Privacy Policy

Last updated: 8 June 2026

This Privacy Policy explains how Zahard LTD, trading as AnchorLess ("AnchorLess",

"we", "us", "our"), collects, uses, shares and protects your personal data when you use our

website https://anchorless.io and our immigration and tax services (the "Services"). We are

the data controller for the personal data described here.

We provide administrative assistance for relocation to Europe (e.g. NIF, NIE, NISS,

tax representation, IRS filing, certificates, bank-account assistance, appointments). Because our

Services involve sensitive documents (identity documents, tax and financial data), we take

data protection seriously and comply with the EU GDPR and the UK GDPR.

Summary of key points

• What we process: identity & contact data, identity documents, tax/administrative identifiers, financial data, service documents, account & usage data (§2).
• Special categories: we do not process biometric or health data; criminal-record certificates only where strictly required (§2).
• Who we share with: vetted providers under data-processing agreements — full list at anchorless.io/sub-processors (§4).
• Where your data lives: at rest in the EU (Frankfurt / Paris); transfers safeguarded by SCC/DPF (§5).
• How long: operational data deleted 6 months after service completion; invoices kept up to 10 years (§6).
• Your rights: access, rectification, erasure, portability, objection — including specific rights for EEA/UK, Swiss, Canadian and US-state residents (§8, §11). EU contact point: Prighter (§1).

---

1. Who we are (controller & contacts)

• Controller: Zahard LTD (trading as AnchorLess), 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. Company VAT: GB 452262020.
• Data-protection contact: contact@anchorless.io (no Data Protection Officer appointed — not required; data-protection matters handled internally).
• EU Representative (GDPR Art. 27): Prighter Group (with its local partners), appointed as our privacy representative and point of contact for the European Union. Contact / exercise your rights via: https://app.prighter.com/portal/19270620082.
• UK supervisory authority: the Information Commissioner's Office (ICO). EU supervisory authorities: CNPD (Portugal), AEPD (Spain), CNIL (France).

Representative — We value your privacy and your rights as a data subject and have therefore

appointed Prighter Group with its local partners as our privacy representative and your point of

contact for the European Union (EU). Prighter gives you an easy way to exercise your privacy-related

rights (e.g. requests to access or erase personal data). To contact us via our representative Prighter

or make use of your data subject rights, please visit: https://app.prighter.com/portal/19270620082.

2. The personal data we process

Depending on how you interact with us, we process:

• Identity & contact data: name, date and place of birth, nationality, postal address, email, phone.
• Identity documents: passport / ID card, collected via our document-collection provider (no biometric processing).
• Tax & administrative identifiers: NIF, NIE, NISS, codice fiscale and equivalent government identifiers.
• Financial data: IBAN/bank details, billing information and payment data (card data is handled by our payment provider; we do not store full card numbers).
• Service-specific documents: proof of address, tax declarations (IRS), civil-status certificates (birth/death), and, where strictly required for a service, criminal-record certificates.
• Account & usage data: credentials, preferences, support messages, and technical data collected automatically (IP address, device and browser characteristics, operating system, language, referring URLs, log and usage data, approximate location derived from IP, and analytics events).
• Marketing data: contact details and engagement data where you have opted in.

Sign-in with Google

You may register or log in using your Google account. If you do, we receive limited profile

information from Google (typically your name, email address and profile picture). We use it only to

create and authenticate your account. Google's own use of your data is governed by Google's privacy

policy, not this one.

Criminal-offence data

We generally do not process "special category" data under GDPR Art. 9 (no biometric, health or

similar data). Where strictly required for a specific service, we may process **criminal-offence data

under Art. 10** (criminal-record certificates), only as necessary to deliver the requested service, on

an appropriate legal basis (compliance with a legal obligation and/or, where applicable, a national

legal basis), with enhanced safeguards and data minimisation.

3. Why we process your data & legal bases (GDPR Art. 6)

Purpose	Legal basis
Create and manage your account; authenticate you	Performance of a contract (Art. 6(1)(b))
Deliver the immigration/tax service you ordered (processing your file, liaising with authorities)	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Collect proof of identity & proof of address	Contract (Art. 6(1)(b)); KYC/AML legal obligation where applicable
Process payments, invoicing, accounting	Contract; legal obligation (accounting retention)
Customer support	Contract; legitimate interests (Art. 6(1)(f))
Transactional communications (status of your file)	Contract
Marketing communications & audience measurement	Consent (Art. 6(1)(a)); legitimate interests with opt-out
Webinars / live events (incl. recording, live translation)	Consent / legitimate interests
Security, fraud prevention, logging	Legitimate interests; legal obligation
Comply with legal requests	Legal obligation

4. Who we share your data with (processors & recipients)

We share personal data only as necessary, under written data-processing agreements (DPAs), with

service providers acting on our instructions. Categories and main providers:

• Hosting & infrastructure: Hetzner (EU + US servers), Amazon Web Services (EU storage), PlanetScale (EU database), Cloudflare (CDN/security).
• Payments: Stripe.
• Document collection (proof of identity & address): Checkin.com (Sweden/EU).
• Email: Mailgun (transactional), Brevo (marketing).
• Customer support & messaging: Crisp, Intercom.
• Appointment scheduling: Calendly.
• Document processing & AI: Mistral (EU OCR), OpenAI, Cerebras, Cartesia (used to process documents/text/voice for the Services).
• Webinars: LiveKit.
• Analytics & measurement: PostHog, Google Analytics (via server-side tagging through Addingwell).
• Advertising / remarketing: Google Ads.
• Automation, reviews & outreach: Make.com, Trustpilot, Lemlist.
• Operational tooling: Airtable, Notion.
• Anti-bot: Google reCAPTCHA.

