1. Controller and contact details
The data controller is Annota S.r.l., with registered office at Via Davide Lazzeretti 2/P, 58100 Grosseto, EU VAT No. IT01783380536, Tax code / Companies Register no.: 01783380536 - Maremma e Tirreno, REA No. GR-236295, fully paid-up share capital of €10.000,00, certified email (PEC) annotasrl@pec.it.
- Privacy email: team@annota.ai
- Certified email (PEC): annotasrl@pec.it
Annota AI has not appointed a Data Protection Officer (DPO). For any privacy request, use the contact details above.
2. Scope of this notice and privacy roles
Annota AI is the controller for the processing described here: website, Account, contract, platform, internal analysis, billing, communications, and security. For customer content, see section 13.
This notice does not cover third-party websites or services reached through links, or external applications you authorize to access your Account, such as MCP clients: their providers process data under their own notices. Annota AI’s providers are listed in section 6.
The conditions of the Service are set out in the Terms of Service.
3. Data processed and sources
We process only data relevant to the activities described here. Data comes from you, your organization, the systems you use to access the Service and, only for identity, payment, and security, our providers.
- Account and authentication: name, verified email, Account identifier, linked Google or GitHub identities, passkey public keys and metadata, sessions.
- Profile and onboarding: avatar, language, role, use case, team size, referral source, and other optional information.
- Organization: workspace name and logo, memberships, roles, invitations, and member and invitee email addresses.
- Contract and usage: Plan, subscription, purchased members, storage add-ons, credits, storage used, features and operations used, event identifiers and dates.
- Billing and payment: billing details stored by Annota AI, namely buyer type (individual or business), name or business name, billing email, country, and postal code and, for businesses, full address, VAT number, and SDI recipient code or PEC; customer and subscription identifiers, amounts, currency, and payment status. These details are shared with the payment provider, which keeps the payment instrument data: Annota AI does not receive complete card details. The codice fiscale (Italian tax code) is processed only if a consumer sends it by email to request an invoice.
- Contractual acceptances and declarations: Terms acceptances (user, version, and date); purchases with the declarations made (request for immediate performance, consent to the loss of the right of withdrawal, specific approval of clauses, Terms version, user, and dates); withdrawals (name, email, date, and time).
- Customer content: datasets and versions, files, documents, audio recordings, which may contain people’s voices, and their transcripts, text, labels, annotations, instructions, output, OCR results, exports, training runs, and models; imported text, summaries, and indexes of knowledge bases; Brain chat conversations with questions, answers, and cited sources.
- Preferences and authorizations: interface preferences and authorized external applications, with client identifier, permissions, and approval or revocation dates.
- Communications: first name, last name, email, optional company and industry, language, request type and identifier, messages and replies.
- Illegal content reports: the reporter’s name and email, if provided, the report type, the location of the reported content, the reasons for the report, the country indicated, the decision, and communications.
- Technical and security data: IP address, date and time, URL, technical headers, request or session identifiers, browser or device, logs and events.
Annota AI manages authentication and sessions directly. If you choose to sign in with Google or GitHub, we receive from the provider the identification and profile data needed to sign in.
4. Purposes, legal bases, and retention
For representatives of a customer organization who are not a party to the contract, the legal basis is the legitimate interest of Annota AI and the customer in performing the Service (Art. 6(1)(f) GDPR), instead of the contract.
Demo, contact, and model-access requests
Data processed
Communications data listed in section 3.
Purpose and legal basis
Responding, arranging the demo, or assessing model access. Pre-contractual steps requested (Art. 6(1)(b) GDPR) or legitimate interest in managing communications (Art. 6(1)(f)), depending on the request.
Retention
Up to 24 months after the last substantive contact. If a contract follows, the contract’s retention periods apply.
Account, authentication, sessions, and authorized applications
Data processed
Account and authentication data, application authorizations, and security data.
Purpose and legal basis
Creating and managing the Account and authenticating you (Art. 6(1)(b) GDPR); preventing unauthorized access and protecting the Service (legitimate interest, Art. 6(1)(f)).
Retention
For the duration of the Account. Upon closure, access is disabled. Identifying profile data is deleted or anonymized after a short technical period, normally no more than 30 days after closure, if you no longer belong to any organization, subject to legal, security, or legal-defense requirements.
Profile and onboarding
Data processed
Name, avatar, language, role, use case, team size, referral source, and preferences.
Purpose and legal basis
Configuring the experience and providing requested features (Art. 6(1)(b) GDPR); improving onboarding and the Service (legitimate interest, Art. 6(1)(f)).
