Privacy Notice

Fintela is a joint-stock company incorporated in the Republic of Türkiye and registered with the Ankara Trade Registry under number 524478. “Annot” is a trading name and product of Fintela and is not a separate legal entity.

• Registered address: Üniversiteler Mah. 1597. Cad. No: 3/127, Bilkent, Çankaya, Ankara, Türkiye
• Privacy contact: privacy@useannot.com
• General contact: support@useannot.com

We are the controller of the personal data we collect about users of the Service, for the purposes of the EU and UK General Data Protection Regulation and of Turkish Personal Data Protection Law No. 6698 (“KVKK”). This means we determine how and why your personal data is processed, as described in this Notice.

When you purchase a paid plan, our merchant of record — Paddle.com Market Limited or another company in the Paddle group, depending on where you are located (“Paddle”) — acts as a separate, independent controller for the payment and billing data it collects to process your purchase. That processing is governed by Paddle's own privacy policy. We do not receive or store your full payment card details.

Data you provide to us

• Account and contact data — your email address, any profile details you provide, and your responses to early-access or onboarding questionnaires.
• Your Content — the notes, links, quotes, documents, files, and other content you choose to save in the Service.
• Support communications — the content of messages you send us when you contact support or otherwise correspond with us.
• Consent records — where you opt in to marketing, we record your consent choice, the date and time, your IP address and browser user-agent, and the wording you agreed to, as evidence that consent was given.

Data we generate from your content

To make your saved material searchable and useful, we generate additional data from it: summaries, titles, tags, topics, connections between items, and numerical representations of your content (embeddings) that allow search and recall to work. This data is generated by us rather than provided by you, but it derives from your content and is treated as part of it. It belongs to you, it is not used to train AI models, and it is deleted when you delete the content it was generated from or delete your account — subject to the backup retention described in §6.

Data we collect automatically

• Usage and telemetry data — how you interact with the Service, feature usage, and diagnostic information.
• Server logs and device data — IP address, browser and device details, requested URLs, and timestamps.
• Cookies and local storage — your cookie and consent preferences, and analytics data where you have consented. See §8.

Data collected through the browser extension

The extension is a web clipper. It acts only when you tell it to — by clicking the extension, using its context-menu items, or using its capture tools on the tab you are viewing. It does not read pages in the background, monitor your browsing history, or run on sites you have not explicitly captured.

When you save something, it collects only what that save requires: the page's URL, title, and text or HTML content (with scripts and styles stripped); your text selection, when you save a highlight; an image or a region screenshot, when you capture one; for YouTube videos, the title, channel, and transcript; and a best-effort thumbnail of the visible tab.

The extension contains no analytics or telemetry. It requests a minimal set of permissions (activeTab, scripting, contextMenus, storage, alarms). For the occasional page our servers cannot fetch on their own, it asks for one-time, per-site permission before fetching that page on your behalf — you approve each site individually. Your session and a short list of recent saves are stored locally in your browser's extension storage and are removed when you sign out or uninstall the extension.

Payment data

We do not collect or store your full payment card details. Payment information is collected and processed independently by Paddle as merchant of record. We receive limited transaction data from Paddle — such as your plan, billing country, and the fact and status of a payment — to manage your subscription.

Where the EU or UK General Data Protection Regulation (“GDPR”) applies, the legal basis for each purpose is shown.

Where we rely on legitimate interests, those interests are operating, securing, and improving our Service and communicating with our users; we balance them against your rights and freedoms, and you may object at any time (see §9).

What we do not do. We do not use Your Content or your browsing activity to train AI models — neither our own models nor those of any third party. We do not use your personal data for advertising, and we do not sell your personal data. Where you connect a third-party AI tool to your memory, what that tool does with the content it receives is governed by its own terms; see §11.

We share personal data only as needed, and with:

• Service providers (processors) who help us run the Service under contract:
  • Supabase — authentication and database for your account, saved content, and consent records;
  • Google Cloud — hosting and API infrastructure;
  • Plunk — delivers our account, authentication, waitlist, and marketing emails, and stores marketing contact and subscription records;
  • Google Analytics — website analytics, only where you have consented. Google's privacy policy governs their processing: policies.google.com/privacy.
• Merchant of record (Paddle) — for the sale of paid plans, payment and subscription management, invoicing, and sales-tax/VAT compliance. Paddle acts as an independent controller for the payment data it collects.
• Third-party tools you connect — when you connect an AI assistant, application, or integration to your Annot memory, we make Your Content available to it at your instruction. Those tools act as independent controllers of the content they receive: they decide what to do with it, and their own terms and privacy policies govern that. We do not control them and are not responsible for their processing. You choose which tools to connect, and you can disconnect any of them at any time in your account settings.
• Professional advisers — such as our lawyers, accountants, and auditors, where necessary.
• Authorities and third parties — where required by law, to comply with legal process, or to protect the rights, property, or safety of Fintela, our users, or the public.
• In a business transfer — if we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Notice. We will notify you if this happens.

We require our service providers to protect personal data and to process it only on our instructions.

We are based in Türkiye, and some of our service providers are located in the European Union, the United States, and other countries. Your personal data may therefore be transferred to, and processed in, countries whose data-protection laws differ from those in your country.

Where we transfer personal data out of the European Economic Area (“EEA”) or the United Kingdom, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable), or transfers to countries covered by an adequacy decision. Contact privacy@useannot.com for more information about these safeguards.

As a controller established in Türkiye, we also transfer personal data abroad within the meaning of KVKK when we use service providers located outside Türkiye. We carry out those transfers on the bases permitted under Article 9 of KVKK, and we keep records of the safeguards we rely on. If you would like more detail, contact privacy@useannot.com.

