English

Privacy policy

As of 3 November 2026, version 1.7. This is the English version of the German text. The German text governs in case of doubt; you reach it through the language switch.

This privacy policy applies to Annotator (annotator.ch), the service that replaces personal data in texts with placeholders before you use the text with an AI. Annotator stores little: we do not store your text.

1. Controller

The controller within the meaning of the Swiss Federal Act on Data Protection (FADP) is VectorAgency GmbH, Zürcherstrasse 57, 8102 Oberengstringen, Switzerland.

Contact for privacy questions: support@annotator.ch

If you use Annotator for a company, an organization or another professional activity, we process the personal data in your texts on your behalf (Art. 9 FADP). You are then the controller of this data, and the processing agreement in section 10 of the terms of use applies. We stay the controller of all other data in this policy, for example the data about your account, your credit and your purchases, and the logs.

2. Your text

Text you insert and files you upload (PDF, DOCX, TXT, MD) go through the Annotator server to VectorAgency's detection service in Switzerland. It finds the personal data and replaces it with placeholders. It keeps neither your text nor your files nor the result; it writes only one usage line without text for each request (section 3, request log). With each new text or file, your browser also sends the detection service the placeholders and original values from every text processed in this tab, so the same value keeps its placeholder. Neither our server nor the detection service stores this assignment. On our server, text, files, file names and the assignment of placeholders to the original data are neither stored nor logged.

The result, the text with placeholders and the assignment, passes through our server on its way back to your browser. If you mark a missed word, the result with your mark goes the same way to the detection service once more for the re-check. No text is stored then either.

Annotator sends nothing to an AI provider. You copy the text with placeholders into your AI chat yourself. You insert the answer into Annotator; the original data is put back there in your browser only, and the answer is not sent to our server.

3. What we store

The following list names what we store about you. We use this data to provide sign-in, accounts, organizations and credit, to prove your agreement to the terms of use, to detect abuse, to find faults and to see how the website is used. Individual VectorAgency staff can see it in an administration tool to manage vouchers, credit and blocks.

  1. Account. Your email address, your language, the date of registration and the date of your last sign-in. When you sign in, you agree to the terms of use: we store the version you last agreed to and the time of your first sign-in under that version.
  2. Workspaces, organizations and memberships. Every account has a workspace of its own. If you belong to an organization, we store its name, your membership with its role (owner, member) and date, and the workspace you last worked in, so that it is open at your next visit.
  3. Invitations. If the owner of an organization invites someone, we store the email address of the person invited, even if that person has no account yet. We also store the organization, who invited, the times of the invitation, and whether it was accepted or withdrawn.
  4. Vouchers. Organizations arise only from vouchers that we issue. We store the code, the name of the organization, the administrator's email address, the amount, the number of seats, the discount on the first purchase, the dates of issue and redemption, and the identifier of the staff member who issued it.
  5. Credit. Every booking, credit or debit, with workspace, kind, amount in tokens and date, for a debit the reference number of the request, and for a credit the date it expires. If we remind you by email of bought credit that expires soon, we record which credit and when. No text.
  6. Purchases. If you buy credit, we store the workspace, the pack, the amount in tokens, the price, any discount on the first purchase, the validity in months, the version of the terms of use and the time you accepted them on the payment page, the state of the purchase (open, paid, failed or refunded) with its dates, and the payment's IDs at Stripe: payment page, payment, charge and any refund. You enter card and account details directly at Stripe; we neither receive nor store them.
  7. Credit we grant and check value. If staff add credit by hand, we store the workspace, the amount, the reason as free text, the staff member's identifier and the date. The starting credit is given once per mailbox; for that we store a check value of your mailbox (a hash with a secret key), not the address itself.
  8. Sign-in codes and sessions. When you sign in, we email you a six-digit code and a link. We store your address, the code and the link (these two only as check values), the expiry after 10 minutes and the number of attempts, whether or not the code was used. After sign-in we store the session: the session key only as a check value, the date, the last use, the expiry and any revocation. The key itself is only in your cookie.
  9. Sign-in log. For every request of a code, every check of a code and every confirmation of a link, successful or not, the server writes a line: the address entered (as it was entered, up to 320 characters, even if there is no account), the IP address, the browser identification, the result (for example wrong code), the identifier of the account, the reference number of the request and the time. The server does not write the code or the link into this line, but the address field is recorded as it was entered.
  10. Request log. For every request the application writes a line: method, page (the route, without parameters), status, duration, identifier of the account and reference number. For text detection it adds the workspace, the tokens debited and any error code. For every text detection it also writes a usage line without text: whether it was text, a file or a re-check, for a file its format (for example PDF), the size of the request in bytes, the number of characters and pages, whether your workspace had paid or free credit, the interface language, the position in the queue, the time waited and the duration of the detection, the tokens debited and the result with any error code. It likewise writes a usage line when you sign in for the first time (with the start credit and the interface language), redeem a voucher (with the result, the amount and the number of seats), send an invitation (with its identifier and the number of seats, members and open invitations) or accept one (with the number of invitations accepted and when, at sign-in or on a page load), start a purchase (with the identifiers of the purchase and the pack, the amount in tokens, the price and any discount), sign out, or did not solve the puzzle of the sign-in page (with the reason it was not solved and the limit that then applies). Each of these lines carries, where there is one, the identifier of the account, the workspace and the reference number. None contains text, file names, email addresses or sign-in or voucher codes. On a server error it writes the reference number, the page, the status and the kind of error. This line contains no IP address, no email address and no text. We show you the reference number when an error occurs, so that we can find the line. The VectorAgency detection service also writes a usage line of its own for every request made to it, without text: the same reference number, an identifier of Annotator's service key (a hash), the page, the result with any error code, the duration, the number of characters, pages and tokens, and the number of entries detected per type. This lets its line be matched to the application's line.
  11. Server log. The server that receives requests to Annotator keeps an access log: IP address, time, page requested and browser identification.
  12. Visitor statistics. On the home page, the terms of use, the privacy policy and the imprint we count page views, so that we can see how the website is found and used. For this we use Umami, a statistics tool that VectorAgency runs itself. Your browser loads a script from analytics.vectoragency.ch and, for every page view, sends the following there: the page, the page or website you came from, the page title, the screen size and the browser's language. Of the page's address it sends only the path and any campaign parameters (utm_source and the like), and of another website only its domain. Umami also stores the time, the browser, operating system and device type, and the country, region and city it derives from the IP address. It does not store the IP address itself. From it and the browser identification it computes an identifier that changes every month and applies to annotator.ch only. This lets page views from the same browser within a month be counted together. We do not count sign-in, the application or the account, and your text never reaches the statistics. If your browser sends the Global Privacy Control or Do Not Track signal, the page does not load the statistics.
  13. Blocks. If we block an account for abuse, we store the time and the reason on the account. If we block an address or a domain, we store the block with the date, the reason and the identifier of the staff member.

