Policies and disclosures

Privacy Notice

Last updated: August 18, 2026

This notice explains what personal data Ancestrify collects, why we collect it, who we share it with, and how you can exercise your rights. Genetic data is sensitive — we treat it as such.

1. Who we are

The data controller for personal data processed through the Service is Andi Thomaj, a sole trader registered in Tiranë, Albania (register number M61725001N), trading as Ancestrify ("we", "us"). Full trader details are in our legal notice. You can contact us at info@ancestrify.io for any privacy-related question or to exercise the rights described below.

We are established outside the EU/EEA. Where the GDPR applies to our processing of your data, we are required to designate a representative in the Union under Article 27; we are in the process of appointing one and will name them here. Until then, please write to the address above — we answer every data-protection request directly, and being outside the EU does not reduce any of the rights described in this notice.

2. What data we collect

Account data

When you create an account, we collect your email address, name, and a one-way, salted hash of your password. We use this to identify your account, send you transactional messages, and link your purchases and reports to you.

Genetic data

To run an analysis you upload genotype data (for example, a raw-data file from a consumer DNA test or a G25 coordinate set). This is special-category data under Article 9 of the UK GDPR and EU GDPR. We process it only with your explicit consent, only for the purpose of running your analysis and producing your report, and only on infrastructure configured with strict access controls. Your genetic data is processed only on our own infrastructure — it is never sent to any AI provider or other third party.

Payment data

Card payments are processed by POK Payments (operated by RPay Ltd), our payment provider. POK collects the card-payment details (card number, expiry, CVV) directly from you on its PCI-DSS-compliant payment form. Ancestrify is the merchant of record. We do not see or store your full card number. We receive a transaction reference, the amount, the country used for tax purposes, and your email so we can match the purchase to your account. POK's processing of your data is governed by POK's own privacy notice.

Technical and usage data

Like most websites, we receive technical data when you visit us — IP address, browser type and version, device type, referrer URL, pages visited, and timestamps. We use cookies and similar technologies; see your cookie preferences for details and controls.

Support correspondence

If you contact us we keep a record of the message and our reply so we can help you and improve the Service.

3. How we use your data and our legal basis

To provide the Service (run your analysis, generate your report, keep your dashboard working) — performance of our contract with you (Art. 6(1)(b) GDPR), and your explicit consent for the genetic data (Art. 9(2)(a) GDPR).
To take payment and prevent fraud — performance of our contract and our and POK's legitimate interests (Art. 6(1)(b) and (f)).
To keep the Service secure (rate-limiting, abuse detection, log review) — our legitimate interests (Art. 6(1)(f)).
To communicate with you about your account, purchases, and changes to the Service — performance of our contract (Art. 6(1)(b)) and, for non-essential communications, your consent (Art. 6(1)(a)).
To comply with our legal obligations, including tax, accounting, and responses to lawful requests — Art. 6(1)(c).
To show your entry on the public ancestry leaderboard — when you order a qpAdm or Global25 analysis you choose a public nickname and country of origin, and your order's ancestry percentages appear on the public leaderboard under that nickname (with your order's profile picture, when it has one). Your real name is never shown. This rests on the same explicit consent you give for the analysis (Art. 9(2)(a) GDPR), and you can opt any order out at any time from your dashboard's "Edit details" — its entry and picture stop being served.

4. Who we share data with

We do not sell your personal data. We share data only with the following categories of recipients, under written contracts that require them to protect it:

