Where is my data?
Core infrastructure in the EU.
Content, databases, storage, and authentication are hosted in the European Union. Some supporting services also operate internationally.
Infrastructure and providersPrivacy & Security
Your data. Clear answers.
Where it is stored, who can access it, and how it is used. The information you need to make an informed choice about Annota AI.
The essentials
Does my data train AI?
Never used to train third-party models.
On paid plans, your content and organization data do not train our models either. On Free, we may use anonymized, aggregated usage data.
The rules for each planCan I control access?
Permissions, sessions, and connected apps.
Permissions govern access to your workspace. From your Account, you can revoke sessions and authorizations granted to applications.
Available controlsHow your data is used
On every plan, user content is not used to train third-party models.
Free
Anonymized, aggregated usage data.
We may use effectively anonymized and aggregated usage data to improve Annota AI's models.
Pro, Scale, and Enterprise
Your data does not train our models.
User content and organization data are not used to train or improve Annota AI's models. This guarantee is part of the contract.
Workspaces have separate access controls. Enterprise can include dedicated infrastructure or on-premise deployment, including air-gapped environments.
Compare plansWhere data flows
Core compute, databases, and storage run on Scaleway in EU regions. Authentication operated by Annota AI is also hosted in the EU.
This does not mean every processing activity takes place only in the EU. Cloudflare's network and some sign-in and payment providers may process data internationally, under the safeguards described in the privacy notice.
Details on providers and transfers- Scaleway
- Core infrastructure in EU regions: compute, databases, and storage.
- Cloudflare
- Website delivery and traffic protection, including requests and files in transit.
- Stripe
- Payments, billing, and fraud prevention.
- Mailjet
- Sign-in codes, invitations, notifications, and email communications.
- Google / GitHub
- Account sign-in or linking, only when you choose these methods.
Controls you can use today
Sign-in and authorizations
Sign in with an email code, a passkey, Google, or GitHub. Manage linked methods and revoke sessions and apps, including MCP clients. Sensitive changes require a recent sign-in.
Versions and traceability
Annotations preserve their origin. Immutable dataset versions retain reviewed data, while training history links models to their source data and metrics.
Organization SSO and audit logs are coming soon for eligible plans.
More privacy questions
Who can access my data?
Workspace access follows assigned permissions. Authorized Annota AI staff and collaborators access data only as needed for their duties. Providers process the data needed to deliver their services, under the roles and agreements described in the privacy notice.
Read the details in the privacy noticeWhat happens if I delete my Account?
Access is disabled. Identifying profile data is normally deleted or anonymized within 30 days once you no longer belong to any organization, subject to legal or security needs. Dataset content follows the customer's choices, the Terms, and any applicable DPA; backups and deletion may follow different technical timelines.
Read the details in the privacy noticeDo you use cookies to track me?
We do not currently use advertising, profiling, or analytics cookies, and we do not track users across websites. Technical cookies and local storage support sign-in, security, and preferences such as language and theme.
Read the details in the privacy noticeCan I upload personal or health data?
Before uploading third-party personal data, you must sign or accept a DPA, the data processing agreement. Health data, criminal-offence data, and other high-risk content require explicit authorization in the DPA and applicable plan, with agreed safeguards. Contact us before uploading to check these conditions.
Read the details in the privacy noticeHow do I exercise my data rights?
You can write to us to request access, a copy, correction, or deletion of personal data, as provided in the privacy notice. If the data is in a dataset managed by your organization, address the request to that organization; Annota AI provides the required support.
Read the details in the privacy noticeOur compliance program
Privacy in the design
Access controls, data minimization, and transparency about processing guide the platform's design. The privacy notice describes roles, purposes, and rights under the GDPR.
Data quality, documentation, and traceability features support AI Act workflows. Specific obligations depend on the customer's role and use case.
Audits and certifications
These programs are in progress and are not yet complete.
- SOC 2In progress
- ISO 27001In progress
- ISO 42001In progress
Have a question about your use case?
Write to us to clarify privacy requirements, the DPA, or deployment options before uploading your data.