Whether you are an individual creator, an agency, or an enterprise company located in the European Union, the United Kingdom, or serving EU citizens, Anchorflow provides lawful data processing, transparent subprocessors, and prompt execution of all Data Subject Rights.
1. Our Role: Controller vs. Processor
Under the General Data Protection Regulation (Regulation (EU) 2016/679), Anchorflow operates in two distinct capacities:
We act as a Data Controller for our customers' account information, login credentials, billing details, customer service correspondence, and direct website analytics on useanchorflow.com.
When you input target websites to crawl and analyze internal link structures, you are the Data Controller and Anchorflow acts as the Data Processor, analyzing public web text strictly according to your instructions.
2. Your Data Subject Rights Under GDPR
The GDPR grants individuals located within the European Economic Area (EEA) comprehensive rights regarding their personal data. We honor these rights for all customers globally:
Right of Access (Article 15 GDPR)
You have the right to request confirmation of whether we process your personal data and to receive a copy of all stored data.
Right to Rectification (Article 16 GDPR)
You can update or correct your profile details anytime in your account settings or request that we rectify inaccurate data.
Right to Erasure / "Right to be Forgotten" (Article 17 GDPR)
You may delete projects or request total account termination, which initiates complete deletion of your records across our active database within 30 days.
Right to Restriction of Processing (Article 18 GDPR)
You may request that we temporarily restrict data processing while verifying the accuracy of personal records.
Right to Data Portability (Article 20 GDPR)
You have the right to export your internal link suggestions, keywords, and crawl records in a machine-readable JSON/CSV format.
Right to Object (Article 21 GDPR)
You have the right to object at any time to processing based on legitimate interests or direct marketing communications.
3. Authorized Subprocessor Directory
Anchorflow partners with industry-leading cloud providers who maintain independent third-party audits and certifications (e.g. SOC 2 Type II, ISO 27001):
| Subprocessor | Role & Activity | Data Location | Transfer Mechanism |
|---|---|---|---|
| Supabase Inc. | Customer Database & Auth Engine | United States / EU Regions | Standard Contractual Clauses (SCCs) |
| Stripe Inc. | PCI-DSS Compliant Payment Gateway | United States / Global | Data Privacy Framework & SCCs |
| Google Cloud / Gemini | AI Language Model Processing (Stateless) | United States / Global | Enterprise Cloud DPA & SCCs |
| Vercel Inc. | Application Hosting & Edge CDN | Global Edge Network | Standard Contractual Clauses (SCCs) |
4. International Data Transfers
Whenever Anchorflow transfers personal data originated in the European Union or United Kingdom to infrastructure located outside the EEA, we ensure an equivalent level of protection is applied by executing the European Commission's Standard Contractual Clauses (SCCs) under Decision 2021/914 or relying on the EU-U.S. Data Privacy Framework.
5. Data Processing Addendum (DPA)
If your organization processes European personal data and requires a countersigned Data Processing Addendum (DPA) incorporating Standard Contractual Clauses, Anchorflow provides a standard DPA ready for execution.
Please email privacy@useanchorflow.com with your company legal name and address, and our team will issue the DPA for digital signature.
6. Technical & Organizational Measures (TOMs)
Pursuant to Article 32 GDPR, Anchorflow maintains appropriate security controls:
- End-to-end transport layer encryption (TLS 1.3) for all web and API traffic.
- Encryption at rest for all database tables and automated snapshot backups (AES-256).
- Zero retention of raw payment card numbers.
- Principle of least privilege for developer and operational access keys.
- Periodic vulnerability assessments and automated dependency auditing.
7. Personal Data Breach Protocol
In the event of a verified security incident affecting personal data, Anchorflow will notify affected users and the relevant lead supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, in compliance with Articles 33 and 34 GDPR.
8. Contact our Data Protection Team
For any inquiry or to lodge a complaint regarding data processing, contact:
Anchorflow Data Protection Lead
Interlink AI System
Direct Email: privacy@useanchorflow.com
General Legal: legal@useanchorflow.com
You also have the right to lodge a complaint with an EU data protection supervisory authority in your country or habitual residence.