The current, authoritative list of sub-processors (with purpose and country) is published at

https://anchorless.io/sub-processors. We update it when sub-processors change.

We may also disclose data to competent authorities and partners to carry out a service you

request (e.g. Portuguese tax authority / Finanças, AIMA, VFS Global, postal services) — these act

as independent controllers — and in the context of a merger, acquisition or legal requirement.

5. International transfers

Zahard LTD is established in the United Kingdom. Where personal data of EU/EEA residents is

made accessible from outside the EEA, we rely on appropriate safeguards:

• EU → UK: covered by the European Commission's UK adequacy decision (status monitored).
• Transfers to the United States (certain sub-processors): **EU Standard Contractual Clauses

(SCCs) and, where the provider is certified, the EU-US Data Privacy Framework (DPF)**, plus

supplementary measures (encryption, access controls, data minimisation).

• Data at rest is kept in the EU (database in Frankfurt, file storage in Paris). Our US server

is a stateless compute node serving the Americas; EU residents are not routed to it.

You can request a copy of the relevant safeguards using the contact details in §1.

6. How long we keep your data

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it:

• Operational service data & documents (identity/address documents, application data): deleted or anonymised 6 months after the service is completed (automated purge).
• Billing/accounting data (invoices): retained as legally required (up to 10 years); never affected by the purge.
• Marketing data: until you withdraw consent / object.
• Security logs: 6 to 12 months.

Specific retention periods are documented in our internal retention schedule and may be provided on request.

7. How we protect your data

We apply technical and organisational measures including encryption in transit and at rest,

strict access controls and least privilege, multi-factor authentication, managed devices,

logging and monitoring, and vendor due diligence. No method of transmission or storage is 100%

secure, but we work to protect your data appropriately.

8. Your rights

Under the GDPR and UK GDPR you have the right to: access your data; request rectification

or erasure; restrict or object to processing; data portability; and **withdraw

consent** at any time (without affecting prior processing). To exercise these rights, contact us

(§1). We respond within one month (extendable for complex requests).

You also have the right to lodge a complaint with a supervisory authority — the ICO (UK) or

your local EU authority (CNPD Portugal, AEPD Spain, CNIL France).

Switzerland: if you are located in Switzerland, you may contact the **Federal Data Protection

and Information Commissioner (FDPIC)**; equivalent rights apply under the Swiss FADP.

Canada: if you are located in Canada, we process your personal information with your express

or implied consent, which you may withdraw at any time (subject to legal or contractual

restrictions); you may also complain to the Office of the Privacy Commissioner of Canada.

Account information: you can review or update your account information at any time from your

account, or contact us to terminate your account. Upon termination we deactivate/delete your

account and apply the retention rules in §6 (some data may be retained where legally required,

e.g. invoices, fraud prevention).

Withdrawing consent / opting out of marketing: unsubscribe links are included in every

marketing email, or contact us (§1). Withdrawal does not affect processing already carried out.

9. Cookies & tracking

We use cookies and similar technologies (including server-side tagging) for strictly necessary

functions, analytics and advertising. You can manage your choices through our consent banner.

See our Cookie Policy for details.

10. Children

Our Services are intended for adults (18+). We do not knowingly collect data from children

under 18. Where a service concerns a minor (e.g. a dependant in a family relocation), it is

provided through the parent/guardian.

11. US state residents — specific privacy rights

If you are a resident of a US state with a comprehensive privacy law (e.g. California, Colorado,

Virginia, Texas…), the following applies.

Categories of personal information collected in the last 12 months:

Category	Examples	Collected
A. Identifiers	Name, postal address, phone, email, IP address, account name	YES
B. Protected classification characteristics	Date of birth, national origin, marital status	YES
C. Commercial information	Transactions, purchase history, payment information	YES
D. Biometric information	Fingerprints, faceprints, voiceprints	NO
E. Internet or similar network activity	Browsing/usage data, interactions with our website and ads	YES
F. Geolocation data	Approximate location (derived from IP)	YES
G. Audio/electronic/visual information	Webinar audio/video recordings (with notice/consent)	YES
H. Professional or employment information	—	NO
I. Education information	—	NO
J. Inferences	Preferences/profile drawn from the above	YES
K. Sensitive personal information	Government identifiers (e.g. passport/ID number) processed to deliver the requested service	YES (service delivery only)

We retain these categories per §6. We do not "sell" personal information for money. Online

advertising/analytics cookies may qualify as "sharing"/targeted advertising under some state laws —

you can opt out via our consent banner (§9).

Your rights (subject to legal limits): to know/access, correct, delete, obtain a copy, opt out

of targeted advertising/profiling, and non-discrimination for exercising your rights. You may use an

authorised agent (proof of authorisation required). To exercise these rights, contact

contact@anchorless.io; we will verify your identity before responding.

Do-Not-Track: there is no finalised industry standard for DNT signals, so we do not respond to

them at this time; we honour the choices you make in our consent banner.

12. Changes to this policy

We may update this policy to remain compliant. The "Last updated" date reflects the latest version;

material changes will be notified appropriately.

13. Contact

Questions or requests: contact@anchorless.io or by post to Zahard LTD,

71-75 Shelton Street, London WC2H 9JQ, United Kingdom. EU residents may also contact our

EU Representative, Prighter — https://app.prighter.com/portal/19270620082.