Privacy Policy
The short version: we collect what you type into the waitlist and use it to email you about ANNX. We don't use cookies, analytics or ad trackers, and we don't sell or share your information.
Last updated
Draft under review. This document is in plain language and is being reviewed before we incorporate. Questions: hello@annx.dev.
1. Who we are
This website, annx.dev, is run by ANNX, an unincorporated project of its three founders (“ANNX”, “we”, “us”). We decide how the personal information described here is used, which makes us its “controller” or “business” under privacy laws that use those terms. When we incorporate, the new company will take over this policy and we will update this page. Privacy questions and requests: privacy@annx.dev.
2. What this policy covers
It covers personal information we collect through this website, the waitlist and email you send us. Section 13 explains how we handle information about companies in the ANNX dataset. It does not cover other websites we link to, which have their own policies.
3. What we collect
- When you join the waitlist: your work email, your company name (optional), the role you choose, whether you asked to be a design partner, and the time you agreed to hear from us.
- When you email us: your email address and whatever you choose to write.
- When you visit: our hosting provider records standard request data, such as IP address, browser type, the page requested and the time, to keep the site secure and running. To stop abuse of the waitlist form, our server holds your IP address in memory for up to 10 minutes. We never write it to our database.
What we don't collect:
- No cookies, analytics, advertising pixels, session recording or other third-party trackers.
- No precise location, payment details or sensitive personal information.
- Fonts load from our own domain, so viewing a page doesn't contact a font provider.
- The lookup demo runs in your browser against a fixed sample. We don't store what you search for.
4. How we use it, and our legal bases
| Purpose | Legal basis (EU and UK) |
|---|---|
| Emailing you about ANNX's launch and early access, which you asked for | Your consent |
| Contacting you about the design-partner program, if you ticked that box | Your consent |
| Replying when you write to us | Our legitimate interest in answering you |
| Keeping the site secure, stopping spam and abuse, and fixing errors | Our legitimate interest in a working, secure site |
| Counting interest by role, in aggregate | Our legitimate interest in planning the product |
| Meeting legal obligations and defending legal claims | Legal obligation; legitimate interest |
We do not sell your personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or add it to the ANNX dataset. We do not use it to train machine-learning models. We do not make decisions about you by automated means that have legal or similarly significant effects.
5. Who we share it with
We use these service providers. Each handles personal information only to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosts this website and runs the waitlist form. Keeps standard request logs (IP address, browser, pages requested) for security and operations. | United States |
| Supabase (Supabase Pte. Ltd. and Supabase, Inc.) | Stores the waitlist: email, company, role, design-partner choice and consent time. | Our project's hosting region; Supabase operates from Singapore and the United States |
| Cloudflare, Inc. | Runs DNS for annx.dev and forwards email sent to @annx.dev addresses. Cloudflare says it does not store forwarded messages. | United States (global network) |
| Google LLC (Gmail) | The inbox where email sent to @annx.dev arrives and from which we reply. | United States |
We may also disclose personal information:
- if the law requires it, or to respond to a valid legal request;
- to protect the rights, safety or property of ANNX, our users or others, including to stop fraud or abuse;
- to the company we form when we incorporate, or to a buyer or successor in a merger, financing or sale. That company will be bound by this policy, and we will tell the waitlist before any change in how its data is used.
We will update the provider list above before we add a new one.
6. International transfers
We are based in the United States, and our providers process data in the United States and, for Supabase, in Singapore. If you are in the EU, the UK or Switzerland, your information is transferred outside your country. Where the law requires a safeguard, we rely on our providers' data processing terms, which include the European Commission's Standard Contractual Clauses and the UK addendum, or on the EU-US Data Privacy Framework where a provider is certified under it.
