Privacy notice

This notice explains what personal data Annota collects, why, and your rights under Malaysia’s Personal Data Protection Act 2010 (PDPA). It is written in English; a Bahasa Malaysia version is available on request.

What we collect

• Account details: your name, organisation, work email and a password (stored only as a secure hash by our sign-in provider).
• What you ask: searches you type, questions you ask the AI assistant, and any mistakes you report about an award.
• Projects (only if you use them): a project keeps a case in one place so you can come back to it. When you work in a project we store, on our servers: its name, the facts, steps, dates and timeline (whether you or the assistant enter them), your notes, the text of the documents you add to it (letters, reports, emails; the text read from them, not the files), the letters you write in it, your assistant chats in it, the searches you run while working in it, and the awards you save with your notes. Only you can see your projects, unless you share one. To share, you make an invite link and send it yourself; it works once, for 7 days, and whoever opens it while signed in joins the project and can see and change everything in it. You see the email address on the account of each person who joined, and can take anyone off at any time; they can leave. They are kept until you delete them; deleting a project deletes everything in it, for everyone it is shared with, and deleting your account deletes all your projects. If you delete your account, what you added to someone else’s shared project stays in it as part of their case, without your name, and you are taken off it. While you work in a project the top of the screen says so, and one tap stops it. Add to calendar makes a calendar file on your device with each date, its label and the project’s name; we don’t send it anywhere, but once you add it, it is in your calendar app and goes wherever that calendar syncs.
• Letters you draft: outside a project, what you type into a letter stays in your browser and is not saved on our servers. Your company name and the signer’s name are remembered in this browser so you don’t retype them. When you use the AI on a letter (filling it from your description, Rewrite, Check or Write your own letter), your request and the letter’s text are sent to the AI for that task only; we do not store them.
• Files you attach to the assistant: PDFs, Word and text files are read in your browser; the file itself is not uploaded. Photos, and PDF pages that are only a scanned picture, are sent to an AI model to read their text, which is not stored. The text of what you attach is sent to the AI with your questions in that conversation only, the same way as your questions, and is not saved on our servers, unless you report an answer as not right (below). Close or reload the page and it is gone. The one exception is a project: while you work in one, the chat is kept in it, and that includes the assistant’s answers, which may quote your files. On a project’s page, a file you attach or add is kept in the project as text (the text read from it in your browser), so the assistant can use it later; the file itself is never kept. Remove a document from the project and its text is deleted.
• Answers you rate: marking an answer helpful sends only a count. Marking it “not right” sends that question, the answer (which may quote a file you attached) and your note to the Annota team, and an AI drafts a lesson from it that a person reviews before the assistant uses it. Please don’t include other people’s personal details in a report.
• Recent searches and awards: your recent searches and the awards you opened are listed in this browser only, so you can find them again. These lists are not kept on our servers. You can remove any recent search from the search menu, and both lists are cleared when you sign out.
• Technical data: basic error logs (time, page, error message) needed to keep the service running and secure.

Outside projects, we do not collect data about the employees or cases you work on. A project holds only what you choose to put in it: keep it to what the case needs. Please do not type personal data about other people into search or the assistant unless the case needs it.

Why we use it

• To create and secure your account and let you sign in.
• To answer your searches and questions. The text you type, and which award or filters are on your screen, is sent to an AI model to produce the answer.
• To fix mistakes you report, and to improve the service from search patterns that are not linked to your name.
• To send account emails you ask for, such as password resets.

We do not sell your data or use it for advertising.

Who processes it

• Supabase (database and sign-in), in Singapore. Data is encrypted at rest (AES-256) and in transit (TLS). Supabase is SOC 2 Type 2 audited.
• Vercel (website hosting), running in Singapore. Vercel is ISO 27001 certified and SOC 2 Type 2 audited.
• OpenRouter and the AI model provider it routes to (search answers, the assistant, and reading photos and scanned pages you attach). Only what you type, what you attach and what is on your screen is sent, never your account details. We allow only providers that do not store your questions or use them to train AI models (zero data retention).

Some of these providers are outside Malaysia. We use them only for the purposes above.

How long we keep it

Account data is kept while your account is open. When you delete your account (Settings, Delete account), your account details, the answers you reported and the questions the assistant declined are deleted straight away. Search logs and error logs are not linked to your name; they, reported answers and declined questions are deleted automatically after 12 months.

Cookies

We use only the cookies needed to keep you signed in and secure, and one that remembers which of your projects you are working in (it holds the project’s id, nothing else, and is cleared when you sign out). We do not use advertising or tracking cookies, so there is nothing to opt in or out of.

Security and breaches

Data is encrypted in transit and at rest, and access to it is restricted. If a personal-data breach occurs, we will notify the Personal Data Protection Commissioner and affected users as required by the PDPA (as amended in 2024). More detail is on our Security page.

Your rights

• See and correct your details in Settings at any time.
• Delete your account and its personal data in Settings.
• Ask for a copy of the personal data we hold about you, or withdraw consent, by contacting us.

Court awards

Awards in the data bank are published by the Industrial Court of Malaysia and are public records. Our summaries are derived from those published awards.

Contact

Questions or requests about your personal data: jchandrasegaran@gmail.com.