in links
15 minutes.
Portals
Online while the subscription is active and for 14 days after it ends, then archived, then deleted 90 days after being archived. A portal you delete yourself is removed 30 days later. We keep the last 5 versions of each portal.
Portal visit events
90 days.
Backups
14 days. Data deleted from the Service can remain in a backup for up to 14 days.
Site statistics
Kept as aggregates only; the raw IP is never stored.
Support emails
As long as needed to handle your request and keep a record of it.

6. Your rights

Under the GDPR and French law you have the right to:

  • access the personal data we hold about you and get a copy;
  • rectify data that is inaccurate or incomplete;
  • erase your data, when we have no legal reason to keep it;
  • restrict processing while a dispute is examined;
  • portability: receive the data you gave us in a machine-readable format;
  • object to processing based on our legitimate interest;
  • give directives on what happens to your data after your death.

Write to [email protected] from the address on your account. We answer within one month, and may ask you to confirm your identity first. You may also lodge a complaint with the French supervisory authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the authority of the country where you live.

7. Cookies

The site uses one kind of cookie: a session cookie, needed to deliver the Service and therefore exempt from consent.

  • anchr_portal is set when you unlock a password protected portal, so you do not retype the password on every page.
  • anchr_account is set when you open your account from an emailed link and keeps you signed in for thirty days.

Both are encrypted, HttpOnly, sent over HTTPS only, and expire after 14 days at most or when you sign out. There are no advertising, tracking or third-party cookies, and no analytics cookie: Plausible stores nothing in your browser.

8. Security

All traffic is encrypted with HTTPS. Portal passwords are stored hashed, licence tokens are cryptographically signed, session cookies are encrypted, and access to production systems is restricted. Production data is backed up daily. If a breach affected your rights, we would notify you and the CNIL as the GDPR requires.

9. Changes to this policy

We may update this policy. The date at the top tells you when it last changed. For material changes we email the address on your account before they take effect.

10. Contact

[email protected]. Our postal address is in the legal notice.