Privacy Policy

1. Data controller

The operator of this Anto instance is the controller of the data described below. Contact: the Contact page of this instance, or the displayed support address.

2. Data we collect

Account: name, email address, password (hashed, never stored in plain text), preferences (language, theme, timezone).

Content: conversations, files, agent instructions and any content you submit to the Service.

Technical: request logs (timestamp, path, request id), strictly necessary cookies.

Billing: plan history and token consumption for paid plans.

3. Purpose

Your data is used exclusively to: operate the Service, manage accounts and quotas, bill, ensure security and support, and meet legal obligations.

It is neither resold nor used to train AI models.

4. Transfers to external AI providers

Anto is designed around external AI APIs: the content of your requests is sent to the configured providers (for example OpenAI, Anthropic, Google) in order to generate responses.

These transfers are required to operate the Service. The applicable processing terms are those of each provider; we do not use your content for other purposes.

To keep the Service secure and prevent abusive use, content sent to AI providers may be kept for up to 30 days in their abuse-monitoring logs. This content is not used to train their models. Anto does not send client content to a provider's free tier when that tier uses the data to improve its products.

5. Cookies

Session cookie: strictly necessary, keeps you signed in.

Language preference cookie (anto_locale): remembers your FR/EN choice for one year.

The theme preference (light/dark) is stored locally in your browser. No advertising or third-party tracking cookies are used.

6. Retention

Account and content: kept while the account is in use, then deleted or anonymized on request or after termination, within a reasonable delay.

Technical logs: kept as long as needed for security and debugging.

Billing data: kept for the period required by applicable accounting obligations.

7. Security

Measures in place: encryption in transit (HTTPS recommended), password hashing (Argon2id), role-based access control, strict security headers, logs without secrets.

8. Your rights

Under applicable law (including the GDPR in the European Union), you have rights of access, rectification, erasure, portability and objection regarding your data.

To exercise these rights: use the Contact page. Proof of identity may be requested.

9. Advertising and resale

No personal data is sold, rented or handed to third parties for advertising purposes.

10. Contact

Any question about this policy: the Contact page of this instance.