In addition there is the activity log of the administration tool: it records which staff members (by identifier) changed which entries there, and when. We keep it for 12 months. If you send us an email, for example for a refund or a deletion, we keep your email and our answer in Annotator's mailbox at the Swiss email provider. If we refund by bank transfer, we also keep your bank details there (section 7).

4. Cookies and browser storage

We use no analytics or marketing cookies and we do not track you across other websites. The visitor statistics (section 3) set no cookie and write nothing to the browser's storage. The font is loaded from our own server, not from third parties.

  • annotator_session keeps you signed in and holds the session key. It lasts 30 days and is extended with use. The cookie cannot be read by scripts (HttpOnly), is sent only over HTTPS and is not sent with requests that another website triggers, unless you click a link to Annotator there (SameSite Lax).
  • annotator_locale remembers the language you picked. It lasts one year and is set only when you pick a language.
  • Work in the tab. The browser keeps your work in the tab's storage (sessionStorage): your text (for a file only its name and size), the result with the assignment, the answers you inserted and your marks, plus the placeholders and original values from every text processed in this tab and a few settings of the view. This assignment stays after “New text” and disappears when you close the tab. The browser sends it with each new text or file to the detection service so the same value keeps its placeholder; neither our server nor the detection service stores it.

5. Email

We send three kinds of email from noreply@annotator.ch, through a Swiss email and SMTP provider: the sign-in email with code and link, the invitation to an organization, and a reminder when bought credit expires within the next 30 days. The invitation names the organization and is written in the language of the person who invited, never with that person's address. The reminder goes to the person who owns the account or the organization and says how much credit is valid until when. Only the connection from our server to the email provider is TLS-encrypted; we cannot vouch for the rest of the way to your mailbox. If we change the terms of use or end Annotator, we also write to the address of your account.

6. Recipients and service providers

We pass on personal data only where this is necessary for the purposes named or where the law requires it.

