Privacy Policy

Last updated: 14 October 2026

This policy covers three things we operate: the annotide.com website, the purchase of a licence key through Paddle, and the licence service that issues and renews keys. It does not cover data you annotate inside your own Annotide installation — see “Your annotation data” below for why that’s a separate, important case.

Data controller: R Squared Data Solutions, a Finnish sole trader (toiminimi), business ID 3544515-7. Contact: hello@annotide.com; postal address on the Imprint.

The website

This section covers the annotide.com website only. The licence service and your own Annotide installation are described separately below; neither goes through Cloudflare.

annotide.com uses no cookies, no analytics scripts and no trackers. It is a static documentation and marketing site. Every request goes first to Cloudflare, from a location in its network near you, which serves the page from its cache or fetches it from Azure Static Web Apps, where Microsoft hosts the files and manages the app from its East US 2 region (the EU region does not accept new sites). Both process the technical data any web request carries (IP address, requested path, timestamp, user agent) to deliver the page and protect their services, and keep it for a limited time in their own logs.

We look at that request data only in Cloudflare’s dashboard, and only to keep the site secure and running: to spot attacks, vulnerability scans and abusive bots, to find errors and broken links, and to check overall load. We do not use it to profile visitors or follow anyone across pages or sites, we do not export or keep a copy of it, and nothing on the site calls a third-party analytics or advertising service.

The “Buy” buttons open Paddle’s checkout. Only when you click one, or open a payment link Paddle sent you (for example to pay an invoice or update a card), does the page load Paddle’s checkout script (Paddle.js) from Paddle’s servers; the checkout then runs in a window served by and communicating directly with Paddle, which may use its own cookies for the payment — see below.

Buying a licence (Paddle)

Paddle.com Market Limited (“Paddle”) is the merchant of record for all paid Annotide licences: Paddle is the seller, collects your payment details, calculates and charges VAT/sales tax, issues the invoice/receipt, and is the data controller for the payment transaction itself (card details, billing address, tax identifiers). See Paddle’s privacy policy for how Paddle handles that data.

Paddle passes R Squared Data Solutions the information needed to fulfil the licence: your email address and company name, the product and seat count purchased, and the transaction/subscription identifiers. We use this only to generate and email your licence key, to answer support requests, and to handle renewals, refunds and revocations. We do not use it for marketing without separate consent, and we do not sell it.

The licence service

The vendor-side licence service is a small backend we operate, separate from any Annotide installation, that:

stores the buyer’s email and company name (from Paddle) against the licence it issues, so it can email keys and handle renewals;
answers the calls your own installation makes to it, described in full field-by-field on the Telemetry page: a daily licence refresh (licence id, install id, host, active user count, version) for keyed installations, each of which we log; a weekly heartbeat, on by default and switched off with one setting (install id, version, edition, active user count and a salted-hash organisation fingerprint; no names or email addresses) for any edition; and a trial request, sent only when an administrator starts the 30-day trial (install id and host), after which we keep the install id, the host and the trial dates so the same installation can’t start a second trial; and
when a heartbeat is received, stores a keyed hash of the sender’s network prefix (the IPv4 /24 or IPv6 /48), made with a secret key only the licence server holds — never the full IP address, never the prefix itself, and never a user’s individual IP; and
writes one operational log line per request (time, method, path, response status, duration and the caller’s network prefix, never the full IP address) for security, rate limiting and troubleshooting. It holds the full address in memory for about a minute, for rate limiting, and never stores it.

Nothing the licence service receives includes your annotation data, your users’ names or email addresses, item content, or anything about what your installation’s human users do. It cannot: your installation never sends that to us, by design (docs/LICENSING.md).

Your annotation data — we are not a processor

Annotide is self-hosted software. When you run it, the application, its database and the object storage it reads and writes all run inside your own cloud account or your own infrastructure. R Squared Data Solutions never receives, stores, or has access to the media, annotations, user accounts, or any other data inside your installation.