Retention
Same as the Account. The pseudonymous Account identifier, linked to content, credits, and logs, and data required for legal obligations, audit, security, or legal defense may be retained longer.
Organizations, roles, and invitations
Data processed
Organization data listed in section 3 and invitation status.
Purpose and legal basis
Managing workspaces, access, and collaboration (Art. 6(1)(b) GDPR); ensuring access security and traceability (legitimate interest, Art. 6(1)(f)).
Retention
For the duration of the workspace. Unaccepted invitations expire after a short period, normally no more than 7 days. Essential access information may be retained longer for security, contractual obligations, or protection of legal rights.
An audit log, with identifiers but no names or content, is kept even after the organization is deleted. Events relating to contracts, billing, credits, and ownership of the organization are kept for up to 10 years from the event, to protect legal rights (ordinary limitation period, Article 2946 of the Italian Civil Code) and for accounting obligations. Other security and administration events are kept for up to 24 months.
Platform delivery
Data processed
Contract and usage data and customer content listed in section 3.
Purpose and legal basis
Providing, maintaining, and supporting the Service, measuring storage, and applying Plan limits (Art. 6(1)(b) GDPR). For personal data in customer content, see section 13.
Retention
For the duration of the relationship, according to the customer’s deletion choices, the Terms, and any DPA. Temporary exports expire after a short period, normally no more than 7 days.
Brain conversations and knowledge bases are kept until the user or the organization deletes them. A user’s conversations are also deleted when the user leaves or is removed from the organization or deletes their Account; all of this data is deleted when the organization is deleted. Copies in backups then expire according to backup cycles.
Deletions, backups, and legal obligations may follow different technical timelines.
Internal analysis and Service improvement
Data processed
Usage data, events, technical metadata, and pseudonymous identifiers, read by Annota AI with an internal tool on a read-only copy of the platform database. We do not read customer content and do not use third-party analytics providers.
Purpose and legal basis
Understanding how the Service is used, planning its capacity, and improving its reliability and features: legitimate interest of Annota AI (Art. 6(1)(f) GDPR). Results are used only in aggregate form and are not used to profile individuals.
Retention
Aggregate and anonymous statistics, which do not allow individuals to be identified, are kept without time limit. The source data follows the retention of the data it comes from.
Subscriptions, credits, payments, invoices, and acceptances
Data processed
Billing and payment data, purchased members, storage add-ons, credits and pooled allowances, promotional codes and the user who used them; Terms acceptances, purchases with the related declarations, and withdrawals listed in section 3.
Purpose and legal basis
Entering into and performing the contract (Art. 6(1)(b) GDPR); complying with tax and accounting obligations and the confirmation obligations of the Italian Consumer Code (Art. 6(1)(c)); preventing fraud, proving the conclusion of the contract and the declarations made, and protecting legal rights (Art. 6(1)(f)).
Retention
For the duration of the relationship; tax, accounting, and contractual documents are normally retained for 10 years. Terms acceptances, purchases with the related declarations, and withdrawals are retained for up to 10 years from the event, including after Account closure, linked to the pseudonymous identifier; the names of people withdrawing are retained as part of the evidence. The payment provider also applies its own retention periods for financial, anti-fraud, and legal obligations.
Operational email and support
Data processed
Email, name, organization, and only the information needed to describe the event, the request, or the outcome of an operation; for new sign-in alerts, the sign-in method, browser or device, date, and time.
Purpose and legal basis
Sending invitations and notices about the Account, exports, and requested operations, and providing support (Art. 6(1)(b) GDPR); sending order and withdrawal confirmations (legal obligation, Art. 6(1)(c)); alerting you to sign-ins from an unrecognized browser (legitimate interest in security, Art. 6(1)(f)); ensuring reliability and support (legitimate interest, Art. 6(1)(f)). Emails do not track opens or clicks.
Retention
For the time needed to deliver and manage the event. Administrative support correspondence is normally kept for up to 24 months after closure, subject to contractual, legal, or security requirements. Documents, attachments, and other customer content received in support are instead removed when no longer needed for the request, in accordance with the DPA.
Direct communications
Data processed
Contact details and the content of the communication.
Purpose and legal basis
Responding to your requests: pre-contractual steps (Art. 6(1)(b) GDPR) or legitimate interest in managing correspondence (Art. 6(1)(f)), depending on the content.
Retention
Up to 24 months after the request is closed, unless needed for a contract or a dispute.
Illegal content reports (DSA)
Data processed
The reporter’s name and email, if provided; the report type, the location of the reported content, the explanation of the reasons, and the country indicated; the decision taken and communications with the reporter and the user concerned.
Purpose and legal basis
Receiving and reviewing reports, deciding, and communicating the decision: legal obligation (Art. 6(1)(c) GDPR, in connection with Article 16 of Regulation (EU) 2022/2065). We do not disclose the reporter’s identity to the user concerned, except where required by law or necessary, for example for some copyright infringement reports.
Retention
24 months from the decision; longer only if needed to establish, exercise, or defend legal claims.
Website and platform delivery and security
Data processed
Technical and security data listed in section 3.
Purpose and legal basis
Providing reliable systems, preventing abuse and incidents, and diagnosing errors: performance of the contract for requested features (Art. 6(1)(b) GDPR) and legitimate interest in security and proper operation (Art. 6(1)(f)).
Retention
Authentication security events: normally no more than 180 days. Logs and metadata held by network and email providers: according to the provider’s service, plan, and settings, based on service delivery, security, and legal needs. Data relating to an incident: up to 12 months, or longer if needed for a legal obligation or to protect legal rights.
Preferences and technical browser storage
Data processed
Cookies and local storage data listed in section 8.
Purpose and legal basis
Remembering settings, maintaining the session, and completing initiated flows: performance of the contract (Art. 6(1)(b) GDPR) and legitimate interest in proper interface operation (Art. 6(1)(f)).
Retention
As stated in section 8.
Legal obligations and protection of rights
Data processed
Data needed to respond to privacy requests, authorities, or disputes.
Purpose and legal basis
Complying with legal obligations (Art. 6(1)(c) GDPR) and establishing, exercising, or defending legal claims (Art. 6(1)(f)).
Retention
For the period required by law. Privacy requests and related evidence: normally 5 years. Accounting and contractual documents: 10 years, where applicable. Data kept only to comply with legal obligations, for example accounting or evidence, is kept separate and used only for that purpose.
5. Provision of data
In the demo, contact, and model-access forms, first name, last name, and email are required, and a message is also required for contact and model-access requests. Company and industry are optional. Without the required data, we cannot handle the request. In the illegal content report form, the report type, the location of the content, the reasons, and the good-faith statement are required; country, name, and email are optional, but without an email we cannot confirm receipt or communicate the decision. The forms do not subscribe you to promotional communications.
Data needed to create and protect the Account, use features, or complete a purchase is necessary for the relevant Service. Other profile and onboarding data is optional, unless otherwise indicated in the interface.
Do not enter in public forms special categories of data (for example health, biometric or genetic data, political opinions, religion, sex life, ethnic origin, trade union membership), data on criminal convictions or offenses, credentials, identity documents, or other data not needed for the request.
6. Recipients and processors
Data is accessed by authorized Annota AI personnel and contractors, bound by confidentiality and only to the extent necessary. They access customer content and Brain conversations only when needed for support requested by the customer, for security and abuse prevention, or to comply with legal obligations. Data may also be disclosed to:
- Scaleway S.A.S.: primary cloud infrastructure (compute, database, object storage, and database backups) in France (EU).
- Cloudflare, Inc.: DNS, content delivery, network protection, edge functions, and protected transit of requests and files.
- Google and GitHub: only if you choose to use them to sign in or link an identity, for the data of the relevant authentication flow.
- Stripe Payments Europe, Limited and the Stripe group companies involved: checkout, subscriptions, credits, invoicing, taxes, fraud prevention, and payments.
- Mailjet SAS (Sinch group): forwarding form requests to Annota AI, with fields and message, one-time sign-in codes, and operational platform email, such as security and new sign-in notices, invitations, order and withdrawal confirmations, support requests sent from the Application, and the results of exports or processing. Emails do not track opens or clicks.
- Google Cloud Italy S.r.l., through Google Workspace: Annota AI’s mailboxes and correspondence, including support and related attachments. This is separate from Google sign-in.
- Legal, tax, or technical advisers bound by confidentiality, where necessary.
- Public authorities, supervisory bodies, or entitled parties, in the cases provided for by law.
The Service’s AI models, including Brain chat, run on the infrastructure of the providers listed in this section.
Providers that process data on Annota AI’s behalf act as processors under an agreement pursuant to Article 28 GDPR. Some may act as independent controllers for their own legal or security obligations; in that case their own notices apply, available through the links above.
7. Transfers outside the European Economic Area
Customer content and the primary database and object storage are on Scaleway infrastructure in France (EU). However, some processing connected with the Service may take place outside the European Economic Area (EEA):
- Google and GitHub, if you use them to sign in, may process authentication and technical data outside the EEA.
