Privacy Policy
This policy explains what personal data Eshkal processes, why, which service providers are involved, and the rights you have under the GDPR.
Controller
Mohamed Aly, Eupener Str. 12, 52066 Aachen, Germany. Privacy requests: privacy@eshkal.com.
What we collect
Account details (name, email), letters you scan and the answers you give inside a flow, optional family profiles, payment metadata (never card numbers), and basic usage data. We never sell your data.
Letter scans & AI processing
Scanned official letters can contain sensitive information (e.g. about benefits or health). To produce your analysis they are processed by our AI providers Anthropic (scans, text) and OpenAI (voice transcription), both USA, under EU standard contractual clauses / the EU-US Data Privacy Framework, solely to generate your result — never to train their models on your data.
The AI Agent
When you ask the Agent to act, it only touches the services and forms you explicitly approve, step by step. You can pause or cancel at any time, and we log everything it does.
Payments
Payments are processed by Stripe. Your card data goes directly to Stripe and never reaches our servers. Stripe may transfer data to the USA under the EU-US Data Privacy Framework.
Hosting & infrastructure
Your data is stored on servers operated by Hetzner Online GmbH in Germany. Our website is delivered via Cloudflare. Optional Google sign-in is processed by Google.
Analytics
We use Google Analytics (via Google Tag Manager) to understand how the product is used. Where required, this only happens with your consent, and you can withdraw it at any time.
Data retention
You can delete any scan, flow, or your entire account from Settings at any time. When you delete your account, we remove your personal data within 30 days, except where statutory retention duties (e.g. invoices) require longer storage.
Your rights
You can access, correct, export, or delete your data, object to certain processing, and withdraw consent. Contact privacy@eshkal.com. You also have the right to lodge a complaint with a supervisory authority — for us: the Data Protection Commissioner of North Rhine-Westphalia (LDI NRW).
Last updated 1 June 2026