--- title: "Privacy policy | Annsa" product: annsa url: /privacy canonical_url: "https://annsa.ai/privacy" last_updated: 2026-11-08 type: company summary: Annsa privacy policy. How we collect, store, and protect your data. Encrypted at rest and in transit. No customer data used for AI training. mcp_server: https://app.annsa.ai/mcp disambiguation: "Annsa (annsa.ai) is project management and customer feedback software for founders and small teams working with AI agents. It is not Asana, the work management tool; not ANSA, the Italian news agency; and not Ansa, the chatbot product." --- > For agents: connect to the Annsa MCP server at https://app.annsa.ai/mcp to give every agent one shared plan. Setup guide: https://annsa.ai/docs/quick-start. Index of every page: https://annsa.ai/llms.txt. # Privacy policy | Annsa > Annsa privacy policy. How we collect, store, and protect your data. Encrypted at rest and in transit. No customer data used for AI training. Last Updated: November 2, 2026 **Data Controller:** Circuit Software Pty Ltd, Sydney, NSW, Australia **Contact:** privacy@annsa.ai Circuit Software Pty Ltd ("Annsa," "we," "our," or "us") operates Annsa at annsa.ai. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our services. Annsa is project management and customer feedback software for founders and small teams working with AI agents. We are committed to protecting your privacy and handling your data transparently. --- ## 1. Information We Collect ### 1.1 Account Information - Email address, name and profile picture (from Google sign-in) - Company or organization name (optional) - Billing information (processed securely by Stripe; we never see or store credit card details) ### 1.2 Customer Feedback Data When you upload or connect feedback sources, we may collect: - Feedback text and associated metadata - Customer identifiers (names, emails, or IDs if included in your data) - Source information (CSV upload, feedback widget, Slack, Google Sheets, API, manual entry) - Timestamps and categorization data - Star ratings and page URLs submitted via the feedback widget - Screenshots attached to widget feedback (may contain visible on-screen content) - Transcript recordings and structured notes uploaded for analysis - Revenue band or customer tier if included in your data ### 1.3 Usage and Technical Data - IP addresses and approximate location (country/region level) - Browser type, operating system, and device information - Pages visited, features used, and interaction patterns - Date and time of access ### 1.4 Integration Data When you connect third-party services, we access: - **Slack:** Messages from channels you select for feedback collection - **GitHub:** Repository name, structure, and context (to improve spec file paths) - **Google Sheets:** Spreadsheet content you choose to import as feedback OAuth tokens for integrations are encrypted at the application layer. ### 1.5 AI Assistant Data When you use Ask Annsa, we store your questions, AI-generated answers, referenced help articles, and your feedback on answer quality. --- ## 2. How We Use Your Information Purpose Description Legal Basis Provide the Service Operating Annsa, processing feedback, generating specs Contract AI Processing Classifying feedback and generating specifications using AI Contract Behavioral Learning Learning from your actions to improve prioritization and spec quality Legitimate Interest Service Communications Account notifications, security alerts, product updates Legitimate Interest Service Improvement Analyzing usage patterns to improve Annsa Legitimate Interest Security & Fraud Prevention Protecting against malicious activity Legitimate Interest Analytics Understanding how users interact with Annsa Consent --- ## 3. AI Processing and Automated Decision-Making ### 3.1 What AI Does - **Classification:** Automatically categorizes feedback by type, sentiment and topic - **Prioritization:** Scores feedback based on volume, revenue impact, urgency and other factors - **Spec Generation:** Creates build specifications from prioritized feedback - **Pattern Recognition:** Identifies trends and patterns in your feedback data - **Behavioral Learning:** Learns from your actions (such as which specs you ship or correct) to improve future prioritization and spec quality - **Competitive Signals:** Identifies competitor mentions in your feedback to surface switching risks and feature gaps - **AI Assistant:** Answers your questions using a knowledge base and your workspace data ### 3.2 Privacy Protections - **PII Stripping:** Before customer feedback is classified or searched, email addresses, phone numbers, government ID and card numbers, API keys and customer names are removed. When Ask answers a question or a spec is written, those sensitive details are still removed, but customer names are kept so a quote stays exact - **No Model Training:** Your data is NOT used to train third-party AI models. We use API services that do not train on customer data by default - **Data Minimization:** Only the minimum necessary data is sent for processing ### 3.3 AI Providers - **Anthropic Claude API:** Ask's answers, spec drafts you ask for, theme names and classification - **OpenAI API:** Text embeddings, and a fallback when Claude