# Privacy & data handling
What Annot8 stores, what it deliberately never collects, your consent obligations, and how to get data out or delete it.
Source: https://docs.annot8.app/docs/security/privacy
This page describes how the product behaves. It is not legal advice, and it
does not replace the [privacy policy](https://www.annot8.app/privacy), the
[DPA](https://www.annot8.app/dpa), or the [subprocessor
list](https://www.annot8.app/subprocessors).
## Two independent systems [#two-independent-systems]
Feedback and Analytics are separate, and it matters:
| | Feedback | Analytics |
| ------------------- | ------------------------------------------------------------------------ | ------------------------------------------------ |
| On by default | Yes, once installed | **No** |
| Consent and notices | Deliberate submission; applicable notices and permissions still required | Prior permission through the host consent signal |
| Collects | What the reviewer submits, plus page and device context | Pageviews, sessions, sources, devices, events |
| Identifier | The reviewer's name, or their account | A random per-browser id |
Core feedback collection does not require Analytics, and turning Analytics off
takes nothing away from feedback.
A deliberate submission is not blanket consent for everything visible in a
screenshot or recording. Site operators must determine the lawful basis and
provide applicable notices and permissions, including for other people's data,
workplace monitoring, children, and confidential communications. Do not submit
PHI to Annot8's current service. Browser permission to use a microphone or share
a screen does not establish that everyone recorded agreed to it.
## Consent [#consent]
Analytics only runs when **both** are true:
1. An admin enabled Analytics in **Project → Settings → Features**.
2. The page passed `data-analytics-consent="true"` (or called `init` with
`analyticsConsent: true`).
Don't hard-code that attribute for visitors in the EEA or the UK. Wire it to
your consent-management platform. If your site is directed at children, take
legal advice about the additional consent requirements before installing the
widget at all.
Describing Annot8 in your own privacy and cookie notices is your responsibility
as the site operator — you're the controller for the data your visitors submit.
Even with consent passed, the widget never starts Analytics in a browser that
sends a [Global Privacy Control](https://globalprivacycontrol.org) signal or
Do Not Track (`DNT=1`), or in headless and automated browsers. Blocked Analytics
does not create measurement identifiers and removes the optional identifiers
for that project.
To withdraw consent, re-initialise with `analyticsConsent: false`. Once the
project configuration loads, the widget removes the host-page Analytics keys.
Your consent handler should also clear them if the widget cannot load. These
keys are each suffixed with the project id: `ca_visitor_id:`
(`localStorage`), and `ca_session_id:`, `ca_session_start:`,
and `ca_session_activity:` (`sessionStorage`). Withdrawal stops
future collection; deleting previously delivered server records requires the
project deletion controls or a rights request.
## Browser storage [#browser-storage]
Annot8 sets no cookies on your site. It uses `localStorage` and
`sessionStorage`:
| Where | Keys | Why |
| ------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Your site | `ca_visitor_id:`, `ca_session_*:` | Analytics, only once enabled and consented |
| Your site | `annot8-widget-position` | Where the visitor dragged the launcher |
| The widget frame (served from Annot8) | `a8_visitor_id:`, `a8_visitor_contact:` | Reconnect a visitor to their live chat; their name and email, if given |
| The widget frame | `annot8-theme-override`, `annot8-pins-hidden:`, `annot8-emoji-recent` | Display preferences |
| The portal | `annot8:voter`, `annot8:portal-identity`, `annot8:portal-following` | One vote per post, the name and email they entered, and what they follow |
Everything visitor-specific in the widget is scoped per project, so a name or
email typed on one site is never offered to another. The full list, with
durations, is in the [Cookie & Storage Notice](https://www.annot8.app/cookies).
## Emails to your visitors [#emails-to-your-visitors]
Two features email visitors on your behalf, and only when the visitor gave an
email address:
* **[Portal followers](/docs/feedback/portal#followers-and-email-updates)** get
status changes, official replies, and changelog updates for posts they follow.
* **[Live chat email follow-ups](/docs/chat/overview#email-follow-ups)** send a
team reply the visitor hasn't read yet. They're on by default; switch them off
in **Live chat → Settings**.
Every one of these emails has an unsubscribe link and one-click unsubscribe
headers. Describe them in your privacy notice like any other email you send.