  • Processors: a Swiss hosting and infrastructure provider and a Swiss email and SMTP provider.
  • The detection service is a service of VectorAgency itself on the same Swiss infrastructure. It stores no text and no files; it writes one usage line without text for each request, kept for 12 months.
  • Payments: if you buy credit, Stripe (Stripe Payments Europe, Limited, Dublin, Ireland) handles the payment. You enter your payment details on Stripe's payment page. There you also enter your name and billing address, and for a purchase for a company also its name and UID number. Stripe puts these details on the invoice. We do not store them. For this we pass Stripe your email address, the pack and the price. Stripe creates the invoice and keeps it. The Federal Council has found that Ireland provides adequate data protection (Annex 1 of the Data Protection Ordinance, DPO). Stripe also discloses data to Stripe, LLC in the USA and processes data for purposes of its own, such as fighting fraud. Stripe's privacy policy applies to that. Stripe, LLC is certified under the Swiss-U.S. Data Privacy Framework. The Federal Council has found that companies with this certification also provide adequate data protection (Art. 16 para. 1 FADP, Annex 1 DPO). If this finding ends, Stripe relies on the European Commission's standard contractual clauses in the version adapted for Switzerland, which the FDPIC recognizes (Art. 16 para. 2 let. d FADP).
  • VectorAgency runs the visitor statistics (Umami) itself on the same Swiss infrastructure. We do not pass their data on to third parties.
  • Authorities, where required by law.

Hosting, email sending, text detection and visitor statistics are, as things stand, operated in Switzerland. Stripe processes the payments outside Switzerland, among other places in Ireland and in the USA. For operations and support, people who work for VectorAgency also access the servers from the EU, today from Portugal.

7. Retention

  • Your text and your files: not stored.
  • Sign-in codes: valid for 10 minutes. The daily cleanup deletes every code once it is older than a day, used or not.
  • Sessions: until they expire (30 days after the last use) or you sign out. The daily cleanup deletes expired and revoked sessions.
  • Technical logs (sign-in log, request log and error lines of the application, usage lines of the detection service): 12 months.
  • Server log (IP address, time, page, browser): 90 days.
  • Visitor statistics: 12 months.
  • Activity log of the administration tool: 12 months.
  • Database backups: we back up our database regularly and keep each backup for about 30 days. During that time, deleted data may still be contained in an older backup.
  • Account, memberships, invitations and blocks: until deletion at your request (section 8). There is no automatic deletion. If we delete a blocked account, its address stays stored as a block, so that no new account can be opened with it.
  • Vouchers and the name of an organization: a voucher cannot be deleted, the administrator's address on it cannot be changed, and a workspace is never deleted, so an organization keeps its name. The unspent part of a voucher expires 90 days after issue; the entry remains.
  • Credit bookings, credit granted, the reminders of expiring credit and the check value for the starting credit: they are only ever added, never changed, and they remain. The bookings contain amounts, dates and reference numbers, no text from your work. For credit granted, staff write the reason by hand as free text; we do not provide for addresses there, but we cannot rule them out. The check value is a hash, not your address.
  • Purchases: 10 years after the end of the financial year in which you bought. The law requires us to keep accounting records for this period (Art. 958f CO). We then delete them. Until then, only their state changes, for example with a refund. Stripe keeps the invoices.
  • Emails to support: until your request is settled, then for at most 2 years. We keep emails about a purchase or a refund as long as the purchases.
  • Cookies and browser storage: as in section 4.

8. Your rights

You have the following rights: access (Art. 25 FADP), rectification (Art. 32 para. 1 FADP), deletion, data portability (Art. 28 FADP), objection, and the right to have certain processing restricted or prohibited, where applicable.

To exercise them, send an email to support@annotator.ch. We handle your request within 30 days. Annotator itself has no deletion function yet: we handle a deletion request by hand, within the same period. We then delete your account and your sign-in data. Your credit expires with the deletion. We refund the unused part of bought packs if you ask for it in your deletion request or before (section 8.4 of the terms of use). If you own an organization, we close it with your account. What remains: a voucher with the administrator's address and the name of an organization; the credit bookings (amounts, dates and reference numbers, no text); the purchases with the payment's IDs at Stripe until their retention period ends; the check value for the starting credit; credit granted by staff with its reason; the logs, the emails to support and the visitor statistics until their retention period ends (section 7); the database backups for about 30 days. If your account was blocked, your address stays stored as a block, so that no new account can be opened with it.

9. Security incidents

In the event of a data security breach we take suitable measures to contain it, check whether we must notify the FDPIC and inform the persons concerned where the law requires it.

10. Users from the EU and the EEA

Our offer is currently aimed primarily at people in Switzerland and not specifically at people in the EU or the EEA. Where the General Data Protection Regulation (GDPR) should apply in individual cases, we process personal data according to the principles described in this privacy policy. No representative in the EU under Art. 27 GDPR is currently named, as we do not target our offer at the EU or the EEA.

11. Right to complain

You have the right to lodge a complaint with the competent data protection authority: the Federal Data Protection and Information Commissioner (FDPIC, German: EDÖB), Feldeggweg 1, 3003 Bern, Switzerland, www.edoeb.admin.ch.

12. Changes

We reserve the right to change this privacy policy when technical or legal changes require it. The current version is available on this page; its date and version number are given at the top.

13. Contact

For questions about data protection or to exercise your rights: support@annotator.ch.