is unavailable - **Jev by TypeSafe:** Judgments: which priority feedback belongs to, whether two items are the same problem, and whether shipped work meets its Done When All providers confirm that API data is not used for model training under their commercial API terms. ### 3.4 Automated Decisions About Your Account A few decisions about your account are made automatically, without a person reviewing them: - **Data deletion after a subscription ends:** If a paid subscription ends, including when it is canceled after failed payments, your workspace data is scheduled for deletion 30 days later (see section 6.1). Downgrading to the free plan keeps your data - **Free trial eligibility:** When an account is deleted, we keep a one-way hash of its email address. If the same email signs up again, it does not get a second free trial These decisions use your account details, billing status and email address. To ask about or challenge any of them, contact privacy@annsa.ai and a person will review it. --- ## 4. Data Sharing and Sub-processors Category Providers Purpose Cloud Infrastructure AWS, Supabase, Vercel, CloudFront Hosting, database, CDN AI Processing Anthropic, OpenAI, TypeSafe (Jev) Classification, embeddings, judgments, Ask and spec drafts you ask for (anonymized) Caching Redis Performance caching Payment Processing Stripe Subscription and billing Email Resend Transactional and status notifications Error Monitoring Sentry Application reliability (PII redacted) Analytics Google Analytics Usage patterns (with consent only) **We do not sell your personal data to third parties.** --- ## 5. International Data Transfers Annsa is operated from Australia. Your data may be transferred to and processed in countries outside your jurisdiction, including: - **Singapore:** Where our main database is hosted - **Australia:** Where Annsa is headquartered and our application servers run - **United States:** Where our AI providers and some cloud services are located For transfers outside of the EEA or UK, we rely on Standard Contractual Clauses and Data Processing Agreements with all sub-processors. --- ## 6. Data Retention Data Type Retention Period After Cancellation Account Information Duration of account Deleted after 30 days Feedback Data Duration of account Deleted after 30 days Generated Specs Duration of account Deleted after 30 days Behavioral Memory 90 days, then compressed to quarterly summaries Deleted after 30 days AI Assistant Conversations Duration of account Deleted after 30 days Widget Screenshots Duration of account Deleted after 30 days Usage Analytics 24 months Anonymized or deleted Payment Records As required by law (typically 7 years) Retained by Stripe per legal requirements System Backups 90 days rolling Purged within 90 days ### 6.1 Subscription Cancellation When you cancel, your data is retained for **30 days** to allow resubscription. After 30 days, all data is permanently deleted. Request immediate deletion at privacy@annsa.ai or via Settings → Delete Workspace. --- ## 7. Data Security - **Encryption in Transit:** TLS 1.3 - **Encryption at Rest:** AES-256; integration tokens encrypted with Fernet (AES-128-CBC) - **Access Controls:** All queries scoped to the authenticated user at application and database layers - **Authentication:** OAuth 2.0 with optional MFA/2FA - **Infrastructure:** AWS App Runner (hosting) - **Monitoring:** Sentry with PII automatically redacted --- ## 8. Your Rights ### 8.1 All Users - **Access:** Settings → Account → Export Data - **Deletion:** Settings → Account → Delete Workspace - **Correction:** Update inaccurate information - **Withdraw Consent:** Opt out of analytics cookies via cookie settings ### 8.2 EU/UK GDPR Portability, restriction, objection to legitimate interest processing, and human review of automated decisions. ### 8.3 Australia (Privacy Act 1988) Access, correction, complaints to the OAIC, and information about automated decision-making. ### 8.4 California (CCPA/CPRA) Know, delete, opt-out (we do not sell data), and non-discrimination. Contact **privacy@annsa.ai**. We respond within 30 days. --- ## 9. Cookies and Tracking ### 9.1 Essential (Always Active) Authentication, security, user preferences. ### 9.2 Analytics (With Consent) Google Analytics: usage patterns, feature adoption. Sessions linked across annsa.ai and app.annsa.ai. --- ## 10. Data Breach Notification We will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay if there is high risk. Australian users: OAIC notified per the Notifiable Data Breaches scheme. --- ## 11. Children's Privacy Annsa is a B2B service not intended for under-18s. Contact privacy@annsa.ai to report any such data. --- ## 12. Changes to This Policy Material changes notified by updated "Last Updated" date, email, and in-app notification. --- ## 13. Contact Us **Email:** privacy@annsa.ai **Address:** Annsa, Sydney, NSW, Australia **Website:** https://annsa.ai Supervisory authorities: - **Australia:** OAIC (oaic.gov.au) - **EU:** Your local Data Protection Authority - **UK:** ICO (ico.org.uk) --- ## 14. Data Processing Agreement Enterprise customers requiring a DPA for GDPR compliance: contact **privacy@annsa.ai**. If anything on this page is wrong or missing, tell us: https://annsa.ai/contact