Privacy Policy

Quad Labs Technologies LLC, 1021 E Lincolnway, 10208, Cheyenne, WY 82001, United States operates the Service under the Annot8 name and is the controller for the independent purposes described below. Quad Labs publishes its company information at quadlabs.io. Contact privacy@annot8.app for privacy matters and legal@annot8.app for formal notices.

This Privacy Policy explains how Quad Labs Technologies LLC (operating as "Annot8," "we," "us," or "our") handles personal data through annot8.app, our dashboard, documentation, public feedback pages, and related services (the "Service").

Annot8 is the controller of account, website, support, security, and billing-related personal data. When an Annot8 customer installs our widget or uses the Service to collect feedback, forms, analytics, recordings, or live-chat messages from its own visitors, that customer normally determines why the data is processed and acts as controller; Annot8 acts as its processor or service provider. Those visitors should also read the customer's privacy notice and direct requests about customer-controlled data to that customer.

This policy does not replace a customer's privacy notice and does not govern a third party's own use of data. A customer can make a feedback board, post, comment, name, or attachment public; other people may view, copy, or index that content. Review the customer's notice and the visibility of the destination before submitting. Workspace administrators control membership and may access content in their workspace.

2.1Account and workspace data

2.2Customer content and visitor data

2.3Consent-gated Analytics

2.4Technical and source data

• Contract: where needed to perform a contract with the individual, create and secure accounts; provide workspaces, feedback, chat, recording, AI, integrations, support, billing, and data export/deletion features; and communicate service notices.
• Legitimate interests: prevent fraud and abuse, maintain reliability, diagnose faults, improve product usability, support customers, and establish or defend legal claims, balanced against individual rights. Business-contact administration for a customer’s employees may use this basis rather than a contract with each employee.
• Consent: run non-essential analytics or storage technologies, send optional marketing, or process information where consent is the required basis. Consent can be withdrawn without affecting earlier lawful processing.
• Legal obligations: retain tax and transaction records, respond to lawful requests, protect rights and safety, and comply with data protection, consumer, and accounting requirements.
• Customer instructions: process customer-controlled widget, feedback, chat, analytics, and integration data under our agreement with the customer.

We do not sell personal data or share it for cross-context behavioral advertising. We disclose data only as needed to provide the Service, follow customer instructions, or meet legal obligations, including:

• Authorized members and administrators of the relevant workspace
• Clerk (identity and authentication), Convex (database, functions, and storage), Vercel (hosting, delivery, AI Gateway, Workflow, and Sandbox), Polar (merchant of record and billing), Resend (transactional email), OpenAI (AI processing through Vercel AI Gateway), and—only after Analytics consent and when configured—Google Analytics and PostHog (acquisition and product measurement)
• Customer-selected integrations, which may include Slack, Linear, Jira, Asana, Discord, Microsoft Teams, Trello, GitHub, GitLab, email recipients, or customer-provided webhooks
• Sentry, for application error monitoring when configured. Application filtering excludes request bodies, headers, user profiles, custom context and breadcrumbs, and disables performance tracing; the provider still receives network metadata needed to receive error reports.
• Lark, for support and legal email correspondence, attachments, and related delivery/security metadata. Avoid sending sensitive customer content in an initial email; contact us for the account's applicable receiving entity, processing locations and retention schedule.
• Professional advisers, auditors, insurers, authorities, courts, or counterparties where reasonably necessary and legally permitted
• A buyer, investor, or successor in a merger, financing, reorganization, or asset transfer, subject to appropriate confidentiality and notice where required

Providers may use subprocessors under their own published terms. See the maintained Subprocessors list and request an execution copy of the Data Processing Addendum at privacy@annot8.app.

When an AI feature is used, relevant prompts, comments, screenshots, recordings, or chat context are routed through Vercel AI Gateway to OpenAI to generate classifications, summaries, transcripts, suggestions, replies, or proposed code fixes. Semantic search and related-feedback features may produce and store embeddings (numeric representations of content), which are also handled as customer data. Repository-connected agents may process selected repository files, issue context, tool results, and proposed changes using Vercel Workflow and Sandbox. AI output can be inaccurate and should be reviewed by a person before it is relied on. Annot8 discloses possible AI chat replies before a visitor sends a message and labels AI replies and transcripts. We do not use customer content to train our own general-purpose model; Gateway routing restricts providers to OpenAI and disallows prompt-training routes. This setting does not itself guarantee zero provider retention. Provider retention and restricted-transfer requirements must be checked for the enabled workload. Annot8 is not designed to make decisions with legal or similarly significant effects about people solely by automated means.