This means that, under GDPR and equivalent laws, R Squared Data Solutions is not a data processor or sub-processor for your installation’s data — there is no data processing agreement to sign with us for that data, because no processing by us takes place. You, as the operator of your own installation, are the controller (or processor, depending on your own relationship with your end customers) for everything inside it, and your own cloud provider (Azure, AWS, GCP, or your own servers) is your infrastructure provider or processor under your agreement with them, not ours.

The only data that reaches us from an installation is the licence refresh, the heartbeat and, if an administrator asks for one, the trial request described above and on the Telemetry page. None carries your annotation data; the refresh and the heartbeat can be turned off from inside your installation, and the trial request is only sent on request.

Legal basis

We process website request data (above) under legitimate interest: keeping the site and its visitors safe from attacks and abuse, and keeping it working (GDPR recital 49). We process buyer email/company (from Paddle) under contract necessity (to deliver the licence you purchased) and legitimate interest (to prevent licence fraud and handle renewals). We process heartbeat, licence-refresh and trial data under legitimate interest (seeing how many installations an organisation runs so we can offer it the right edition, counting installations by version and edition in aggregate, keeping paid keys current, and granting one trial per installation), kept proportionate by only ever sending hashed, aggregate or non-personal fields — see the Telemetry page for exactly what that is.

Data retention

Licensee email, company name and licence records: for as long as the licence is active, then six years from the end of the calendar year in which it ended, the period the Finnish Accounting Act sets for records of a sale and within which claims about it can still arise.
Purchase notifications from Paddle (the raw event, which can include billing details): 90 days after we have processed them; the licence record above keeps what is needed afterwards.
Heartbeat records: 12 months, then deleted automatically. They are used only in aggregate, to see when several installations belong to one organisation, never to build a profile of an individual.
Licence refresh records (licence, install id, host, active user count, version): 12 months, then deleted automatically.
Trial records (install id, host, dates): three years after the trial ends, so an installation can’t start a second trial in that time, then deleted automatically.
Operational logs of the licence service: 30 days.
Website request data: held only by Cloudflare and Microsoft, under their own retention; we keep no copy.
Emails you send us: as long as needed to answer you and handle any follow-up, and no longer than the licence records they relate to.

Your rights

If you are in the EU/EEA, UK or another jurisdiction with equivalent law, you have the right to:

access the personal data we hold about you;
rectify inaccurate data;
erase your data, subject to our legitimate need to keep licence and tax records;
restrict or object to processing based on legitimate interest;
data portability for data you provided to us; and
lodge a complaint with your local data protection authority — in Finland, the Office of the Data Protection Ombudsman.

To exercise any of these rights, email hello@annotide.com. Requests about your payment data should also be directed to Paddle, as Paddle is the controller for that data.

Who processes data for us

Microsoft (Azure) hosts the licence service and its database in the EU (Sweden Central), hosts the website as described above, and delivers licence-key emails through Azure Communication Services.
Cloudflare delivers and protects the website (not the licence service), as described above, under its Data Processing Addendum.
Our email provider holds the messages you send to hello@annotide.com, under its data processing terms with us.

Paddle is not on this list: it is a separate controller for the payment (see above).

International transfers

R Squared Data Solutions is based in Finland (EU). The licence service and its database are hosted in the EU. The website stores no personal data; the request data its delivery involves can be processed wherever Cloudflare’s network serves you from and in Microsoft’s East US 2 region. Microsoft may access data from outside the EU/EEA (for example for support or security operations) under its Data Protection Addendum, which relies on the EU–U.S. Data Privacy Framework and the EU Standard Contractual Clauses; Cloudflare, a U.S. company, relies on the same two safeguards in its Data Processing Addendum. Paddle may process payment data outside the EU/EEA under its own safeguards — see Paddle’s privacy policy for details.

Changes to this policy

We will post updates to this page with a new “Last updated” date and, for material changes, also email current licence holders.

Contact

R Squared Data Solutions
Business ID (Y-tunnus): 3544515-7
Email: hello@annotide.com