Legal · 01

Privacy Policy

This Privacy Policy ("Policy") explains how AnySaaS, Inc., a Delaware corporation with its principal place of business at 2261 Market Street #4517, San Francisco, CA 94114, United States ("AnySaaS", "we", "us", "our") collects, uses, discloses, and safeguards Personal Data in connection with:

• the AnySaaS websites at anysaas.ai and its subdomains (the "Site");
• the AnySaaS control plane, documentation, and command-line tooling (the "Platform"); and
• sales, support, marketing, and community interactions (together with the Site and Platform, the "Services").

AnySaaS is designed so that the applications it generates run entirely inside your infrastructure. As a result, we do not have access to the data that end users of your generated applications enter, upload, or transmit through those applications. This Policy addresses only the limited Personal Data we process on our own systems as controller.

1. Scope and roles

For the purposes of the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and analogous laws:

• Site & account data. AnySaaS is the "controller" of Personal Data that visitors, prospects, customers, contributors, and personnel provide through the Site and Platform (e.g., name, work email, billing information, telemetry).
• Deployed-application data. When you deploy a generated application in your infrastructure, you are the controller (and, where applicable, the processor) of the Personal Data that application handles. AnySaaS neither processes nor has access to that data.
• Enterprise managed deployments. If you engage AnySaaS to operate a managed deployment on your behalf under an Enterprise Order Form, AnySaaS acts as "processor" for the Personal Data that deployment handles, governed by our Data Processing Agreement ("DPA"), which forms part of your order.

2. Personal Data we collect

2.1 Information you provide directly

• Account & identity. Full name, work email, organisation name, country, job title, and password hash when you register.
• Billing. For paid plans: billing contact, VAT / tax ID, purchase order reference, and payment card token (we do not store full card numbers; see § 4).
• Communications. Content of sales enquiries, support tickets, community forum posts, and feedback you submit.
• Prompts & project metadata. The plain-language prompts you enter, field definitions, workflows, and role descriptions used by the Platform to generate your container. See § 3.4 for how prompts are used.

2.2 Information collected automatically

• Site telemetry. IP address (truncated to /24 within 24 hours), browser type, device type, referrer, pages viewed, and coarse geolocation (country / region).
• Platform logs. API request metadata (timestamp, endpoint, response code, error signatures) and control-plane audit events (who deployed what, when).
• Cookies. See § 8. We do not use third-party advertising cookies or cross-site tracking pixels.

2.3 Information from third parties

• Single sign-on (SSO). If you sign in via Google, GitHub, or a corporate IdP, we receive your name, email, and IdP-issued unique identifier.
• Billing processor. Stripe (see § 4) returns tokenised payment confirmations and dispute events.
• Publicly-available business data. For sales qualification we may enrich your work email with publicly-listed employer, size, and industry.

2.4 Sensitive categories

We do not intentionally collect special categories of Personal Data (Art. 9 GDPR) or Sensitive Personal Information (as defined under the CPRA). Please do not include such data in prompts, support tickets, or community posts.

3. How we use Personal Data

We process Personal Data for the following purposes and legal bases:

• Provide the Services (Art. 6(1)(b) – contract): create accounts, authenticate you, generate containers, deliver documentation and updates, respond to support tickets.
• Billing and tax compliance(Art. 6(1)(b) & 6(1)(c) – legal obligation): process payments, issue invoices, meet VAT / sales-tax and accounting requirements.
• Security & abuse prevention (Art. 6(1)(f) – legitimate interests): rate limiting, fraud detection, audit logging, incident response.
• Improve the Platform (Art. 6(1)(f)): aggregated and de-identified usage analytics to improve reliability and roadmap decisions.
• Marketing communications (Art. 6(1)(a) – consent, or 6(1)(f) for existing customers in permitted jurisdictions): send product updates, release notes, and event invitations. You may opt out at any time via the unsubscribe link or by emailing [email protected].

3.4 Use of prompts and generated artefacts

Prompts you submit to the Platform are used to generate your requested application and are retained on our systems for up to 30 days to support debugging and re-generation. Prompts are not used to train foundation models. We may use strictly de-identified, aggregated prompt statistics (e.g., "average prompt length", "prevalence of the word 'CRM'") for product analytics.

4. Sub-processors

We engage the following sub-processors to deliver the Services. A current, versioned list is maintained at anysaas.ai/subprocessors. We provide Enterprise customers with at least 30 days' prior notice of new sub-processors via email to the primary account contact.

• Amazon Web Services, Inc. — hosting (US-East, EU-Frankfurt).
• Cloudflare, Inc. — CDN, WAF, DDoS protection.
• Stripe, Inc. — payment processing (PCI DSS Level 1).
• SendGrid (Twilio Inc.) — transactional email delivery.
• Google Workspace — internal email, docs, calendars.
• Zendesk, Inc. — customer support ticketing.
• Datadog, Inc. — infrastructure monitoring, error tracking.
• PostHog, Inc. — self-hosted product analytics (EU region).