Where you connect a third-party tool to your memory, Your Content is transmitted to that tool and may be processed in whichever country that tool operates from. You choose which tools to connect, and that choice determines where your content goes.

We keep personal data only for as long as necessary for the purposes described in this Notice.

• Your Content — retained until you delete it, item by item or all at once from Account → Data in the app, or until you delete your account. We do not delete your content because you downgraded, cancelled, or received a refund: content above your plan's allowances becomes read-only but remains available to view and export, so that it is still there if you subscribe again later.
• Data we generate from Your Content — summaries, tags, topics, connections, and embeddings are deleted at the same time as the content they were generated from, or when you delete your account.
• Account data — retained while your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, except where we must retain it by law. If we terminate your account, Section 13 of our Terms of Service explains the period during which you can still export Your Content before this happens.
• Waitlist and early-access details — retained while your registration is active.
• Consent records — retained as evidence of consent for as long as necessary to demonstrate compliance, including after you unsubscribe.
• Server logs and analytics — retained for a limited period; Google Analytics retention follows our property configuration, currently 14 months.
• Legal and financial records — retained for as long as required by applicable law.
• Backups — deleted content may persist in encrypted backups for a short period before being overwritten in the ordinary course.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. These include encryption in transit (HTTPS/TLS), encryption at rest for stored content, per-user database isolation (row-level security, so each account can access only its own data), access controls limiting internal access to those who need it, and a deliberately minimal permission model in the browser extension. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We review our safeguards regularly.

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and we will notify the relevant supervisory authority where the law requires it.

Some of your account's security depends on you. Keep your password confidential, and treat your MCP endpoint URL as a secret: anyone who has that URL can reach the content you have made available through it. If you think your endpoint URL has been exposed, contact us at support@useannot.com and we will help you replace it.

We use cookies and similar technologies, including browser local storage, on our websites and in our browser extension:

• Essential — required for the Service to function, such as authentication, security, and remembering your cookie choice (stored under the key annot-cookie-consent). These do not require consent.
• Analytics — Google Analytics 4, loaded only if you select “Accept all”. GA4 may set cookies such as _ga. We configure it with IP anonymisation and without ads-personalisation signals. If you select “Essential only”, no analytics scripts load and no analytics cookies are set.
• Marketing — if ever used, only with your consent.
• Extension storage — our browser extension stores your session and a short list of recent saves in your browser's extension storage, so that it can work without asking you to sign in each time. This is not analytics, and it is removed when you sign out or uninstall the extension. §2 describes what the extension collects.

We ask for your choice again if you clear it, if you use a different browser or device, or if what we use cookies for changes.

You can reopen your preferences at any time from the Cookie settings link in our footer, and withdrawing consent is as easy as giving it. You can also clear local storage for this site in your browser. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We provide self-service tools in the app to export and delete your data — Account → Data — and you can contact privacy@useannot.com to exercise any right. We will respond within one month, which may be extended where permitted by law. You will not be treated differently for exercising your rights.

Before we act on a request, we may need to confirm that it comes from you. Where we cannot identify you from the request itself, we will ask for enough information to be reasonably sure — usually confirmation from the email address registered on your account. We do this to make sure we never disclose your data to someone else.

If you are in the EEA or the UK (GDPR)

You have the right to: access your personal data; rectify inaccurate or incomplete data; erase your data (“right to be forgotten”); restrict processing in certain circumstances; data portability; object to processing based on legitimate interests, and to direct marketing at any time; withdraw consent where processing is based on consent; and lodge a complaint with your local data-protection authority, such as the UK Information Commissioner's Office or your EEA supervisory authority.

To object to processing based on legitimate interests, or to stop receiving marketing, email privacy@useannot.com or use the unsubscribe link in any marketing message. We act on marketing objections immediately and without asking for a reason.

If you are in California (CCPA/CPRA)

You have the right to know what personal information we collect and how we use and disclose it; to access a copy of it; to request correction or deletion; to opt out of any “sale” or “sharing” of personal information — we do not sell or share personal information as those terms are defined by law; and not to receive discriminatory treatment for exercising your rights. In the preceding 12 months we have collected identifiers (such as email and IP address), internet or network activity information (such as usage and server-log data), and the content you save. You may use an authorised agent to submit a request on your behalf.

If you are in Türkiye (KVKK)

You have the rights granted under Personal Data Protection Law No. 6698, including the rights to learn whether your data is processed, to request information, correction, or deletion, to request notification of such action to third parties, and to object to results arising exclusively from automated analysis of your data, as well as to claim compensation for damage arising from unlawful processing.

The Service is not directed to anyone under the age of 18, and our Terms of Service require you to be at least 18 to hold an account. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@useannot.com and we will take appropriate steps to delete it.

The Service contains links to, and integrations with, third-party websites and services that we do not operate. We are not responsible for their content or privacy practices.

Tools you connect to your memory. When you connect a third-party tool — for example an AI assistant through our MCP endpoint, or an app such as Notion or Obsidian — you are instructing us to make your saved content available to it. From that point the tool can retrieve the content you have made available, and it decides what to do with what it receives, including whether to store it or use it to train models. It acts as an independent controller, its own terms and privacy policy govern that processing, and it may operate from a different country. We do not control it and we are not responsible for it.

You choose which tools to connect, and you can see and remove your connections at any time in your account settings. Disconnecting stops any further access from that point on. It does not affect content the tool has already received, and it cannot require the tool to delete what it already holds — for that you would need to contact the tool's provider directly.

Connect only tools you trust, and read their terms before you do.

We may update this Privacy Notice from time to time. If we make material changes, we will give notice through the Service or by email at least 30 days before they take effect. The “Last updated” date at the top shows when it was last revised.

For any privacy question or to exercise your rights:

You can also reach us for general enquiries at support@useannot.com. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.