1. Scope
This policy explains how ANAFRA handles personal data when you visit this site, create an account, or use our services. It covers the data of account holders and of the beneficial owners, members, and officers declared for a company.
ANAFRA is the controller of that data. Where we act on the documented instructions of a customer, for instance to hold documents relating to their company, we act as a processor for that part.
2. What we collect, and why
We collect only what a given purpose requires:
- Account data : name, email address, password (stored only as a hash), country of residence, language, and the terms version you accepted. Purpose: operating your account and signing you in.
- Questionnaire answers : desired company name, sector, activity, number of owners, intended purpose, U.S. presence. Purpose: preparing your filing and producing the structure recommendation shown to you.
- Company and member data : legal name, address, entity type, and for each member their name, date of birth, nationality, country of residence, address, and ownership share. Purpose: preparing filings, and identifying beneficial owners as required by law.
- Identity documents : passport, national identity card, driving licence, or proof of address. Purpose: identity verification. These are the most sensitive records we hold.
- Order and payment data : order contents, amounts, invoices, and the payment reference returned by our payment provider. We never receive your full card number.
- Technical data : IP address, browser, and session events, kept in security logs.
3. Legal bases
We rely on the performance of our contract with you for account, order, and filing data; on our legal obligations for identity verification, accounting, and record retention; on our legitimate interest in securing the platform and preventing fraud for security logs; and on your consent for optional analytics and marketing messages, which you may withdraw at any time.
4. Who we share it with
We share personal data only where a purpose requires it: with the state authority and the IRS for the filings you ordered; with the registered agent providing the statutory address; with our payment provider to take payment; with our email and SMS providers to send you notifications; with a banking partner where you asked us to introduce an application; and with hosting and infrastructure providers.
We do not sell personal data, and we do not share it for third-party advertising.
5. International transfers
Forming a U.S. company necessarily involves transferring data to the United States. Where data leaves the country in which it was collected, we rely on the transfer mechanisms permitted by the applicable law and require equivalent safeguards from our processors by contract.
6. How long we keep it
Account and company data are kept for the life of the account, then for the period required to answer a later claim or an authority request. Filings, invoices, and accounting records are kept for the statutory period. Identity verification records are kept for the period imposed by anti-money-laundering rules, which is generally five years after the end of the relationship. Security logs are kept for a rolling period proportionate to their purpose.
Deleting your account does not erase records we are legally required to keep. It does end their use for any other purpose.
7. How we protect it
Passwords are hashed, never stored in a readable form. Sensitive data is encrypted. Documents are held in a private store and are never reachable through a permanent public address: every download passes through an authenticated, logged request. Administrator accounts require a second authentication factor, their permissions are granted by role, and sensitive actions are written to an audit log.
No system is immune. Where a breach is likely to result in a risk to your rights, we will notify the competent authority and, where required, you.
8. Your rights
Subject to the applicable law, you may request access to your data, its correction, its deletion, a restriction of processing, a copy in a portable format, or object to processing based on our legitimate interest. You may also withdraw a consent you have given, without affecting what was done before.
9. Contact
Write to us at the address shown at the end of this page. We answer within the period set by the applicable law, and in any case within one month. If you are not satisfied with our answer, you may lodge a complaint with your national data protection authority.