5. International data transfers

AnySaaS is headquartered in the United States. Personal Data we collect may be transferred to, stored, and processed in countries outside your country of residence, including the United States. Where we transfer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country the European Commission has not deemed to provide adequate protection, we rely on:

• the European Commission's Standard Contractual Clauses (2021/914);
• the UK International Data Transfer Addendum; and
• the EU–U.S. Data Privacy Framework where applicable to the recipient.

A copy of the safeguards in place is available on request at [email protected].

6. Retention

We retain Personal Data only for as long as necessary for the purposes described above:

• Active account data — for the duration of your account.
• Prompts & generation artefacts — 30 days.
• Site telemetry — 13 months (aggregated after 30 days).
• Support tickets — 24 months after ticket closure.
• Billing & tax records — 7 years, or the minimum period required by applicable law.
• Backups — 35 days rolling; encryption keys rotated quarterly.
• Deleted-account data — hard-deleted within 30 days of account deletion, save for records we are required to retain by law.

7. Security

AnySaaS maintains an information-security programme designed to protect Personal Data commensurate with its sensitivity and the risks presented by its processing. Controls include:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access control with least-privilege enforcement and quarterly access reviews.
• Mandatory multi-factor authentication for all AnySaaS personnel with production access.
• SOC 2 Type II audit programme (reports available under NDA); ISO/IEC 27001 alignment.
• Independent penetration testing at least annually and after major architectural changes.
• Formal secure-development lifecycle, dependency scanning, and container image signing.
• Documented incident-response plan with defined severity levels and notification timelines (see § 9).

8. Cookies and similar technologies

We classify cookies into three categories:

• Strictly necessary — session, CSRF, load balancer affinity. Cannot be disabled.
• Preferences — language, colour scheme, region.
• Analytics — first-party product analytics (PostHog, EU region). Anonymised IPs, no cross-site tracking. You can opt out via the cookie banner or by setting Do-Not-Track.

We do not use third-party advertising cookies, retargeting pixels, or session-replay tools that record end-user input.

9. Data-breach notification

We will notify our supervisory authority of a Personal Data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it, in accordance with Art. 33 GDPR. Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify those individuals without undue delay.

10. Your rights

10.1 EEA / UK / Swiss residents (GDPR / UK GDPR)

Subject to the conditions set out in applicable law, you have the right to:

• request access to and a copy of your Personal Data (Art. 15);
• rectify inaccurate or incomplete data (Art. 16);
• request erasure (Art. 17);
• restrict processing (Art. 18);
• data portability in a machine-readable format (Art. 20);
• object to processing based on legitimate interests or direct marketing (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of prior processing;
• lodge a complaint with your local supervisory authority.

10.2 California residents (CCPA / CPRA)

You have the right to know what Personal Information we have collected about you, to request deletion or correction, to opt out of any "sale" or "sharing" (we do not sell or share Personal Information as defined by the CPRA), and to limit the use of Sensitive Personal Information. You may designate an authorised agent to make requests on your behalf.

10.3 How to exercise your rights

Email [email protected] from the email address associated with your account, or submit a request via the account settings page. We respond within 30 days (extendable by 60 days for complex requests, with notice). We do not discriminate against you for exercising your rights.

11. Automated decision-making

The Platform performs automated content generation but does not make decisions with legal or similarly significant effects concerning you under Art. 22 GDPR. Human review of any automated abuse or fraud-prevention decision is available at your request.

12. Children

The Services are directed to organisations, not to individuals under 16. We do not knowingly collect Personal Data from anyone under 16. If you believe a child has provided us with Personal Data, contact us at [email protected] and we will delete it.

13. Data Protection Officer and EU representative

AnySaaS has appointed a Data Protection Officer, reachable at [email protected].

Our representative in the European Union pursuant to Art. 27 GDPR is AnySaaS EU B.V., Herengracht 420, 1017 BZ Amsterdam, Netherlands ([email protected]). Our UK representative is AnySaaS UK Ltd., 71–75 Shelton Street, London WC2H 9JQ, United Kingdom ([email protected]).

14. Changes to this Policy

We may update this Policy from time to time. If we make material changes we will notify you by email (to the address associated with your account) or by prominent notice on the Site at least 14 days before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was last revised. Prior versions are archived at anysaas.ai/legal/history.

15. Contact

• General privacy enquiries: [email protected]
• Data Protection Officer: [email protected]
• Security disclosures: [email protected] (PGP available)
• Postal: AnySaaS, Inc., 2261 Market Street #4517, San Francisco, CA 94114, USA