- Cloudflare’s global network may process technical and traffic data in several countries.
- Stripe and financial network participants may process payment, billing, and anti-fraud data outside the EEA.
- Google Workspace may process correspondence and related attachments outside the EEA.
- Authorized provider personnel may access data from the countries where they work.
If authorized Annota AI personnel or contractors access data from outside the EEA, the safeguards described in this section apply.
Transfers rely on an adequacy decision or on the safeguards under Articles 44 et seq. GDPR, such as the European Commission’s Standard Contractual Clauses with the necessary supplementary measures. The Data Privacy Framework applies only if the recipient and the processing fall within the relevant adequacy decision.
You can request information and a copy of the safeguards, except for confidential parts or parts that protect the rights of others, by writing to team@annota.ai. Contact form
9. Data security
Annota AI adopts technical and organizational measures proportionate to the risks, including access control, data minimization, protection of data in transit, system updates, credential management, and providers bound by contract.
No Internet-connected system is risk-free. In the event of a personal data breach, we apply Articles 33 and 34 GDPR, with the required notifications to the authority and data subjects.
10. Data subject rights
In the cases and within the limits provided by the GDPR, you can:
- access your data and receive a copy;
- rectify or complete it;
- request its erasure;
- request restriction of processing;
- receive the data you provided in a portable format, where processing is automated and based on consent or a contract;
- object to processing based on legitimate interest, on grounds relating to your particular situation;
- object to direct marketing at any time;
- withdraw consent at any time, without affecting earlier processing.
| Right | Where to exercise it |
|---|---|
| Access and copy | Exports in the Application and your Account data, or email |
| Rectification | Account settings, or email |
| Erasure | By deleting conversations, datasets, the Account, or the organization, or by email |
| Objection, restriction, and portability | |
| Complaint | Italian Data Protection Authority or another supervisory authority (see below) |
In the Service, you can also revoke sessions and connected applications. For everything else, or if you prefer, write to team@annota.ai. We may ask you for information to verify your identity. Contact form
We respond without undue delay and normally within one month. For complex or numerous requests, the deadline may be extended by two months, and we will tell you within the first month. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests in the cases permitted by law.
You can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the country where you live or work or where you believe the infringement occurred.
Rights relating to the data of a deceased person may be exercised by anyone who has their own interest, acts to protect the data subject as their agent, or acts for family reasons deserving protection, unless the data subject prohibited it (Article 2-terdecies of Legislative Decree 196/2003).
11. Profiling and automated decisions
Annota AI does not profile individuals for advertising purposes and does not make decisions based solely on automated processing that produce legal or similarly significant effects (Article 22 GDPR). Output from AI features must be reviewed by the user and is not meant to make such decisions about individuals on its own.
12. Third-party data, minors, and sensitive data
Anyone who gives us another person’s data must be authorized to do so and must inform that person. Where we receive data other than directly from the data subject, we comply with the obligations under Article 14 GDPR where applicable.
The website and services are intended for adults and organizations, not for anyone under 18. If we discover minors’ data collected without a valid basis, we delete it or take the other measures required by law.
For special categories of data in public forms, see section 5. Special categories of data, data relating to criminal convictions and offenses, or other high-risk content must not be uploaded to the platform until the DPA and the Plan expressly authorize it and appropriate safeguards have been agreed.
13. Data processed on behalf of customers
Where a customer uses the platform to process personal data for its own purposes, the customer is normally the controller, and Annota AI is the processor and follows the customer’s documented instructions. If the customer is itself a processor for another controller, it must be authorized to appoint Annota AI as a subprocessor.
The customer decides which content to upload and must have a valid legal basis, inform data subjects, and comply with the Terms. Before uploading third-party personal data, the customer must accept the Data Processing Agreement (Article 28 GDPR), which governs instructions, confidentiality, security, subprocessors, assistance, incidents, audits, transfers, and deletion and return of data.
Data subjects must direct requests about customer data to the customer directly; Annota AI assists the customer as provided.
Annota AI does not use customer content, Brain conversations, knowledge bases, or Output to train or improve its own or third-party AI models. A model is trained only at the customer’s request, with the customer’s data, and for the customer’s own model.
14. Updates to this notice
We may update this notice to reflect regulatory, organizational, or technical changes, in particular before introducing new processing, data categories, or providers. The current version is published on this page with the date of the latest update.
We communicate material changes through proportionate means, for example on the website or by email if we have your contact details. If new processing requires consent, we request it before it begins; continued browsing does not count as consent.
In the event of any conflict with a translation, the Italian text prevails.