Privacy policy

1. Who we are

Anchor Point Agency, LLC ("AnchorMark", "we", "our") provides a visual feedback platform to product teams. This Privacy Policy explains how we process personal data when you visit our website or use our service.

For privacy questions, contact [email protected]. EU and UK customers may contact our Data Protection Officer at the same address.

2. Data we collect

• Account data: name, email, password hash (when applicable), organization, role, and authentication identifiers from your identity provider.
• Usage data: pages visited, features used, request timestamps, IP address, browser, device, and approximate location derived from IP.
• Captured context: when reviewers submit feedback, our SDK or extension may capture screenshots, console logs, network request/response metadata, the URL, and environment fingerprint (browser, OS, viewport, locale). Inputs marked with our redaction attribute are blurred and stripped before submission.
• Integrations data: when you connect Linear, Jira, GitHub, Slack, or other services, we process the data necessary to fulfill the integration (issue identifiers, status, assignees, comments, channel identifiers).
• Cookies and similar technologies: see Section 11.

3. Purposes and legal bases (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)): provide and operate the service, account management, billing.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, product analytics, service improvement, B2B marketing to existing customers.
• Consent (Art. 6(1)(a)): optional cookies, optional marketing emails, AI features that send context to model providers.
• Legal obligation (Art. 6(1)(c)): tax records, lawful information requests.

For Special Category data we do not intentionally collect (Art. 9), we rely on explicit consent if such data is incidentally captured.

4. Sharing and sub-processors

We share personal data with vetted sub-processors who provide hosting, identity, billing, email, AI, and analytics services. A current list, with name, purpose, and region, is published at /sub-processors. We notify customers in advance of new sub-processors and offer a reasonable objection period.

5. International transfers

Some sub-processors are located outside the EEA, UK, or Switzerland. For such transfers we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, plus supplementary measures such as encryption in transit and at rest.

6. Retention

We retain account data for the life of the account plus 30 days, captured context for the workspace-defined retention window (default 90 days; configurable per workspace), and audit log entries for 13 months unless a longer period is required by law or contract. Backups are rotated within 35 days.

7. Security measures

TLS 1.2+ in transit, AES-256 at rest, KMS-managed keys, tenant isolation enforced at the route, query, and row level, immutable audit logging, least-privilege access, and a documented incident response process. Detailed posture is published on our security page.

8. Your rights

Subject to applicable law (GDPR, UK GDPR, CCPA/CPRA, and similar), you have the right to access, correct, port, restrict, object to, or delete your personal data. California residents have the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal data — AnchorMark does not sell personal data. To exercise a right, contact [email protected]. You may also lodge a complaint with your local supervisory authority.

9. Children

AnchorMark is a B2B service not directed to children under 16. We do not knowingly collect personal data from children.

10. Automated decision-making and AI processing

AnchorMark uses AI to cluster duplicate reports, suggest severity, and draft summaries. These outputs are advisory and reviewable by humans; no consequential decision is made automatically without a human in the loop. Where AI features send data to a model provider (e.g., Anthropic), processing terms prohibit training on customer content. Workspaces can disable AI features at any time.

11. Cookies and tracking

We use a small set of strictly necessary cookies for authentication and session management. Optional analytics and product cookies require your consent where law requires. A cookie preference center is available from the footer.

12. Changes

We update this policy as our practices evolve. Material changes are notified by in-product banner and email at least 30 days before they take effect. The "last updated" date above reflects the current version.

13. Contact

Anchor Point Agency, LLC, attn: Privacy. [email protected]. See our DPA for processor terms and sub-processors for the current list.