• Account and workspace records are kept while the relevant account or customer relationship is active and are deleted or anonymized when the account/workspace is deleted, subject to the exceptions below.
• Shared workspace content may remain under the workspace customer's control after an individual member deletes an account; the member's account identity is anonymized in those shared records.
• Consent-based customer Analytics events and sessions become eligible for deletion after 395 days. An hourly job deletes bounded batches; failures or backlogs can delay completion. Feedback history limits on a plan affect visibility, not automatic deletion of that feedback.
• Origin-validation widget session tokens expire after two hours and expired records are routinely removed.
• Billing, tax, fraud-prevention, security, dispute, and legal records are retained for the period required or permitted by applicable law and then deleted or anonymized.
• Deletion from live application records does not instantly erase provider backups, logs, independently controlled billing records, or copies sent to customer-selected destinations. Their applicable schedules and legal duties govern those copies; contact privacy@annot8.app for the schedule relevant to your processing. We may retain de-identified statistics that can no longer reasonably identify a person.

Annot8 and our providers may process data outside a person's country, including in the United States. Where a transfer is restricted, the responsible parties must establish the required safeguards before it occurs, such as an applicable adequacy decision or executed contractual safeguards and supplementary measures. The actual recipient, location, mechanism and applicable rights must be documented for the processing involved; this notice alone does not establish those safeguards. Contact privacy@annot8.app for the relevant transfer documentation before enabling a use case that requires it.

We use safeguards appropriate to the Service, including encryption in transit, managed authentication, role- and workspace-based access checks, domain allowlists, short-lived origin-validated widget sessions, restricted webhook verification, dependency monitoring, and data minimization. No system is completely secure. Customers are responsible for configuring workspace roles, allowed domains, integrations, and consent controls appropriately and for keeping credentials confidential. Report a suspected vulnerability or incident to security@annot8.app.

We use cookies and browser storage for authentication, security, preferences, widget operation, live chat, and—only after the required signal—Analytics. Details, purposes, durations, and control instructions are in our Cookie & Storage Notice.

Depending on location and context, a person may have rights to know or access personal data, correct it, delete it, restrict or object to processing, receive portable data, withdraw consent, opt out of certain uses, appeal a denied request, and not be discriminated against for exercising a right. EEA and UK residents may complain to their local supervisory authority. California and other eligible US residents may use an authorized agent where the law permits.

Signed-in users can download account data or delete their account from Account & privacy. Requests can also be sent to privacy@annot8.app. We may verify identity and authority before acting. For data submitted to a customer's widget or workspace, contact that customer first; we will assist the customer as its processor. Appeals may be sent to the same address with the subject “Privacy appeal.”

Send requests to privacy@annot8.app, including the relevant account or customer website and the right you wish to exercise. An Annot8 account is not required to send a request. Do not include passwords, unredacted identity documents, or sensitive customer content in the initial email. We request only verification information proportionate to the request and explain if an exception, another controller, or other people's rights limit the response. Statutory response periods apply; if a lawful extension is needed we explain the reason and applicable timing.

• EEA, United Kingdom and Switzerland: subject to applicable conditions, request access, correction, erasure, restriction, portability, or object to processing. Where legitimate interests are used you may object based on your circumstances; objection to direct marketing can be made at any time. Request information about safeguards for a restricted international transfer. Consent may be withdrawn at any time. You may complain to the relevant supervisory authority.
• United States: eligible residents may request access or confirmation, correction, deletion and a portable copy, and exercise applicable rights concerning sale, targeted advertising, sensitive data and certain profiling. We do not sell personal data or share it for cross-context behavioral advertising. We honor GPC by disabling optional analytics; on our own site and in the widget we also disable it for DNT=1. Applicable authorized-agent and appeal rights are available through privacy@annot8.app. We do not penalize people for exercising their rights.
• Brazil: where the LGPD applies, requests may include confirmation and access, correction, information about sharing, portability where applicable, anonymization, blocking or deletion of unnecessary or unlawful processing, and applicable consent-related rights. You may contact the ANPD.
• Canada and other locations: local access, correction, consent withdrawal and complaint rights may apply, including additional provincial rights. The rights described here do not limit additional rights granted by your applicable law.

Raise a data-protection complaint at privacy@annot8.app. Describe the concern, relevant website or account, and how we can contact you; no special wording is required. We review the complaint, make appropriate enquiries, and communicate progress and the outcome. Where UK data-protection law applies, complaints must be acknowledged within 30 days and addressed without undue delay. To appeal a rights response, reply to it or email the same address with the subject ‘Privacy appeal’; applicable local appeal deadlines and regulator routes remain available. You may contact a competent regulator without giving up any legal right.

Regulator information is available from the EEA supervisory authorities, UK ICO, Swiss FDPIC, Canadian OPC, Australian OAIC, and Brazilian ANPD.

The Service is designed for business users and is not directed to children. A person must be at least 18 to create an Annot8 account. Customers must not knowingly use the widget or public forms to collect personal data from children under 16—or under the higher age required locally—without first obtaining Annot8's written approval and implementing all required notices, age assurance, and parental consent. Contact privacy@annot8.app if you believe a child submitted data through our own Service.

We may update this policy to reflect product, provider, or legal changes. We will post the revised date and provide additional notice when required. Questions, requests, or complaints may be sent to privacy@annot8.app. Security reports may be sent to security@annot8.app. Controller identity: Quad Labs Technologies LLC, 1021 E Lincolnway, 10208, Cheyenne, WY 82001, United States.