Privacy Policy

Annoteer (the “Service”) is a Microsoft Teams meeting extension that enables real-time collaborative document annotation and AI-assisted data extraction. The Service is operated by N.T.I MEASURE (Nicolas Tanala), established in France (collectively “we”, “us”, “our”). This policy explains what information we collect when you use the Service, how we use it, and the choices available to you.

1. Information we collect

1.1 Identity and meeting context

When you open Annoteer inside a Microsoft Teams meeting, Microsoft Teams provides us with the following context, as scoped by your tenant administrator and Microsoft’s consent framework:

• Your Azure AD object identifier (oid) and tenant identifier (tid).
• Your display name and user principal name.
• The meeting identifier, conversation identifier, and your meeting role (organizer, presenter, attendee).
• An Azure AD access token that proves your identity to our servers.

We do not store a long-term user profile. Access tokens are validated on each request and discarded.

1.2 Documents and annotations

• Documents you upload (PDF, PNG, JPG, PPTX, DOCX, XLSX) are stored by us so that other participants can see and annotate the same file, and so that a review can continue after the meeting. They are deleted after 90 days without use (see Section 4).
• Annotations (drawings, text, highlights, sticky notes, shapes) are stored alongside the document so they persist across sessions.
• Ephemeral collaboration state (cursor positions, current page, “follow-me” presenter state) is broadcast to other meeting participants while you are connected, and discarded when you disconnect.

1.3 AI extraction content

If you invoke the AI extraction feature, the content of the document is sent to Anthropic for processing by the Claude API (see Section 3). We do not retain the extraction prompt or response beyond what is needed to return the result to you.

1.4 Technical logs

Our servers log technical information required to operate the service: request timestamps, IP addresses, HTTP status codes, error messages, and performance metrics. We do not use these logs for advertising or profiling.

1.5 Subscription and billing

Annoteer is sold per organization. For each organization we keep an entitlement record keyed on its Azure AD tenant identifier (tid): trial dates, subscription status, and the Stripe customer and subscription identifiers. When someone subscribes, the purchaser’s email address, the tenant identifier, and the number of seats are passed to Stripe. Payment card details are entered directly on Stripe’s checkout page; we never see or store them.

1.6 What we do not collect

• We do not use analytics, tracking pixels, or third-party advertising cookies.
• We do not sell, rent, or trade personal information.
• We do not read the content of Teams chats, channels, or other meetings.

2. How we use information

• To authenticate you and authorize access to documents within your meeting.
• To provide real-time synchronization of annotations between meeting participants.
• To persist documents and annotations so you can continue where you left off.
• To operate, secure, and debug the service (rate limiting, error diagnostics, infrastructure monitoring).
• To process AI extraction requests that you explicitly initiate.
• To manage your organization’s trial and subscription, and to issue invoices.

3. Third-party processors

We share data with the following service providers only to the extent necessary to operate the service:

• Microsoft Azure — hosting and document storage (Azure App Service), subscription records (Azure Table Storage), operational monitoring (Azure Application Insights), and the real-time meeting relay (Azure Fluid Relay) that powers Microsoft Live Share. Governed by the Microsoft privacy statement.
• Microsoft Entra ID (Azure AD) — authentication and single sign-on. Governed by the Microsoft privacy statement linked above.
• Anthropic — AI extraction via the Claude API, when you invoke the extraction feature. Governed by the Anthropic privacy policy. By default, Anthropic does not train models on data submitted through the API.
• Stripe — subscription billing, payment processing, and invoicing. Stripe receives the purchaser’s email address, the organization’s tenant identifier, and payment details entered at checkout. Governed by the Stripe privacy policy.

We do not authorize these processors to use your data for their own marketing or profiling purposes.

4. Data location and retention

• Documents and annotations are stored in Microsoft Azure data centers in the West Europe region.
• A document and its annotations are deleted automatically 90 days after they were last used — uploaded, opened, or annotated. A meeting’s whiteboard is deleted 90 days after it was last drawn on or opened.
• If your organization’s trial or subscription ends, its documents and annotations remain available read-only for 90 days and are then deleted.
• To have your organization’s documents, annotations, and subscription record deleted, contact support@annoteer.app. We delete them within 30 days of the request. Stripe keeps billing records as required by accounting and tax law.
• Technical logs are retained for up to 90 days and then deleted.
• Ephemeral collaboration state (cursor positions, presence) is never persisted.

5. Security

We protect your information with industry-standard controls, including:

• HTTPS/TLS encryption for all network traffic.
• Azure AD-based authentication on every API and WebSocket connection.
• Server-side validation of uploaded file types and sizes.
• Rate limiting and Content Security Policy headers to mitigate abuse.
• Principle-of-least-privilege access to production infrastructure.

No service is perfectly secure. If you become aware of a security issue, please contact us at the address in Section 9.

6. Your rights

Depending on your jurisdiction (including the EU/UK GDPR and the California CCPA), you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your documents, annotations, or account data.
• Export your data in a machine-readable format.
• Object to or restrict certain processing.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at the address in Section 9. We will respond within the timeframes required by applicable law.

7. Children

Annoteer is designed for use in a workplace context and is not directed at children under 16. We do not knowingly collect personal information from children.

8. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the app and reflected in the “Last updated” date at the top of this page.

9. Contact

Questions about this policy or requests to exercise your rights can be sent to: support@annoteer.app.