Privacy Policy
Last updated: September 25, 2026
anota is a Grupo Barrdega company.
This policy explains what personal data anota collects, why, and what rights you have. It covers both account holders (people who build forms) and respondents (people who fill them out).
What we collect from account holders
- Account data — name, email address, and password hash.
- Billing data — plan, invoices, and payment status. Card details are held by Stripe, never by us.
- Usage data — form counts, submission counts, and product events used to operate plan limits and improve the Service.
What we process for respondents
When you submit a form built on anota, your answers are delivered to the form's owner — they control what is asked and how your data is used. On their behalf we store the submission, a hashed (not raw) IP address for spam protection, and technical metadata such as browser type.
How we use data
To provide and secure the Service, enforce plan limits, send transactional email (notifications, receipts, account messages), and comply with legal obligations. We do not sell personal data, and we do not use form submissions for advertising or to train AI models.
anota also counts anonymous, cookieless visit statistics to improve the site: we never store your IP address, only a hashed identifier that changes every day, and this data is deleted after 13 months.
Who we share data with
Only the processors needed to run the Service: Microsoft Azure (hosting and storage), Stripe (subscription billing), Azure Communication Services (email delivery), and Google (only if you choose to sign in with Google). Each is bound by its own data protection commitments.
Signing in with Google
If you sign in with Google, Google shares your name, email address, and Google account ID with us. We use them only to create your account and sign you in; we never receive your Google password or access any other Google data.
Connected apps, API keys, and webhooks
You can connect AI assistants such as Claude or ChatGPT, and other tools, to your workspace through our API or MCP server, using an API key or, where available, by approving the connection when you sign in. A connected app receives only the forms and responses it requests, limited to the workspace and permissions you granted. What that app then does with the data is governed by its provider's own privacy policy. anota does not receive your conversations with the app, only the requests it sends us. You can revoke an API key or a connection at any time.
If you set up a webhook, each new response to that form is sent to the web address you chose, signed so your system can verify it came from anota. You are responsible for that destination.
Connection records
To keep your workspace secure, for each API key or connected app we keep its name, the permissions granted, and when it was created and last used. For connections you approve when you sign in, we also record who approved them and when they were revoked. These records are kept while the workspace exists and deleted with it.
Retention
Form submissions are kept until the form owner deletes them or their account closes. Closed accounts are retained for 30 days for export, then deleted. Backups age out within 35 days.
Your rights
You may access, correct, export, or delete your personal data. Account holders can do most of this self-service; for anything else write to privacy@anota.cloud. If you submitted data through someone else's form, contact that form's owner first — we will assist them in honoring your request.
Security
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to personnel who need it, and passwords are stored using modern one-way hashing.
Changes
We will announce material changes to this policy by email or in-app notice at least 14 days before they take effect.