Draft — not yet reviewed by counsel. This document is a starting point written to reflect Anna's actual data handling. It has not been reviewed by a lawyer and should not be relied on or published as binding until it has been — particularly the sections on data subject rights, international transfer, and sub-processors, which depend on which jurisdictions your customers and their clients are in.

Privacy Policy

Last updated: [DATE] · Effective: [DATE]

1. Scope

This Privacy Policy describes how [YOUR COMPANY LEGAL NAME] ("Anna," "we," "us") collects, uses, and shares information in connection with the Anna platform. It covers Organization accounts (contractors and construction companies that sign up for Anna) and the individuals they invite — employees, clients, and contractor-company users who access a project through Anna.

2. Information we collect

We collect:

  • Account information — name, email, phone, and authentication details (including multi-factor authentication enrollment, which is required for every account).
  • Content you provide — project, client, and contractor records; estimates, contracts, change orders, and the signatures applied to them; invoices and payment records (billing amounts, not full card numbers); compliance documents (insurance certificates, licenses) and the files you upload generally; daily reports, progress photos, and messages within the platform.
  • Usage information — log data, device/browser information, and activity within the app, including the append-only audit log Anna maintains for contracts, plan changes, and signatures.
  • Information from connected organizations — when your Organization connects with another company on Anna, data either side explicitly chooses to share (for example, a compliance document, or a project schedule).

3. How we use information

We use information to:

  • Provide and operate the platform — your projects, contracts, scheduling, invoicing, and the features you use.
  • Send notifications you're entitled to receive (contract ready to sign, change order pending, document shared with you, billing notices).
  • Process AI-assisted extraction you request (for example, reading an uploaded estimate or contract into structured data) — uploaded files are sent to our AI provider solely to produce that extraction and are not used to train their models beyond what their own processing terms permit.
  • Maintain security, prevent abuse, and keep the audit trail required for the contract and compliance features to be trustworthy.
  • Communicate with you about the service, including legally required notices.

4. How information is shared

We do not sell your information. We share it only:

  • With other users you invite or connect with inside the platform (your team, your clients, your connected contractors) — scoped to what you choose to share.
  • With service providers who process data on our behalf to operate Anna: our database and hosting provider (Supabase), payment processor (Stripe, once billing is active), transactional email provider (Resend), and AI processing provider (Anthropic) for the extraction features described above.
  • When required by law, or to protect the rights, safety, or property of Anna, our users, or others.
  • In connection with a merger, acquisition, or sale of assets, with notice to you.

5. Data retention

We retain account and project data for as long as your Organization's account is active, and for a reasonable period afterward to allow export and to meet legal, tax, and audit obligations. Compliance documents shared between connected organizations may be subject to independent retention settings configured by the receiving organization. The append-only audit log is retained indefinitely as a record-of-record for contracts and signatures, consistent with its purpose.

6. Security

Anna requires multi-factor authentication for every account with no exceptions, enforces tenant isolation at the database level, and maintains an append-only audit trail for changes to contracts, contract terms, plan items, and signatures. Data is encrypted in transit and at rest by our hosting provider. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. [THIS SECTION NEEDS JURISDICTION-SPECIFIC LANGUAGE — GDPR/CCPA RIGHTS LISTS AND A DEFINED PROCESS FOR EXERCISING THEM — ADDED DURING LEGAL REVIEW, BASED ON WHERE YOUR CUSTOMERS AND THEIR END CLIENTS ARE LOCATED.] To make a request, contact us at the address below.

8. Children's privacy

Anna is a business tool and is not directed at, or intended for use by, anyone under 18.

9. International data transfer

[ADD DURING LEGAL REVIEW IF ANNA WILL SERVE CUSTOMERS OR END CLIENTS OUTSIDE THE UNITED STATES — DESCRIBE WHERE DATA IS HOSTED AND THE TRANSFER MECHANISM USED, IF ANY.]

10. Changes to this Policy

We may update this Privacy Policy from time to time. We will provide notice of material changes before they take effect.

11. Contact

Questions about this Policy, or to exercise a privacy right: privacy@annabuilds.io