What we collect, what we do with it.

This privacy policy ("Policy") describes how annchor ("we," "us," "our"), operator of annchor.ai (the "Service"), collects, uses, shares, and protects personal information. It applies to anyone who signs up for, uses, or otherwise interacts with the Service. By using the Service, you confirm you have read and agree to this Policy. If you do not agree, do not use the Service. ──────────────────────────────────────── 1. Who we are ──────────────────────────────────────── annchor is a US-based independent service operated by the owner of annchor.ai. We are the data controller for the personal information described in this Policy. For privacy questions, contact: privacy@annchor.ai. ──────────────────────────────────────── 2. What we collect ──────────────────────────────────────── We collect only what we need to run the Service. a) You give us directly: • Phone number (E.164) — required to call and text you. • First name and any details you share during onboarding (preferred check-in time, focus areas, support style, "about you" notes you provide). • Email address (optional, if you provide it for account recovery or product updates). • Daily intentions, goals, tasks, and calendar events you enter or that Ann captures during calls. b) Generated automatically when you use the Service: • Audio of phone calls between you and Ann. • Transcripts of those calls. • SMS messages you send to Ann and SMS we send you. • Call metadata (timestamps, duration, end reason, reference codes). • Structured summaries that AI extracts from call content (e.g. "today's one thing"). • Account activity (sign-in times, account changes). • Limited technical data from your browser (e.g. user-agent string and IP address only as needed for Vercel's hosting platform to deliver pages). c) From third parties: • SMS delivery status and inbound SMS content from our carrier (Twilio). • Call session metadata from our voice platform (Vapi). We do not knowingly collect data from children under 13. The Service is intended for users 18 years or older. ──────────────────────────────────────── 3. How we use your information ──────────────────────────────────────── We use personal information to: • Operate the Service — place calls to you, send texts, store transcripts so future conversations have context. • Authenticate you (one-time SMS codes, optional PIN). • Recognize and act on your stated intentions (e.g. send a reminder before a calendar event you asked Ann to remember). • Improve Ann's quality — review call transcripts and summaries to debug issues, evaluate model behavior, and refine prompts. • Detect and prevent abuse, fraud, and security issues. • Comply with legal obligations. Legal basis (where applicable): performance of our agreement with you, your consent (for marketing or non-essential communications), and legitimate interests (security, product improvement). ──────────────────────────────────────── 4. SMS and phone-call communications ──────────────────────────────────────── By providing your phone number on the Service, you expressly consent to receive recurring text messages and phone calls from annchor at that number. This includes: • One-time sign-in codes. • Sporadic check-in calls and messages from Ann throughout your day. • Reminders for events you (or Ann on your behalf) added to your calendar. • Other service-related communications. Message frequency varies — typically several per week, depending on your settings. Message and data rates may apply. Consent is not a condition of any purchase. Texts and calls come from our number, +1 447 266 2467, via Twilio (texts) and Vapi (calls). Opt-out: • SMS: reply STOP to any text we send. You will be unsubscribed and receive one confirmation message. • SMS help: reply HELP to any text. We will reply with contact information. • Calls: email privacy@annchor.ai to be removed from call lists. Opting out of SMS does not opt you out of calls. Opting out of calls does not opt you out of SMS. Request both if you want both. Sample messages you might receive: • "Your annchor verification code is 482719. It expires in 10 minutes. Msg & data rates may apply." • "Morning. New day. What's on your plate?" • "Reminder: Dentist at 2:30 PM." ──────────────────────────────────────── 5. Who we share your information with ──────────────────────────────────────── We share personal information only with providers and parties that help us deliver the Service or as required by law. a) Service providers ("processors"). They are contractually bound to use the data only to perform their service for us: • Vapi — voice platform; processes call audio and metadata. • Twilio — telephony provider; carries voice calls and SMS; provides the phone number. • OpenAI — large language model provider; processes call and chat transcripts to generate Ann's responses and structured summaries. • Anthropic — AI provider; may process the same content depending on configuration. • ElevenLabs — voice synthesis provider used by Ann. • Deepgram — speech-to-text transcription provider. • Turso — database hosting (libSQL) for account, transcript, and intention data. • Vercel — web hosting and deployment for annchor.ai. • Trello — task tracking used by the operator (your data is not stored in Trello unless we deliberately add it to a card; we don't). b) Legal and safety. We may disclose personal information if required by law, subpoena, or court order; to enforce our terms; or to protect the rights, property, or safety of users, ourselves, or the public. c) Business transfers. If annchor is acquired, merged, or sold, your data may transfer to the new entity subject to the same protections in this Policy. We do not sell your personal information. We do not share personal information with advertisers or data brokers. No mobile information — including your phone number and your SMS opt-in or consent — will be shared with or sold to third parties or affiliates for marketing or promotional purposes. The service providers listed above receive only the data needed to deliver the Service (for example, Twilio to carry the messages); SMS opt-in consent itself is never shared with any third party. ──────────────────────────────────────── 6. How long we keep your information ──────────────────────────────────────── • Account profile: kept while your account is active and for up to 30 days after you request deletion (to allow recovery from accidental deletion). • Call audio: retained by Vapi according to their retention policy (typically 30–90 days). We do not store raw audio on our own systems. • Transcripts and summaries: retained on our database until you request deletion. • SMS message bodies and metadata: retained on our database until you request deletion. • Twilio's separate retention of message and call logs is governed by Twilio's own policy. • Aggregated and de-identified data (which cannot be linked back to you) may be retained indefinitely. ──────────────────────────────────────── 7. Your rights and choices ──────────────────────────────────────── Regardless of where you live, you may: • Ask what personal data we hold about you. • Request a copy of that data. • Ask us to correct inaccurate data. • Ask us to delete your account and associated data. • Opt out of SMS (reply STOP) and calls (email us). • Withdraw consent we relied on; this does not affect prior processing. To exercise these rights, email privacy@annchor.ai from the email address on file or the phone number you registered with (we will verify your identity before acting). We aim to respond within 30 days. State-specific rights: • California residents (CCPA/CPRA): you have the rights above plus the right to know the categories of personal information collected and shared, to opt out of "sales" or "sharing" (we do neither), and to non-discrimination for exercising your rights. • Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and similar states: rights of access, correction, deletion, portability, and opt-out of targeted advertising and profiling (we do not engage in either). ──────────────────────────────────────── 8. Security ──────────────────────────────────────── We use commercially reasonable safeguards to protect personal information: • All web traffic is encrypted in transit via HTTPS. • Database connections use authenticated, TLS-secured tokens. • Admin tooling is role-gated. • Credentials and API keys are stored as encrypted Vercel environment variables, not in source code. No system is perfectly secure. If we become aware of unauthorized access to your data, we will notify you as required by applicable law. ──────────────────────────────────────── 9. International users ──────────────────────────────────────── The Service is operated from the United States. By using it, you understand that your information will be transferred to and processed in the US, which may have different data-protection laws than your country. ──────────────────────────────────────── 10. Cookies and tracking ──────────────────────────────────────── We use only the minimum browser storage needed to run the Service: • localStorage to remember your sign-in session and a few UI preferences. • No third-party advertising cookies. • No analytics that profile individuals. ──────────────────────────────────────── 11. Changes to this Policy ──────────────────────────────────────── We may update this Policy from time to time. The effective date appears at the top. Material changes will be highlighted on the homepage or sent to you via SMS or email. Continued use of the Service after changes constitutes acceptance. ──────────────────────────────────────── 12. Contact ──────────────────────────────────────── Questions, requests, complaints: privacy@annchor.ai. For California-specific requests, include "CCPA Request" in the subject line. For SMS opt-out: reply STOP to any text from us. For SMS help: reply HELP to any text from us, or email the address above.