## What's minimised or excluded by default [#whats-minimised-or-excluded-by-default]
* **URLs are stripped** of query strings, hash fragments, and any embedded
credentials before storage — those routinely carry tokens and personal data.
Analytics also redacts email addresses and token-shaped path segments.
* **No IP addresses in Analytics.** Country is a two-letter code from the
hosting edge; the IP address itself isn't stored for Analytics.
* **Form fields are masked** in screenshots: every `input`, `textarea`,
`select`, content-editable region, `iframe`, `video`, and anything marked
`[data-private]`.
* **Your app's storage is not read.** The storage snapshot is filtered to
Annot8's own keys and records key *names* only.
* **No keystroke capture and no session replay.**
* **No microphone during a screen recording.** A voice note is always a separate,
deliberate action.
Add your own redactions with `data-annot8-redact`, `data-annot8-ignore`, or
`window.annot8RedactSelectors` — see
[Widget configuration](/docs/widget/configuration#keeping-sensitive-content-out-of-screenshots).
Screen recording is a browser-level capture and cannot be redacted
automatically. Test your exclusions on every browser and page state you
support.
## Visitor-facing AI is off unless you opt in [#visitor-facing-ai-is-off-unless-you-opt-in]
AI that talks to your visitors — live chat auto-replies and transcription of
visitor-submitted media — is fail-closed. It requires the project's **audience**
to be **Business users aged 18+** *and* visitor AI to be enabled on the
deployment. Team-facing AI is unaffected. See
[AI features](/docs/ai/overview#visitor-facing-ai-is-gated).
## Retention [#retention]
| Data | Retained |
| ----------------------------- | ------------------------------------------------------------------------------------------------- |
| Feedback threads | Visible for your plan's window — 14 days on Free, 90 on Pro, unlimited on Business and Enterprise |
| Analytics events and sessions | Deleted automatically after 13 months |
| Integration credentials | Until you disconnect the integration |
Plan history limits control **visibility**, not deletion — threads outside the
window stop appearing and reappear if you upgrade. Deletion controls are separate.
Analytics cleanup runs in bounded batches for records older than 13 months;
13 months is the cleanup threshold, not a guaranteed maximum deletion time.
Backups, provider records, legal holds, and independent billing records require
their own retention and deletion handling.
## Getting your data out [#getting-your-data-out]
| Want | Do |
| ------------------- | ------------------------------------------------------------------------------------------------------------ |
| A project's threads | **Export CSV** from the project inbox |
| A continuous feed | An [outbound webhook](/docs/integrations/webhooks) |
| Your personal data | **Account & privacy → Download your data** — a JSON export including temporary download links for your files |
## Deleting data [#deleting-data]
| Delete | Where | Effect |
| ------------------ | ------------------------------ | ----------------------------------------------------------------------------------- |
| A thread | The inbox | Removes that thread |
| All Analytics data | **Analytics → Privacy & data** | Erases every event, session, and aggregate for the project; funnel definitions stay |
| A project | **Settings → Danger zone** | Removes the project and its feedback, permanently |
| Your account | **Account & privacy** | Closes your account |
| A workspace | **Account & privacy** | Owner only |
Project and account deletion are not reversible.
## Subprocessors [#subprocessors]
Annot8 relies on Clerk (authentication), Convex (database, functions, file
storage), Vercel (hosting and AI Gateway), OpenAI (AI through Gateway), Resend
(email), Sentry (error monitoring when configured), and Polar (merchant of record).
Optional site analytics providers are disclosed separately from customer widget
analytics. The current list, with locations and
vendor terms, is at
[www.annot8.app/subprocessors](https://www.annot8.app/subprocessors).
Integrations you connect — Slack, Jira, a webhook endpoint — receive data under
*your* instructions. Depending on the arrangement, they may be your processor or
an independent controller. Document the destination contracts, permissions,
notices and deletion handling. Choosing a destination does not remove Annot8's
duties for its own subprocessors.
## Requests and contacts [#requests-and-contacts]
| For | Email |
| --------------------------------- | ------------------------------------------------- |
| Privacy and data subject requests | [privacy@annot8.app](mailto:privacy@annot8.app) |
| Security reports | [security@annot8.app](mailto:security@annot8.app) |
| Contracts, DPAs, security review | [sales@annot8.app](mailto:sales@annot8.app) |