Privacy Policy

We only collect what we need to run the product. Broadly, that falls into three buckets:

• Account information — name, email, workspace, role, password hash, and billing details when you subscribe. We collect this when you sign up or invite teammates.
• Workspace content — everything you and your team create inside Anby: OKRs, meeting recordings and transcripts, knowledge base entries, decisions, action items, comments, integration data you connect (Jira, Slack, Google, etc.).
• Usage and technical data — device information, IP address, browser, product analytics events (which features are used, error logs), and Anby Coin consumption logs.

We do not buy personal data from brokers, and we do not use tracking pixels from third-party advertisers.

We use the information above to:

• Provide and operate the product — store your content, run AI actions, deliver notifications, bill your workspace.
• Keep the service safe — detect abuse, prevent fraud, comply with legal obligations.
• Improve the product — aggregate analytics, debug errors, and understand which features actually help.
• Communicate with you — service updates, security notices, product changelogs, and (if you opt in) occasional product marketing.

We do not train public or third-party AI models on your workspace content. Your team's content is used to serve your workspace — not to improve any model that benefits other customers without your consent.

Anby's AI features run on large language model providers (currently Anthropic and OpenAI). When your team uses an AI action — for example asking God Brain a question or summarizing a meeting — relevant content is sent to these providers to generate the response. These providers are contractually bound to:

• Not retain your content beyond what's needed to generate the response.
• Not use your content to train their models.
• Apply the same security standards as our own infrastructure.

We also use infrastructure providers for hosting (AWS), analytics (PostHog), email (Resend), and error monitoring (Sentry). A current list of sub-processors is available on request at privacy@anby.io.

While your workspace is active, we keep your content as long as you want it. Deleting content from within Anby removes it from active systems immediately; encrypted backups are purged on a rolling 30-day schedule.

If your workspace is cancelled, we retain your data for 30 days in case you want to reactivate, then permanently delete it. You can request immediate deletion at any time.

Some aggregated, non-identifying analytics (e.g., "X% of teams use feature Y") may be kept indefinitely.

You can export every piece of content in your workspace at any time via the Anby API or via our MCP server. No lock-in, no "enterprise upgrade" to get your own data back.

Workspace admins can also trigger a full workspace archive (JSON + attachments) from the Settings page. Large archives are delivered by email link within 24 hours.

Our baseline:

• All data in transit is encrypted via TLS 1.2+.
• All data at rest is encrypted (AES-256).
• Workspace data is isolated at the database-schema level per tenant.
• Access to production systems is limited to engineers on duty, requires 2FA, and is audit-logged.
• We run regular internal security reviews and respond to responsible-disclosure reports at security@anby.io.

No service is perfectly secure. If we ever detect a breach affecting your workspace, we'll notify you and your workspace admins without undue delay.

Depending on where you live, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Export your data in a machine-readable format.
• Delete your data.
• Object to or restrict certain types of processing.

You can exercise any of these rights by writing to privacy@anby.io. We'll respond within 30 days. If you're a team member in a workspace you don't own, some requests may need to be coordinated with your workspace admin.

Anby is operated globally. Your data may be processed in data centers outside your country. Where required by law (GDPR, UK data protection, etc.), we use standard contractual clauses and equivalent safeguards to protect international transfers.

Anby is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us and we'll delete it.

We may update this policy as the product evolves. Material changes (new categories of data, new sub-processors, significant changes to retention) will be announced via product in-app notification and/or email at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.