Privacy Policy

2. Controller and processor

For your account, billing, support messages, and site analytics, Yao Elom ESSAN is the controller. When you connect a client’s books or a spreadsheet so Ilka can build a pack, you choose the purposes of that processing. For that client data, you are the controller and he processes it on your instructions.

3. Data we collect

• Account: name, email address, authentication identifier, and role, via our sign-in provider.
• Billing: Stripe customer and subscription identifiers. We do not store your full payment-card number.
• Workspace: client names, optional client emails, team invites, and pack settings you enter.
• Connected sources: the records you ask us to pull, and connector tokens encrypted at rest.
• Support: messages you send through the contact form or support tickets.
• Technical data: logs needed to run and secure the Service, and product-usage events.
• Analytics: Vercel Analytics, and Google Analytics only if a measurement id is configured for the deployment.

4. Why we use it

• Provide the Service, including packs, generation, and delivery (contract).
• Take payment and keep billing records (contract and legal obligation).
• Secure the Service, prevent abuse, and keep it reliable (legitimate interests).
• Answer support requests (contract and legitimate interests).
• Understand how the public site is used (legitimate interests). Where the law requires consent for a non-essential cookie or similar technology, we rely on consent.

5. AI

When you ask Ilka to design a report layout, we may send column names, column types, and a few masked sample rows to Anthropic (Claude) so it can suggest groupings and columns. Names, email addresses, postal addresses, and other personal contact details in those sample rows, plus free-text notes, are masked before any call. The full dataset from QuickBooks, Xero, Pennylane, or other sources stays on Ilka’s servers and is used only locally to fill the layout. You can disable AI for a data source entirely (“Don’t use AI for this source / Ne pas utiliser l’IA pour cette source”), in which case Ilka uses a standard layout with no Anthropic call.

For a one-off workbook, an uploaded file is parsed in the browser and the original file is not uploaded. Sheet names, headers, and data rows (up to 500 rows per sheet) may be sent to the model so it can draft the workbook. Ilka does not train its own models on customer content. Calls to Anthropic are subject to Anthropic’s API terms.

6. Who we share it with

We do not sell personal information. We share it with service providers who process it for us, with sources you choose to connect, and with authorities when the law requires it.

• Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — hosting and Vercel Analytics (https://vercel.com).
• Clerk — account sign-in.
• Stripe — payment processing.
• Anthropic — AI layout design and one-off generation.
• Resend — transactional email.
• Inngest — scheduled and background jobs.
• The hosted PostgreSQL database that stores account and product data.
• Google (sign-in, Sheets, Drive, or Analytics) and Microsoft (SharePoint or OneDrive) when you use those connections.
• Accounting or data sources you connect, such as Xero, QuickBooks, Airtable, Pennylane, HubSpot, or Notion, only for the connection you set up.

7. International transfers

The site is hosted by Vercel Inc. in the United States. Other providers may process data in the United States or in other countries. Where personal data is transferred from the European Economic Area or the United Kingdom, the transfer uses an appropriate mechanism, such as Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

8. Retention

Account data is kept for the life of the account. If you delete the sign-in account, we anonymise the profile (the name and email are replaced) and remove the subscription record. Other personal data is deleted or anonymised when you ask, except records we must keep to meet a legal obligation, including billing records. Copies in backups can remain for a short further period before they cycle out.

9. Security

We use TLS in transit and encrypt connector tokens at rest. More detail is on the Security page. No method of transmission or storage is perfectly secure.

10. Your rights

Depending on where you live, you can ask for access, rectification, erasure, restriction, portability, and objection, and you can withdraw consent where processing is based on consent. Email contact@ilka.co. We reply within one month. You can also complain to the CNIL (cnil.fr). See GDPR.

11. Cookies

Sign-in uses essential cookies from our authentication provider. A short-lived cookie stores the OAuth proof key while you connect a source. Vercel Analytics runs on the site. Google Analytics runs only when a measurement id is configured. The site does not currently show a separate cookie-choices banner. You can block or delete cookies in your browser. Essential cookies are required to stay signed in.

12. Children

The Service is aimed at business users and is not directed at children under 16. We do not knowingly create an account for a child under 16. If you believe we have, email us and we will delete it.

13. Changes

We may update this policy. The date at the top of this page will change. The current version is always the one published here.

14. Contact

Controller: Yao Elom ESSAN, 41 rue Berger, 75001 Paris, France. Email: contact@ilka.co. Product support: support@ilka.co.