POK Payments (RPay Ltd) — card payment processing as our payment provider; card authorisation, settlement, and fraud prevention.
Cloudflare — application hosting, edge delivery, DDoS protection, and privacy-first website analytics (Cloudflare Web Analytics). Those analytics set no cookies and store no identifier in your browser, so they cannot recognise you across visits and are not governed by the cookie choices below; they tell us only how many people viewed each page.
OpenFreeMap and NASA GIBS — map tiles and satellite imagery for interactive maps on dashboard pages. These and every other third-party source we rely on are listed, with their licences, on our credits page.
Hetzner Online GmbH (Germany/Finland, EU) — the servers that run our analysis pipeline and store your data, including your genotype file.
Resend — delivery of transactional and, where you have opted in, marketing email.
BytePlus (ByteDance) — video generation used to produce the illustrative artwork shown alongside ancestral populations. No customer data of any kind is sent to BytePlus; it is used only to create generic reference imagery.
Google (Google Ireland Limited) — website analytics through Google Analytics 4, only if you accept analytics cookies, and advertising measurement through Google Ads, only if you accept advertising-measurement cookies. Analytics receives the pages you view, a random browser identifier, your approximate location derived from your IP address, and basic device and browser information. Ads measurement may additionally receive a first-party ad-click identifier so a visit can be attributed to the correct campaign. We disable ad personalisation and do not use remarketing or customer-list audiences. Google may process this outside the EU, including in the United States — see "International transfers" above and how Google uses business data. No genetic data, uploads, results, or account details are sent to Google. Declining or withdrawing either optional category prevents the corresponding measurement from being activated or continuing.
Professional advisers (lawyers, accountants, auditors) where necessary, and regulators or courts where required by law.

5. International transfers

Some of our processors operate in countries outside the UK and the European Economic Area, including the United States. Where we transfer personal data outside those regions, we rely on appropriate safeguards — typically the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions — and we apply additional measures where the law of the destination country makes them necessary.

6. How long we keep your data

We keep your account data for as long as your account is active and for a reasonable period afterwards to handle disputes and comply with legal obligations. We keep your genotype data only for as long as we need it to deliver and support your analysis; you can request earlier deletion at any time by emailing info@ancestrify.io. Payment and tax records are retained by us and our payment provider for the period required by applicable accounting and tax law (typically 6–10 years).

7. Your rights

Depending on where you live, you have rights over your personal data, including:

access to your data and a copy of it;
correction of inaccurate data;
deletion of your data ("right to be forgotten");
restriction of, or objection to, certain processing;
portability of data you provided to us;
withdrawal of consent at any time (without affecting processing carried out before withdrawal);
the right to lodge a complaint with your local supervisory authority — in the EU/EEA, the data protection authority of the country where you live, work, or where you believe the issue arose; in the UK, the Information Commissioner's Office (ico.org.uk); and in Albania, the Commissioner for the Right to Information and Protection of Personal Data (idp.al).

To exercise any of these rights, email info@ancestrify.io. We will respond within the timeframe required by applicable law (typically one month).

8. Cookies

We use a small number of cookies that are strictly necessary to operate the site (authentication, security, load balancing) and, with your consent, optional analytics and advertising-measurement cookies. You can review and change your choices at any time via the Cookie preferences link in the footer.

cc_cookie (strictly necessary, 6 months) — remembers your cookie choices so we do not ask again.
_ga and _ga_FM9RJCNPQJ (analytics, 2 years) — set by Google Analytics. They store a random identifier used to recognise repeat visits and to keep track of the current visit. This does not tell us your name, but it is not fully anonymous either.
_gid (analytics, 24 hours) — set by Google Analytics to distinguish visitors.
_gcl_* (advertising measurement, up to 90 days) — set by Google Ads to remember that a visit came from an advertisement and attribute later measured activity to the correct campaign. It is not used by us for personalised ads or remarketing.

Analytics and advertising-measurement cookies are only set if you accept their respective categories, and withdrawing consent deletes them.

9. Children

The Service is not intended for children. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with data, please contact us and we will delete it.

10. Security

We use technical and organisational measures appropriate to the sensitivity of the data we hold, including encryption in transit, encrypted storage, access controls, short-lived signed session tokens, rotating refresh sessions, and regular review of our hosting and processor configurations. No system is perfectly secure; if we ever experience an incident affecting your data we will notify you and the relevant authorities as required by law.

11. Changes to this notice

We may update this notice from time to time. When we do, we update the "Last updated" date at the top and, where the changes are material, give you reasonable advance notice (for example, by email or in-app notice).

12. Contact

For privacy questions, requests, or complaints, email info@ancestrify.io or write to Ancestrify.