Privacy Policy

1. Introduction

Annotation Academy ("we," "our," or "us") is an AI evaluator education and certification service. Annotation Academy is operated by Spuud AI Ltd., a company based in Burnaby, British Columbia, Canada, which is the data controller responsible for your personal information.

This Privacy Policy explains what information we collect when you visit annotation.academy or use our services, how we use and share it, how long we keep it, and the choices and rights you have. Please read it carefully. By using our services, you agree to the practices described here.

2. Information We Collect

Information you provide to us

• Name and email address when you create an account
• Profile information from Google if you sign in with Google (OAuth)
• Payment details, which are processed and stored by Stripe, not by us
• Identity verification information, if you choose to verify your identity for a certificate. This is handled by Stripe Identity and can include images of a government-issued ID and a selfie, used only to confirm that the person earning the certificate is you
• Course progress, assessment answers, and exam results
• Messages you send to our AI assistant and to Kappa, our AI study partner (see Section 4)
• Messages you send us through forms, email, or support requests

Information we collect automatically

• Device information, such as browser type and operating system
• IP address and approximate, city-level location
• Pages visited, time spent, and actions taken on the platform
• The website or source that referred you to us
• Information collected through cookies and similar technologies (see Section 6)

3. How We Use Your Information

• To provide, maintain, secure, and improve our services
• To process payments and send you related confirmations
• To verify identity where required for a proctored certificate
• To track your learning progress and issue and verify certificates
• To respond to your questions and provide support
• To send service messages, and, where you have consented, marketing email
• To understand how the service is used so we can improve it
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To comply with our legal obligations

4. AI Assistant, Study Partner, and Conversation Records

We offer an AI assistant on our website and an AI study partner, Kappa, inside the course. When you use either of them, we record and store the messages exchanged so the assistant can respond and so we can improve our content and support.

These conversations are processed by our AI provider, Anthropic, to generate replies. We also use automated analysis to summarize conversations and to identify their topics, sentiment, and intent. If a conversation can be linked to you (for example, because you are signed in or have given us an email address), we may add that summary to a contact record that our team can review so we can follow up and improve the service. If you are not signed in, a conversation is linked to an anonymous session identifier rather than to your name.

Please do not share sensitive personal information in chat (for example, government identification numbers, full payment card numbers, or health information). The assistant and study partner are educational aids and can be inaccurate, so do not rely on them for legal, financial, medical, or other professional advice.

You can ask us to access, correct, or delete your conversation records or contact profile at any time by emailing privacy@annotation.academy.

5. How We Share Your Information

We do not sell your personal information for money. We share information only as described below.

Service providers

We use trusted third parties to operate our service. They may process your information only to provide their service to us:

• Stripe for payment processing
• Stripe Identity for identity verification
• Anthropic to power and process AI assistant and study partner conversations
• ClassMarker to deliver and proctor the certification exam
• Certifier to issue and host your digital certificate and its verification record
• Vercel for website and application hosting
• Supabase for database hosting of your account, progress, and records
• Resend for sending service and, where you consent, marketing email
• Google for sign-in (Google OAuth) and analytics (Google Analytics)
• Quora for advertising and conversion measurement
• Meta (Facebook and Instagram) for advertising and conversion measurement

Other sharing

• Certificate verification: when you or an employer checks a certificate, we display the limited information shown on the public verification page for that credential
• Legal requirements: when required by law, or to protect our rights, users, or the public
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy

6. Cookies, Analytics, and Advertising

We use cookies and similar technologies for essential site functions, to measure how the site is used, and to support advertising and conversion measurement with partners such as Google, Quora, and Meta. Non-essential analytics and advertising technologies are controlled through our consent banner, and you can change your choices at any time. For more detail, see our Cookie Policy.

7. Data Retention

We keep your personal information for as long as your account is active or as needed to provide the service, and then for a reasonable period afterward to meet legal, accounting, security, and dispute-resolution needs. Certificate and verification records may be kept longer so that credentials you earned remain verifiable. Conversation records and contact profiles are kept until they are no longer needed for support and improvement, or until you ask us to delete them. You can request deletion at any time at privacy@annotation.academy.

8. Data Security

We use appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (HTTPS and TLS)
• Secure authentication, including OAuth 2.0
• Access controls that limit who can view personal data
• Logging and monitoring of access to protected content

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your Privacy Rights (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following lawful bases: to perform our contract with you (providing the course, exam, and certificate), for our legitimate interests (operating, securing, and improving the service and limited marketing), to comply with legal obligations, and with your consent (for example, non-essential cookies and marketing email).

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

To exercise these rights, contact privacy@annotation.academy.

10. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know what personal information we collect, to request access or deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information.

We do not sell your personal information for money. Our use of advertising and analytics partners such as Quora, Google, and Meta may be treated as "sharing" for cross-context behavioral advertising under California law. To opt out, you can:

• Reject non-essential cookies in our consent banner; and
• Email privacy@annotation.academy with the subject "Do Not Sell or Share My Personal Information"

We will not discriminate against you for exercising your privacy rights.

11. International Data Transfers

We operate from Canada and use service providers located in Canada, the United States, and other countries. When your information is transferred across borders, it may be processed in a country with different data protection laws than your own. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

12. Children's Privacy

Our services are not intended for individuals under 16 years of age, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. For significant changes, we will provide additional notice where required.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact: