Where is my data?
Core infrastructure in the EU.
Content, databases, storage, and authentication are hosted in the European Union. Some supporting services also operate internationally.
Privacy & Security
Your data. Clear answers.
Where your data is stored, who can access it, and how it is used, so you can make an informed choice about Annota AI.
Overview
The short answers.
How is my data used?
To provide and protect the service.
We process your data to provide and protect the service, offer support, and meet legal obligations, following your instructions and the applicable agreements. We do not use it for advertising or profiling.
Can I control access?
Permissions, sessions, and connected apps.
Permissions govern access to your organization. From your Account, you can revoke sessions and authorizations granted to applications.
Data use
Your content stays yours.
You retain ownership of your content. Annota AI processes it only as needed to provide, protect, support, and maintain the service. For personal data entrusted by your organization, we follow documented instructions and the applicable DPA.
We don't train models on your data.
Your content, Brain conversations, and knowledge bases are not used to train or improve Annota AI's or third parties' models. Training happens only when you start it, on your data, for your own model.
Each organization has separate access controls. Enterprise plans can include dedicated infrastructure or on-premise deployment, including air-gapped environments.
Infrastructure
Where your data goes.
The cloud service's AI models, database, storage, and authentication run on Scaleway infrastructure in France (EU). AI features do not use other AI providers' APIs.
This does not mean every processing activity takes place only in the EU. Cloudflare's network, Google Workspace for support, and some sign-in and payment providers may process data internationally, under the safeguards described in the privacy notice.
Details on providers and transfers- Scaleway
- Core infrastructure in France (EU): compute, databases, and storage.
- Cloudflare
- DNS, network, and traffic protection for the website and platform, including requests and files in transit.
- Stripe
- Payments, tax calculation, billing, and fraud prevention.
- Mailjet
- Sign-in codes, invitations, notifications, in-app support requests, and website forms.
- Google / GitHub
- Account sign-in or linking, only when you choose these methods.
- Google Workspace
- Support mailbox and correspondence, including attachments you send.
Controls
Controls available today.
Sign-in and authorizations
Sign in with an email code, a passkey, Google, or GitHub. Manage linked methods and revoke sessions and apps, including MCP clients. Sensitive changes require a recent sign-in.
Versions and traceability
Annotations preserve their origin. Dataset versions are immutable and retain reviewed data, while training history links each model to its source data and metrics.
Organization SSO and audit logs that admins can review are coming soon for eligible plans.
Portability
Export your data and switch provider.
You can take your data with you at any time, with no exit charges.
What you can export
Each type of data has its own export path.
- Images and annotations
COCO export of the current dataset or a saved version, with images, bounding boxes, and polygons.
- Documents
Original files can be downloaded; OCR text and figures export as Markdown ZIP or LLM Wiki.
- Models
Download of completed trained models.
- Brain conversations
All your conversations in an organization as JSON from the Account dialog, or a single chat as Markdown from the history.
- Account data
On request, by writing to team@annota.ai.
Switching or deletion
The organization owner writes to team@annota.ai, with at most 2 months' notice. A 30-day transition period follows, then at least 30 more days to retrieve your data, then deletion. Switching is free of charge.
What is not exportable
Search indexes, embeddings, and summaries, which can be recomputed from your documents; internal service configuration; security and billing data.
Compliance
Our compliance program.
Privacy by design
Access controls, data minimization, and transparency about processing guide the platform's design. The privacy notice describes roles, purposes, and rights under the GDPR.
Annota AI provides AI systems, not general-purpose AI models, and none of its systems is high-risk under the AI Act. Whoever trains a model with Annota Studio and places it on the market or puts it into service becomes its provider. Data quality, documentation, and traceability features support AI Act workflows; specific obligations depend on the customer's role and use case.
Audits and certifications
These programs are in progress and are not yet complete.
- SOC 2In progress
- ISO 27001In progress
- ISO 42001In progress
Frequently asked questions
Who can access my data?
Access within your organization follows assigned permissions. Authorized Annota AI staff and collaborators access data only as needed for their duties. Providers process the data needed to deliver their services, under the roles and agreements described in the privacy notice.
Read the details in the privacy noticeWhat happens if I delete my account?
Access is disabled, you are removed from organizations you do not own, and your Brain conversations are deleted. Organizations you own are suspended, their subscription is canceled immediately without refund of the remaining period, open invitations are revoked, and they are deleted after 30 days: transfer ownership or export data first. Identifying profile data is normally deleted or anonymized 30 days after closure, once you no longer belong to any organization; pseudonymous identifiers and data needed for audit, security, or legal obligations may be kept longer. Backups and deletion may follow different technical timelines.
Read the details in the privacy noticeCan I delete my organization?
Yes, if you own it. You can delete it immediately or, on paid plans, at the end of the billing period. Immediate deletion cancels the subscription without refunding the remaining period. Either way, members lose access, and content and credits, including purchased ones, are deleted. Until the period ends, an admin can withdraw the request by resuming the subscription.
Read the details in the privacy noticeDo you use cookies to track me?
We do not currently use advertising, profiling, or analytics cookies, and we do not track users across websites. Technical cookies and local storage support sign-in, security, and preferences such as theme and editor settings.
Read the details in the privacy noticeCan I upload personal or health data?
When you upload third-party personal data, the DPA applies: the data processing agreement that is part of the Terms. Health data, criminal-offense data, and other high-risk content require explicit authorization in the DPA and applicable plan, with agreed safeguards. Contact us before uploading to check these conditions.
Read the details in the privacy noticeHow do I exercise my data rights?
You can write to us to request access, a copy, correction, or deletion of personal data, as provided in the privacy notice. If the data is in a dataset managed by your organization, address the request to that organization; Annota AI provides the required support.
Read the details in the privacy noticeHave a question about your use case?
Write to us to clarify privacy requirements, the DPA, or deployment options before uploading your data.