Privacy & data handling

Two independent systemsCopy Anchor Link

Feedback and Analytics are separate, and it matters:

Core feedback collection does not require Analytics, and turning Analytics off takes nothing away from feedback.

A deliberate submission is not blanket consent for everything visible in a screenshot or recording. Site operators must determine the lawful basis and provide applicable notices and permissions, including for other people's data, workplace monitoring, children, and confidential communications. Do not submit PHI to Annot8's current service. Browser permission to use a microphone or share a screen does not establish that everyone recorded agreed to it.

ConsentCopy Anchor Link

Analytics only runs when both are true:

1. An admin enabled Analytics in Project → Settings → Features.
2. The page passed data-analytics-consent="true" (or called init with analyticsConsent: true).

Describing Annot8 in your own privacy and cookie notices is your responsibility as the site operator — you're the controller for the data your visitors submit.

Even with consent passed, the widget never starts Analytics in a browser that sends a Global Privacy Control signal or Do Not Track (DNT=1), or in headless and automated browsers. Blocked Analytics does not create measurement identifiers and removes the optional identifiers for that project.

To withdraw consent, re-initialise with analyticsConsent: false. Once the project configuration loads, the widget removes the host-page Analytics keys. Your consent handler should also clear them if the widget cannot load. These keys are each suffixed with the project id: ca_visitor_id:<projectId> (localStorage), and ca_session_id:<projectId>, ca_session_start:<projectId>, and ca_session_activity:<projectId> (sessionStorage). Withdrawal stops future collection; deleting previously delivered server records requires the project deletion controls or a rights request.

Browser storageCopy Anchor Link

Annot8 sets no cookies on your site. It uses localStorage and sessionStorage:

Everything visitor-specific in the widget is scoped per project, so a name or email typed on one site is never offered to another. The full list, with durations, is in the Cookie & Storage Notice.

Emails to your visitorsCopy Anchor Link

Two features email visitors on your behalf, and only when the visitor gave an email address:

• Portal followers get status changes, official replies, and changelog updates for posts they follow.
• Live chat email follow-ups send a team reply the visitor hasn't read yet. They're on by default; switch them off in Live chat → Settings.

Every one of these emails has an unsubscribe link and one-click unsubscribe headers. Describe them in your privacy notice like any other email you send.

What's minimised or excluded by defaultCopy Anchor Link

• URLs are stripped of query strings, hash fragments, and any embedded credentials before storage — those routinely carry tokens and personal data. Analytics also redacts email addresses and token-shaped path segments.
• No IP addresses in Analytics. Country is a two-letter code from the hosting edge; the IP address itself isn't stored for Analytics.
• Form fields are masked in screenshots: every input, textarea, select, content-editable region, iframe, video, and anything marked [data-private].
• Your app's storage is not read. The storage snapshot is filtered to Annot8's own keys and records key names only.
• No keystroke capture and no session replay.
• No microphone during a screen recording. A voice note is always a separate, deliberate action.

Add your own redactions with data-annot8-redact, data-annot8-ignore, or window.annot8RedactSelectors — see Widget configuration.

Visitor-facing AI is off unless you opt inCopy Anchor Link

AI that talks to your visitors — live chat auto-replies and transcription of visitor-submitted media — is fail-closed. It requires the project's audience to be Business users aged 18+ and visitor AI to be enabled on the deployment. Team-facing AI is unaffected. See AI features.

RetentionCopy Anchor Link

Plan history limits control visibility, not deletion — threads outside the window stop appearing and reappear if you upgrade. Deletion controls are separate. Analytics cleanup runs in bounded batches for records older than 13 months; 13 months is the cleanup threshold, not a guaranteed maximum deletion time. Backups, provider records, legal holds, and independent billing records require their own retention and deletion handling.

Getting your data outCopy Anchor Link

Deleting dataCopy Anchor Link

Project and account deletion are not reversible.

SubprocessorsCopy Anchor Link

Annot8 relies on Clerk (authentication), Convex (database, functions, file storage), Vercel (hosting and AI Gateway), OpenAI (AI through Gateway), Resend (email), Sentry (error monitoring when configured), and Polar (merchant of record). Optional site analytics providers are disclosed separately from customer widget analytics. The current list, with locations and vendor terms, is at www.annot8.app/subprocessors.

Integrations you connect — Slack, Jira, a webhook endpoint — receive data under your instructions. Depending on the arrangement, they may be your processor or an independent controller. Document the destination contracts, permissions, notices and deletion handling. Choosing a destination does not remove Annot8's duties for its own subprocessors.

Requests and contactsCopy Anchor Link