Privacy & data handling
What Annot8 stores, what it deliberately never collects, your consent obligations, and how to get data out or delete it.
This page describes how the product behaves. It is not legal advice, and it does not replace the privacy policy, the DPA, or the subprocessor list.
Two independent systems
Feedback and Analytics are separate, and it matters:
| Feedback | Analytics | |
|---|---|---|
| On by default | Yes, once installed | No |
| Needs visitor consent | No — it's a deliberate submission | Yes |
| Collects | What the reviewer submits, plus page and device context | Pageviews, sessions, sources, devices, events |
| Identifier | The reviewer's name, or their account | A random per-browser id |
Core feedback collection does not require Analytics, and turning Analytics off takes nothing away from feedback.
Consent
Analytics only runs when both are true:
- An admin enabled Analytics in Project → Settings → Features.
- The page passed
data-analytics-consent="true"(or calledinitwithanalyticsConsent: true).
Don't hard-code that attribute for visitors in the EEA or the UK. Wire it to your consent-management platform. If your site is directed at children, take legal advice about the additional consent requirements before installing the widget at all.
Describing Annot8 in your own privacy and cookie notices is your responsibility as the site operator — you're the controller for the data your visitors submit.
To withdraw consent, re-initialise with analyticsConsent: false and clear the
host-page keys ca_visitor_id, ca_session_id, and ca_session_start.
What's minimised or excluded by default
- URLs are stripped of query strings, hash fragments, and any embedded credentials before storage — those routinely carry tokens and personal data.
- Form fields are masked in screenshots: every
input,textarea,select, content-editable region,iframe,video, and anything marked[data-private]. - Your app's storage is not read. The storage snapshot is filtered to Annot8's own keys and records key names only.
- No keystroke capture and no session replay.
- No microphone during a screen recording. A voice note is always a separate, deliberate action.
Add your own redactions with data-annot8-redact, data-annot8-ignore, or
window.annot8RedactSelectors — see
Widget configuration.
Screen recording is a browser-level capture and cannot be redacted automatically. Test your exclusions on every browser and page state you support.
Visitor-facing AI is off unless you opt in
AI that talks to your visitors — live chat auto-replies and transcription of visitor-submitted media — is fail-closed. It requires the project's audience to be Business users aged 18+ and visitor AI to be enabled on the deployment. Team-facing AI is unaffected. See AI features.
Retention
| Data | Retained |
|---|---|
| Feedback threads | Visible for your plan's window — 14 days on Free, 90 on Pro, unlimited on Business and Enterprise |
| Analytics events and sessions | Deleted automatically after 13 months |
| Integration credentials | Until you disconnect the integration |
Plan retention controls visibility, not deletion — threads outside the window stop appearing and reappear if you upgrade. To remove data permanently, delete the thread, the project, or the account.
Getting your data out
| Want | Do |
|---|---|
| A project's threads | Export CSV from the project inbox |
| A continuous feed | An outbound webhook |
| Your personal data | Account & privacy → Download your data — a JSON export including temporary download links for your files |
Deleting data
| Delete | Where | Effect |
|---|---|---|
| A thread | The inbox | Removes that thread |
| A project | Settings → Danger zone | Removes the project and its feedback, permanently |
| Your account | Account & privacy | Closes your account |
| A workspace | Account & privacy | Owner only |
Project and account deletion are not reversible.
Subprocessors
Annot8 relies on Clerk (authentication), Convex (database, functions, file storage), Vercel (hosting and AI Gateway), OpenAI (AI through Gateway), Resend (email), and Polar (merchant of record). The current list, with locations and vendor terms, is at annot8.app/subprocessors.
Integrations you connect — Slack, Jira, a webhook endpoint — receive data under your instructions. They're your processors, not Annot8's, which means the destination contracts, permissions, notices, and deletion requests are yours to manage.
Requests and contacts
| For | |
|---|---|
| Privacy and data subject requests | privacy@annot8.app |
| Security reports | security@annot8.app |
| Contracts, DPAs, security review | sales@annot8.app |