Skip to content
AKANTIO

Privacy Policy

Effective date: May 7, 2026

This Privacy Policy explains how Akantio ("we", "us", or "our") collects, uses, and protects personal data when you use the AKANTIO website and Akantio POS at https://akantio.com/. We are committed to handling your data responsibly and in compliance with the General Data Protection Regulation (GDPR) and applicable privacy laws.

1. Data We Collect

Account Information

  • Name and email address (required to create an account)
  • Company name and contact details
  • Password (stored as a bcrypt hash — we never store plaintext passwords)

Payment Information

Payments are processed by Stripe. We receive only a transaction reference and basic billing details. Full card numbers and sensitive payment data are handled exclusively by Stripe and never stored on our servers. Stripe's privacy policy is available at stripe.com/privacy.

License and Device Data

  • Software license keys and their activation status
  • Device identifiers submitted during POS software activation
  • License lifecycle events (activation, renewal, revocation) logged for audit purposes

Usage and Technical Data

  • IP addresses and browser/device information collected via server logs
  • API request logs for security and rate-limiting purposes
  • Timestamps of logins and key actions

Communications

If you contact us via email or the contact form, we retain the content of your message to respond and track support history.

Project Inquiries

If you send a project inquiry, we store your name, business email, company name (optional), the service, budget range and timeline you choose, and your project description. We use these details only to reply to you and prepare a proposal, with your consent given on the form, and keep them only as long as needed for that conversation and any agreement that follows.

2. How We Use Your Data

  • Providing and operating the Service (license management, billing, support)
  • Authenticating users and enforcing security policies
  • Processing payments and issuing license keys
  • Sending transactional emails (account confirmation, license activation, expiry notices)
  • Monitoring for abuse, fraud, and unauthorized access
  • Complying with legal obligations

We do not sell your personal data. We do not use your data for advertising or profiling.

3. Legal Basis for Processing (GDPR)

  • Contract performance: Processing necessary to provide the service you purchased (account management, license issuance, billing).
  • Legal obligation: Retaining transaction records as required by law.
  • Legitimate interests: Security monitoring, fraud prevention, and service improvement.
  • Consent: Optional communications (e.g., product updates) where you have explicitly opted in.

4. Data Sharing

We share personal data only with the following parties:

  • Stripe — payment processing. Stripe acts as an independent data controller for payment data.
  • Infrastructure providers — cloud hosting and database providers used to operate the platform, bound by data processing agreements.
  • Legal authorities — only when required by applicable law or valid legal process.

We do not share your data with third-party marketers or analytics companies.

5. Data Retention

  • Account data is retained for as long as your account is active.
  • After account deletion, personal data is removed within 30 days, except where retention is required by law (e.g., financial transaction records, typically 7 years).
  • Audit logs are retained for a minimum of 2 years for compliance purposes.
  • Support communications are retained for up to 3 years.

6. Security

We apply industry-standard security measures including TLS encryption in transit, AES-256 encryption for sensitive data at rest, bcrypt password hashing, JWT-based authentication with short-lived tokens, and rate limiting on authentication endpoints. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

7. Your Rights

Under GDPR and applicable law, you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion of your personal data ("right to be forgotten").
  • Restriction — request that we limit processing of your data.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Cookies

We use only essential cookies required for authentication (session tokens) and security (CSRF protection). We do not use tracking cookies or third-party advertising cookies. You may disable cookies in your browser, but this will prevent you from logging in to the platform.

9. International Transfers

Your data may be processed on servers located within the European Economic Area (EEA) or in countries with an adequacy decision by the European Commission. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by email or by a prominent notice in the customer portal before the change takes effect. The updated date at the top of this page always reflects the latest revision.

12. Contact and Complaints

For privacy-related questions or to exercise your rights, contact us at: [email protected]

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national data protection authority (e.g., your local supervisory authority under GDPR).