Privacy Policy

1. Who we are

Incant is a product of Äctvli Responsible Consulting (“we”, “us”, “our”). We are the data controller for personal data processed through incant.actvli.com.

Contact: reachout@actvli.com

2. What data we collect

• Account data: Your email address, used solely for authentication via magic link. We do not store passwords.
• App content: The apps (“spells”) you create — their names, configurations, and data you enter while using them.
• Usage data: View counts on public spells. We do not use cookies for tracking or analytics.
• Payment data: Billing is handled entirely by Stripe. We store only your Stripe customer ID and subscription status — never your card details.
• Voice input: If you use voice input, audio is processed entirely in your browser via the Web Speech API. We never receive or store your audio.
• App input text: The text description you type or speak is sent to Anthropic’s Claude API to generate your app. See section 5 for details.

3. Legal basis for processing (GDPR)

• Contract performance: Processing your email and app data to provide the Incant service.
• Legitimate interests: View counts on public spells to show popularity.
• Legal obligation: Retaining billing records as required by applicable law.

4. Cookies

Incant uses only strictly necessary cookies — specifically, a session cookie to keep you logged in. This cookie is essential for the service to function. No consent is required for strictly necessary cookies under GDPR.

We do not use advertising cookies, analytics cookies, or any third-party tracking.

5. Third-party processors

We work with the following sub-processors, each bound by data processing agreements:

6. Data retention

• Your account and app data is retained for as long as your account is active.
• When you delete a spell, it is permanently removed from our database.
• When you delete your account, all personal data is deleted within 30 days, except billing records which are retained for 7 years as required by law.

7. Your rights under GDPR

If you are located in the EEA, UK, or Switzerland, you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate data.
• Erasure: Delete your account and all associated data from your dashboard settings.
• Portability: Request your data in a machine-readable format.
• Restriction: Request we limit processing of your data.
• Objection: Object to processing based on legitimate interests.

To exercise any right, email reachout@actvli.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

8. International transfers

Some of our processors (Anthropic, Stripe, Vercel) are based in the United States. Transfers are covered by Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by the European Commission.

9. Children

Incant is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us at reachout@actvli.com.

10. Changes to this policy

We may update this policy. We will notify you by email for material changes. Continued use after notice constitutes acceptance.