This Privacy Policy explains how Easy Annotation (“we”, “us” or “our”), based in Toronto, Ontario, Canada, collects, uses, discloses and protects personal information when you visit easyannotation.com or use the Easy Annotation Service.
We are responsible for the personal information under our control and have designated a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy laws, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). If you are in the European Economic Area, the United Kingdom or Switzerland, we are the controller of your account information. When an organization uses the Service to process personal information contained in its documents, that organization is the controller and our Data Processing Addendum applies.
Information we collect
Information you give us
- Account information: your name, email address, country and password (stored only as a one-way hash), and an optional profile photo.
- Account choices and security settings: whether you have turned on AI processing; if you use two-factor authentication, its secret (stored encrypted) and recovery codes (stored as hashes); and a record of each version of our Terms you accepted, with the date, time, IP address and browser type at acceptance.
- Your content: PDF, Word and PowerPoint files you upload; file and folder names; annotations and label settings; and, in project workspaces, text and images extracted from your files, previews, claims, evidence matches, review records and processing history. Your documents can contain personal information about other people, such as the authors named in references.
- Sharing: the email addresses you enter when you share a document. We use them only to send the invitation to registered users; we do not keep a list of the addresses you enter.
- Support messages: what you tell us when you contact support, and our replies.
- Pre-launch list: if you joined our pre-launch mailing list, your name and email address.
Information from payments
When you subscribe or buy credits, our payment processor Stripe collects your payment details. We receive and store your Stripe customer identifier, your card brand and last four digits, subscription status and dates, payment amounts, invoices, and your AI Processing Credit balances and usage. We never receive your full card number or security code.
Information collected automatically
- Technical and usage information: IP address, browser and device type, the pages and features you use, timestamps, and error and security logs.
- Cookies and browser storage: described in our Cookie Notice.
- Public website measurement and bot protection: the LinkedIn Insight Tag on our public pages and sign-in and registration pages, and Google reCAPTCHA on sign-in and registration.
How we use information
- To create and secure your account, including sign-in, email verification, password resets and two-factor authentication.
- To provide the Service: storing, converting, displaying and annotating your documents, delivering copies you share, and running project processing you start.
- To run AI-assisted claim extraction, only if you have turned on AI processing (see section 4).
- To process payments, manage subscriptions, credits and invoices, and keep financial records.
- To send service emails, such as verification links, password resets, security notices, receipts, trial reminders and sharing invitations. We do not currently send marketing emails.
- To respond to support requests.
- To prevent fraud and abuse, protect the Service and investigate security incidents.
- To understand how our public website is used and measure our advertising, using the LinkedIn Insight Tag.
- To comply with legal obligations, such as tax and accounting requirements, and to enforce our Terms.
We do not sell personal information. We do not use Your Content for advertising or to train AI models.
Legal bases (EEA, UK and Switzerland)
Where these laws apply, we rely on: contract (to provide the Service you signed up for); legitimate interests (to secure the Service, prevent fraud, support you and measure our public website); consent (for AI processing, which you can withdraw at any time, and where consent is required for cookies); and legal obligation (for example, keeping tax records).
AI processing
AI processing is off until you turn it on in your profile. When it is on, text from the primary deliverable you upload to a project is sent to OpenAI’s API to identify claims. We send document text and processing instructions only — not your name, email address or account details. OpenAI does not use this data to train its models and may retain it for up to 30 days to monitor for abuse. Full details are in our AI Processing Notice.
How we share information
- Service providers that host, store, process, deliver or secure information for us under contract, listed on our Sub-processors page. They may use it only to provide services to us.
- Other users, when you share a document with them.
- Professional advisers, such as lawyers and accountants, under confidentiality obligations.
- Legal and safety reasons: to comply with a law, court order or lawful request, or to protect the rights, property or safety of our users, the public or us.
- Business transfers: as part of a merger, acquisition, financing or sale of assets, with notice to you.
- With your consent, or at your direction.
Our public website uses the LinkedIn Insight Tag to measure visits and the effectiveness of our advertising on LinkedIn. LinkedIn receives information such as your IP address, browser details and the public pages you visit. Depending on where you live, this may be treated as sharing personal information for targeted advertising; you can opt out as described in our Cookie Notice. The tag is not loaded inside the signed-in application.
Where information is stored
We store the Service’s databases, files and backups with Amazon Web Services in its Canada (Central) region. Some of our service providers, including Stripe, Resend, OpenAI, Google and LinkedIn, process information in the United States and other countries, where laws may differ from those where you live and where authorities may be able to access it. We use contractual and other safeguards to protect information that is transferred, including, where required for the EEA, UK or Switzerland, approved standard contractual clauses.
How long we keep information
| Information | How long we keep it |
|---|---|
| Account information | While your account is open. When you delete your account, your profile is erased and the account record is anonymized straight away; the anonymized record is kept so that billing records stay accurate. |
| Documents and project content | Until you delete them or your account. Deleted files are removed from primary storage immediately; remaining copies in versioned storage and backups are removed within 30 days. |
| Accounts that never confirm their email | Deleted after 7 days. |
| Billing, payment and tax records | 7 years after the end of the tax year they relate to, as required for Canadian tax purposes. |
| Database backups | 14 days. |
| Application and web-server logs | 14 days. |
| Records of the Terms you accepted | For the life of your account and afterwards for as long as needed to resolve disputes or meet legal obligations. |
| Support messages | For as long as reasonably needed to handle your request and keep a record of it. |
| Text sent for AI processing | Stored with your project as described above. OpenAI may keep it for up to 30 days for abuse monitoring. |
How we protect information
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including: encryption in transit (HTTPS); encrypted storage of uploaded files; private file storage that is accessed only through short-lived signed links or through the application after an ownership check; password hashing; optional two-factor authentication, required for administrators; security headers; restricted, least-privilege access for our systems and personnel; and monitored backups.
No method of transmission or storage is completely secure. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by law, and we keep a record of every such breach.
Your rights and choices
- Access and portability: download a copy of your account information and documents at any time from Profile → Download my data, or ask us for the personal information we hold about you.
- Correction: update your name and profile photo in your profile, and change your email address through the secure email-change process.
- Deletion: delete your account from Profile → Delete account, or ask us to delete information.
- Withdrawing consent: turn off AI processing at any time in your profile.
- Depending on where you live, you may also have the right to object to or restrict certain processing, to opt out of targeted advertising, and to appeal a decision we make about your request.
To make a request, email our Privacy Officer at support@easyannotation.com. We will ask you to confirm your identity, usually by replying from the email address on your account, and we will respond within 30 days. We will not treat you differently for exercising your rights. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or to the data-protection authority where you live.
Cookies
We use essential cookies to keep you signed in and protect forms, browser storage to remember preferences, and third-party technologies on some public pages. See our Cookie Notice for the full list and how to control them.
Children
The Service is intended for professionals and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy. The updated version will show a new effective date and version number. If a change is material, we will tell you by email or in the Service before it takes effect.
Contact our Privacy Officer
Privacy Officer, Easy Annotation, Toronto, Ontario, Canada. Email: support@easyannotation.com.