Privacy Policy

Effective Date: May 27, 2026 · Last Updated: May 27, 2026

This Privacy Policy describes how ANKH OU("Company," "we," "us," or "our") collects, uses, discloses, and protects personal data when you access or use raked.app(the "Site") and our products and services ("Services"). We are committed to protecting your privacy in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act ("CCPA"), the ePrivacy Directive (2002/58/EC), and all applicable data protection laws.

1. Data Controller

The data controller for the purposes of the GDPR is:

Entity: ANKH OU
Jurisdiction: Republic of Estonia, European Union
Contact: rake@mechanist.ai

2. Data We Collect

2.1 Data You Provide

Account information: Email address, name, and billing information when you subscribe to Services.
Communications: Content of emails, support requests, and calendar bookings.
Payment data: Processed exclusively by Paddle.com Market Limited as our Merchant of Record. We do not store credit card numbers, bank account details, or other payment instruments.

2.2 Data Collected Automatically

Log data: IP address, browser type, operating system, referring URL, pages visited, timestamps.
Device data: Device type, screen resolution, language preference.
Cookies: Strictly necessary cookies for site functionality. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. See Section 7.

2.3 Data We Do Not Collect

We do not collect special categories of personal data (Article 9 GDPR), including racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, health data, or sexual orientation.

3. Legal Basis for Processing (GDPR)

We process personal data on the following legal bases:

Contract performance (Art. 6(1)(b)): To provide Services you have subscribed to.
Legitimate interests (Art. 6(1)(f)): To maintain security, prevent fraud, and improve Services, balanced against your rights and freedoms.
Legal obligation (Art. 6(1)(c)): To comply with tax, accounting, and regulatory requirements.
Consent (Art. 6(1)(a)): Where explicitly provided, for optional communications. You may withdraw consent at any time.

4. How We Use Your Data

To provide, maintain, and improve the Services.
To process payments via Paddle.
To communicate with you regarding your account, support requests, or service changes.
To detect, prevent, and address security incidents and fraud.
To comply with legal obligations.

We do not sell your personal data. We do not use your data for automated decision-making or profiling that produces legal effects.

5. Data Sharing

We share personal data only with:

Paddle.com Market Limited: Payment processing, billing, and tax compliance as our Merchant of Record.
Vercel Inc.: Site hosting and content delivery.
Legal authorities: When required by law, court order, or lawful government request.

We do not share data with data brokers, advertising networks, or AI training data providers. All sub-processors are bound by data processing agreements compliant with GDPR Article 28.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the EEA, including the United States. Such transfers are protected by:

EU-U.S. Data Privacy Framework (where applicable).
Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914).
Adequacy decisions of the European Commission.

7. Cookies

We use only strictly necessary cookies required for the Site to function. These cookies:

Do not track you across websites.
Do not collect data for advertising purposes.
Cannot be disabled without impairing site functionality.
Are exempt from consent requirements under Article 5(3) of the ePrivacy Directive.

We do not use Google Analytics, Meta Pixel, or any third-party tracking technology.

8. Your Rights

8.1 GDPR Rights (EU/EEA Residents)

Under the GDPR, you have the right to:

Access your personal data (Art. 15).
Rectification of inaccurate data (Art. 16).
Erasure ("right to be forgotten") (Art. 17).
Restriction of processing (Art. 18).
Data portability (Art. 20).
Object to processing based on legitimate interests (Art. 21).
Lodge a complaint with your national data protection authority.

8.2 CCPA Rights (California Residents)

Under the CCPA, you have the right to:

Know what personal information is collected, used, shared, or sold.
Delete personal information held by us.
Opt-out of the sale of personal information. We do not sell personal information.
Non-discrimination for exercising your rights.

To exercise any of these rights, contact us at rake@mechanist.ai. We will respond within 30 days (GDPR) or 45 days (CCPA).

9. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described in this Policy, or as required by law. Account data is retained for the duration of your subscription and for 36 months thereafter for legal and accounting purposes. Log data is retained for 90 days.

10. Security

We implement appropriate technical and organizational measures to protect personal data, including:

TLS 1.3 encryption in transit.
Encryption at rest for stored data.
Strict access controls and least-privilege principles.
Security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options).
Regular security audits.

For security vulnerability reporting, see our Security Disclosure Policy.

11. Children

The Services are not directed at individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or prominent notice on the Site at least 30 days before they take effect. Your continued use of the Services constitutes acceptance.

13. Contact

Entity: ANKH OU
Email: rake@mechanist.ai
Jurisdiction: Republic of Estonia, European Union