Privacy Policy

This privacy policy describes how Ankhaw SASU (hereinafter "Ankhaw" or "we"), publisher of the InHook mobile application, collects, uses, and protects the personal data of its users, in accordance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the French Data Protection Act (Act No. 78-17 of January 6, 1978).

1. Data Controller

The data controller is:

• Company name: Ankhaw SASU
• Registered office: 47 rue Vivienne, 75002 Paris, France
• SIRET: 10346144800013
• Contact email: contact@ankhaw.com
• Legal representative: David Relut, President

2. Data Collected

2.1 Identification data (user account)

• Email address
• First and last name (if provided at registration or via Google / Apple OAuth)
• Unique user identifier (automatically generated)
• Password (stored encrypted, never in clear text)

2.2 Content data

• Photos uploaded by you for processing by the app (retouching, AI enhancement, effects)
• Customization settings (presets, theme preferences, language)
• Local render history (stored only on your device)

2.3 Technical and usage data

• Device type and model, operating system and version
• Anonymized technical identifiers for session tracking
• Crash diagnostic data (stack traces, without personal data)
• Aggregated usage logs (number of renders, critical actions)

2.4 Billing data

• Subscription status (active / inactive, plan subscribed)
• Transaction identifier (Apple App Store or Google Play Store)

Important: Ankhaw does not collect any payment data (card number, bank details). The entire payment process is managed by Apple and Google under their own policies.

3. Purposes of Processing

Your data is processed for the following purposes:

• Providing the InHook service: authentication, photo processing, storage of your settings
• Subscription management: verifying Pro status, enforcing monthly quotas
• Service improvement: bug detection, aggregated and anonymized usage analysis
• Security: preventing fraud, abuse, and unauthorized use
• Communication: responding to your support requests via email
• Legal obligations: data retention required by law (billing, anti-fraud)

4. Legal Bases for Processing

In accordance with Article 6 of the GDPR, processing is based on:

• Contract performance (Art. 6.1.b) — to provide the app features you subscribed to
• Consent (Art. 6.1.a) — for optional processing (newsletter, detailed usage analysis)
• Legitimate interest (Art. 6.1.f) — for security, fraud prevention, and service improvement
• Legal obligations (Art. 6.1.c) — for data retention required by French law

5. Recipients and Sub-processors

To provide the service, Ankhaw uses third-party sub-processors, each contractually bound to comply with the GDPR. The categories of sub-processors involved are:

• Authentication provider (USA) — user account management and session handling
• Subscription management provider (USA) — verification of subscription status and synchronization with stores
• Technical observability provider (USA, EU hosting) — error detection and app diagnostics
• Backend hosting provider (Germany) — API hosting and application data
• Artificial intelligence image processing provider (European Union and USA) — AI-powered portrait rendering and image quality enhancement
• Distribution platforms (Apple App Store, Google Play Store, USA) — app distribution and in-app payment handling
• Website hosting provider (France) — ankhaw.com and legal pages hosting

A detailed and named list of our sub-processors is available upon request to contact@ankhaw.com, in accordance with your enhanced right to information.

6. International Data Transfers

Some of your data may be transferred outside the European Union, particularly to the United States (authentication, subscription management, technical observability, AI image processing, and distribution platform providers). These transfers are governed by:

• Standard Contractual Clauses of the European Commission
• Recognized certification mechanisms (EU-U.S. Data Privacy Framework for certified providers)
• Complementary technical and organizational measures (encryption, minimization)

7. Data Retention

• Account data: retained as long as the account is active, then deleted within 30 days after user-initiated deletion
• Uploaded photos: automatically deleted after processing (no long-term server storage)
• Billing data: retained 10 years for accounting and tax obligations
• Technical logs and diagnostics: 90 days maximum
• Anonymized aggregated data: retained indefinitely (no longer enables identification)

8. Data Security

Ankhaw implements appropriate technical and organizational measures to ensure your data's security:

• TLS encryption for communications (HTTPS)
• Encrypted storage of authentication tokens on device (iOS Keychain, Android Keystore)
• Irreversible password hashing
• Strict access controls to information systems
• Access logging and regular permission reviews

9. Your Rights

Under the GDPR, you have the following rights over your personal data:

• Right of access (Art. 15) — obtain a copy of your data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — delete your account and data
• Right to restriction (Art. 18) — temporarily suspend processing
• Right to portability (Art. 20) — retrieve your data in a structured format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to withdraw consent at any time, without affecting prior processing

To exercise these rights, contact us at contact@ankhaw.com. We commit to responding within 30 days maximum.

Account deletion: to request the deletion of your InHook account and associated data, see our dedicated Account Deletion page which details the full procedure, deleted data, and data retained for legal obligations.

You also have the right to file a complaint with the French Data Protection Authority (CNIL): www.cnil.fr/en.

10. Cookies and Trackers

The InHook app does not use any advertising cookies or third-party commercial trackers. Only the following are used:

• Technical identifiers necessary for service operation (authentication, session)
• Anonymized usage measurements for diagnostics and service improvement

11. Minors

InHook is not intended for children under 13 years of age. We do not knowingly collect data from minors of this age. If you believe a minor has provided us with data, contact us for immediate deletion.

12. Policy Updates

This policy may be updated at any time to reflect legal or service changes. The last update date is indicated at the top of this document. For substantial changes, you will be notified by email or via an in-app notification.

13. Contact

For any question regarding this policy or your personal data:

• Email: contact@ankhaw.com
• Mail: Ankhaw SASU — 47 rue Vivienne, 75002 Paris, France