Privacy Policy

AnnexWise is built privacy-first: the core of the product runs in your browser, and the most sensitive data it touches — your assessment answers and generated compliance documents — never reaches our servers. This page describes the little we do process, and your rights over it.

1. What stays on your device

Assessment answers, risk classifications, generated documents, your AI-system inventory and any partner branding are processed in your browser and stored in its local storage. We do not receive, store or see them. Clearing your browser data deletes them permanently.

2. What we process

Purchases. Payment is handled by our payment partner, identified at checkout; card details go to them, never to us. From a completed purchase we receive transaction metadata — the plan bought, amount, a payment reference and your billing email — to issue your licence and provide support.

Licence cookie. After a purchase (or licence activation) we set one strictly-necessary, httpOnly cookie (annexwise_license) holding your signed licence so paid features stay unlocked. It contains your plan tier and billing email, and is not used for tracking. We use no analytics or advertising cookies — our usage analytics are cookieless (see below).

Emails. We send transactional email only — your licence key after purchase and replies to your support requests — via our email provider. No marketing lists, no newsletters unless you explicitly ask for one.

Purchase requests. If you ask us for a payment link through the purchase-request form, we process the email address and plan you submit in order to respond.

Server logs. Our hosting provider (Vercel) keeps standard, short-lived request logs (IP address, user agent, URL) for security and operations.

Aggregate usage analytics.We measure page views with Vercel Web Analytics, which is cookieless by design: no cookies are set, no identifier persists across visits or sites, and we see aggregate counts (pages, referrers, countries, device types) — never an individual’s browsing profile. Your assessment answers are not part of this data in any form.

3. What we never do

We do not sell personal data, share it for advertising, profile you, or move it outside what is described above. We collect the minimum a software business can and still function.

4. Retention

Transaction records are kept as long as tax and accounting law requires. Support correspondence is kept while relevant. Licence cookies expire with your licence term (or after one year for perpetual licences, and can be re-set anytime with your key).

5. Your rights

Where the GDPR or similar law applies, you may request access, correction, deletion or portability of your personal data, object to processing, and lodge a complaint with your supervisory authority. Write to support@annexwise.com — we answer within one month. Note that we cannot delete what we never had: assessment content exists only on your device.

6. Processors

We use a small number of processors to run the Service: our payment partner (checkout and billing), Vercel (hosting and cookieless analytics), and our transactional email provider. Each processes data only to provide its function to us.