7. How long we keep it
| Information | How long |
|---|---|
| Waitlist details | Until 12 months after the free lookup launches, or until you unsubscribe or ask us to delete them, whichever comes first |
| Unsubscribe records | Just your email address, kept on a do-not-email list for as long as we send email, so we don't contact you again |
| Emails with us | Up to 24 months after our last exchange, unless we need them longer for a legal reason |
| Rate-limit IP addresses | Up to 10 minutes, in memory only |
| Hosting request logs | We can see them for about an hour on our current hosting plan. Vercel keeps its own logs under its privacy policy. |
| Privacy and correction requests | 24 months after we close the request, as a record that we handled it |
8. Your choices and rights
Everyone, wherever you live, can:
- unsubscribe from our emails at any time, using the link in any email or by replying “unsubscribe”;
- ask what we hold about you, and get a copy;
- ask us to correct it or delete it.
In the EU, the UK and Switzerland, you also have the right to restrict or object to our processing, to data portability, and to withdraw consent at any time (this doesn't affect processing before you withdrew). You can complain to your local data protection authority, though we'd like the chance to fix things first.
In US states with privacy laws, such as California, Colorado, Connecticut, Virginia, Texas, Oregon and others, you may have the right to know what we collect and how we use it, to access, correct and delete it, to get a portable copy, and to opt out of the sale of personal information, targeted advertising and certain profiling. We don't do any of those three, so there is nothing to opt out of, but you can still ask. We will not treat you differently for using any of these rights.
How to make a request:
- Email privacy@annx.dev from the address you want the request to cover, or tell us which address it is about.
- We may ask you to confirm you control that address before we act. An authorized agent may make a request for you with your signed permission, and we may check with you directly.
- We reply within 30 days, and always within the time your law allows. If we turn a request down, we'll say why. If your state gives you a right to appeal, reply to our decision with “appeal” and someone who didn't make the first decision will review it within the legal time limit.
9. Opt-out signals and Do Not Track
If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information. Since we don't sell or share it, nothing else changes. We don't track you across sites, so Do Not Track signals don't change anything either.
10. California disclosures
In the past 12 months we have collected the categories below, for the purposes in section 4. We have not sold or shared any personal information, including of anyone under 16, and we don't collect sensitive personal information.
| Category | Examples | Source | Disclosed for a business purpose to |
|---|---|---|---|
| Identifiers | Work email address; IP address in request logs | You; your browser | Vercel, Supabase, Cloudflare, Google |
| Professional information | Company name, the role you pick, whether you want to be a design partner | You | Vercel, Supabase |
| Internet activity | Pages requested, browser type, time of request | Your browser | Vercel |
| Communications | Whatever you write in an email to us | You | Cloudflare (forwarding only), Google |
11. Security
The key the website uses for our database can add a sign-up to the waitlist and do nothing else: it cannot read, change or delete entries. Only the founders can view the list. Traffic to this site is encrypted with HTTPS. No method of storage or transfer is perfectly secure, so we keep what we hold to the minimum above. If we learn of a breach that affects your information, we will tell you as the law requires.
12. Children
This site is for business users. It is not directed to anyone under 16, and we do not knowingly collect their information. If you think a child has given us information, email privacy@annx.dev and we will delete it.
13. Information about companies, and corrections
ANNX records which AI vendors a company uses, taken from pages the company or its vendors publish, such as sub-processor lists, trust centers, data-processing addenda, help and AI-terms pages, job posts and vendor customer pages. Each record keeps the source URL, the date we captured it, the page's own date where it has one, and a short excerpt as evidence.
The dataset is about companies, not people. If a source page includes a person's name or contact details, we do not keep them, and we do not build profiles of individuals.
Any company can see its entry and ask us to correct it. Email privacy@annx.dev from an address at your company's domain, tell us which record is wrong, and link to the page that shows the correct position if there is one. We aim to reply within 10 business days, and we correct or remove the record if the published evidence does not support it.
14. Changes to this policy
If we change this policy, we will update the date at the top. If a change affects how we use waitlist data, we will email the waitlist before it takes effect, and we will ask for your consent again where the law requires it.
15. Contact
Privacy questions and requests: privacy@annx.dev. Anything else: hello@annx.dev. See also our Terms of Use.