Legal
Privacy policy
This policy covers the hosted AnnotateTheWeb service at annotatetheweb.com: the browser extension, the website snippet (att.js), the dashboard, share links and the API and MCP endpoints. The short version: nothing is collected until you open the annotation overlay, and nothing is sent until you press Send. We don't sell data, show ads or track you across websites.
Who is responsible
umage.ai ApS, Teknikerbyen 5, 2830 Virum, Denmark. CVR 46352262. Email: [email protected].
What we collect, and when
When you send a note (extension or snippet)
Only when you press Send, the following goes to the workspace you chose:
- the page address (URL) and page title
- the element you picked: a CSS selector, a short excerpt of its text and HTML, and its position
- the size of the browser window and the scroll position
- your note, or the old and new text for a text change
- a screenshot of the visible page and your sketch, if you included them
- up to 10 recent console or script errors and 10 failed network requests from the page, with query strings and credentials removed
- your browser's user agent (browser name and version)
- the author name you typed
The page URL is saved as it is, including any query string. Don't annotate pages whose address contains something secret.
While the overlay is open, it also loads the existing notes for the current site, which sends that site's origin (for example https://example.com) to the service.
Replies and status changes
Replies to a note, the name of whoever wrote them, and status changes are stored with the note. This includes replies written on a share link or by a reviewer invited through the snippet.
Permanent workspaces and sign-in
For permanent workspaces we store the email addresses of the members, so we can send them sign-in links. We store only a hash of each access token, never the token itself.
Server logs
Like any website, our servers record technical logs: IP address, time, requested address, response status and user agent. We use them to keep the service running and to stop abuse, for example by rate limiting the creation of workspaces per IP address. Rate-limit counters are kept in memory only.
What the extension stores in your browser
The extension stores your workspace tokens, the server address, your author name, which replies you have read, and whether the overlay should stay open on the current site. This stays in your browser (chrome.storage) and is not sent anywhere except as needed to talk to your workspace. The dashboard stores your workspace tokens in your browser's local storage. To remove it all, uninstall the extension, or clear the site data for annotatetheweb.com. We don't use cookies for tracking or advertising.
Why we process it, and on what legal basis
- To provide the service: store your notes, show them to your workspace and deliver them to the tools you connect. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
- To keep the service secure and working: logs, rate limits, abuse prevention. Legal basis: our legitimate interest (GDPR art. 6(1)(f)).
- To send sign-in links to members of permanent workspaces. Legal basis: performance of a contract.
Who receives it
- Everyone with access to the workspace. Anyone holding a workspace token can see every note in that workspace. Treat the token like a password.
- Places you send it to yourself: AI agents you connect over MCP, webhook addresses you configure, and anyone you give a share link to.
- Hetzner Online GmbH, which hosts our servers in Finland (EU).
- Cloudflare, Inc., which sits in front of the site for security and performance and so processes requests in transit. Cloudflare is certified under the EU-US Data Privacy Framework.
- Resend, only for sending sign-in emails to members of permanent workspaces, once sign-in by email is switched on: it receives the email address and the message. Resend is a US company; transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.
Our website serves its own fonts. It doesn't load fonts or scripts from Google.
We don't sell personal data, and we don't share it with anyone else unless the law requires it.
How long we keep it
- Notes in a free workspace, with their screenshots, sketches and replies: deleted 7 days after their last activity (creation, reply, status change or edit).
- Empty free workspaces: deleted after 30 days without use.
- The public demo on annotatetheweb.com: notes are deleted after 24 hours.
- Permanent workspaces: kept until you delete the notes or ask us to remove the workspace.
- Server logs: rotated and deleted within 30 days.
Our commitments
We use the data only to provide and secure AnnotateTheWeb. We don't sell it, don't use it for advertising, don't use it to determine creditworthiness or for lending, and don't let people read it except where you've asked us to (for example for support), where it's needed for security, or where the law requires it.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Your rights
Under the GDPR you can ask for access to your personal data, and ask us to correct, delete or export it, to restrict how we process it, or object to our processing. Write to [email protected]. Because workspaces don't have user accounts, tell us the workspace and, if you can, the notes concerned. You can also delete your own notes in the dashboard at any time.
You can complain to the Danish Data Protection Agency, Datatilsynet (datatilsynet.dk), or to the authority where you live.
Self-hosted servers
AnnotateTheWeb can point at a server you run yourself. Data sent to such a server is handled by whoever runs it, not by us, and this policy doesn't cover it.
Changes to this policy
When we change this policy, we update it on this page and change the effective date at the top. For significant changes we also announce them on annotatetheweb.com before they take effect.