← Legal

Privacy Policy

Effective date: July 1, 2026

1. Who We Are

Annex AI ("we," "us," "our") operates the compliance automation and AI governance platform at annexai.in. This Privacy Policy explains how we collect, use, store, and protect information when you use our Service.

For privacy questions, contact us at contact@annexai.in.

2. Information We Collect

Information you provide directly:

  • Account information: name, email address, organization name
  • Onboarding questionnaire responses (industry, cloud provider, security posture)
  • Integration credentials (encrypted before storage — see Section 5)
  • AI system descriptions and compliance notes you enter
  • Communications you send us

Information collected automatically:

  • Evidence data pulled from connected integrations (GitHub branch protection status, AWS encryption settings, etc.) on your behalf
  • Usage logs (pages visited, features used, timestamps)
  • IP address and browser/device information
  • Cookies and session tokens necessary for authentication

3. How We Use Your Information

  • To provide and operate the Service, including running automated compliance checks and generating policies
  • To authenticate you and maintain your session
  • To send you service-related communications (account updates, security alerts)
  • To improve the Service based on aggregate usage patterns
  • To comply with legal obligations
  • To respond to your support requests

We do not use your data to train AI models without your explicit consent. We do not sell your data to third parties. We do not serve advertising.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your personal data on the following legal bases:

  • Contract performance — processing necessary to provide the Service you signed up for
  • Legitimate interests — improving the Service, security monitoring, fraud prevention
  • Legal obligation — complying with applicable laws
  • Consent — for any processing where we specifically ask for it

5. How We Protect Integration Credentials

Integration credentials that require storage (Google Workspace service account keys, Okta API tokens) are encrypted using AES-256-GCM before being written to our database. The encryption key is stored separately from the database. Credentials that do not need long-term storage (AWS cross-account role ARNs, GitHub App installation IDs) are stored as non-sensitive identifiers only — no secret material is retained.

We access third-party systems using the minimum permissions necessary to run our compliance checks, and we never use integration access for any purpose other than the checks described in our documentation.

6. Data Sharing

We share your data only in these circumstances:

  • Service providers — infrastructure providers (Vercel for hosting, Neon for database, Anthropic for AI policy generation, Trigger.dev for scheduled tasks). Each is bound by data processing agreements.
  • Your public trust center — if you enable it, aggregate compliance posture data (percentage of controls passing, frameworks adopted) is publicly visible. No internal evidence detail is shared.
  • Legal requirements — if required by law, court order, or to protect rights and safety.
  • Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to you.

7. Data Retention

We retain your data for as long as your account is active, plus a 30-day grace period after account termination during which you can request an export. After that, we delete account data. Certain anonymized or aggregated data may be retained for longer for product improvement purposes. Audit logs are retained for 12 months.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access — request a copy of the personal data we hold about you
  • Correction — request correction of inaccurate data
  • Deletion — request deletion of your data (subject to legal retention requirements)
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing based on legitimate interests
  • Opt-out of sale — we do not sell personal data, but California residents may submit a request to confirm this

To exercise any of these rights, email contact@annexai.in. We will respond within 30 days.

9. Cookies

We use cookies solely for authentication (session tokens) and security (CSRF protection). We do not use tracking cookies, advertising cookies, or third-party analytics that track you across sites. You can disable cookies in your browser settings, but doing so will prevent you from logging in.

10. International Transfers

Our infrastructure is based in the United States. If you are located outside the US, your data is transferred to and processed in the US. For EEA users, this transfer is covered by Standard Contractual Clauses with our infrastructure providers. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The current version is always available at annexai.in/legal/privacy.