Privacy Policy

This Privacy Policy explains how Anchor AI Ltd.,Kibbutz Ga’ash, Israel 6095000 (“Anchor AI”, “we”), collects,uses, and shares personal data when you visit our website athttps://www.getanchor.ai, communicate or interact with our sales and marketing,or use or administer an Anchor account, including as a customer administrator,billing or notice contact, or authorized user (together, the “Services”for purposes of this Policy).

This Policy applies where Anchor AI acts as a controller—that is, where we determine how and why personal data is processed. Where weinstead process personal data on a customer’s behalf as a processor (orservice provider), that processing is governed by our Data Processing Agreement(DPA), not this Policy. The same category of personal data may be Processed indifferent capacities depending on the relevant purpose. For example,information associated with an authorized user may be Processed on a customer’sbehalf to provide access to and enable use of the customer’s workspace, whilelimited account, billing, security and service-administration data may beProcessed by Anchor AI as a controller for the purposes described in thisPolicy.

Platform data is  different. When  our business customers upload, connect, generate or otherwise make data  available through  the Anchor AI  platform, that data may include personal data, and we process it on their  behalf and under their instructions as a processor / service provider. Depending  on how a customer uses the Services, such personal data may include business  contact details, information contained in RFPs, RFIs, security and compliance  questionnaires, proposals and other documents, information obtained from  customer-authorized systems and data sources, and content generated or  submitted within the customer’s workspace. That processing—including the  content customers and their authorized users generate within the platform—is  governed by our Data Processing Agreement, not this Policy. If your personal  data was provided to the platform by a company you deal with, please contact  that company; we will, where appropriate, refer you to them.

1.Personal Data We Collect

We collect personal data directly from you,automatically when you use or interact with the Website or Services, from theorganization that provides you with access to the Services, from serviceproviders and integration partners, and from publicly available sources andbusiness-data providers.

The categories of personal data we collect include:

•    Contactand identity data: name, business email, phonenumber, job title, and company, e.g., when you book a demo, contact us, orsubscribe to communications.

•    Accountdata: if you register, your name, email, username,and authentication data, including identifiers from a social or SSO login youchoose to use (e.g., Google, LinkedIn).

•    Billingand transaction data: billing contact details,billing address, tax and company information, invoices, payment status,transaction details, and limited payment-method information received from ourpayment service providers. We do not directly store complete payment-card detailswhere payments are processed by a third-party payment provider.

•    Communications: the content of your messages, support requests, survey responses,and records of your interactions with us including any files, screenshots orother materials you choose to provide.

•    Usageand device data: IP address, device and browserinformation, identifiers, pages viewed, and activity on the Website, collectedvia cookies and similar technologies (see our Cookie Policy).

•    Marketingand inferred data: engagement with ourcommunications and limited information from analytics and business-datapartners used to identify organizations interested in our Services.

We do not seek to collect special categories of personaldata through the Website. Where information is aggregated or de-identified suchthat it no longer identifies you, and cannot reasonably be used to re-identifyyou, we may use it for any lawful purpose. We will not attempt to re-identifysuch information.

Unless otherwise stated, you are not legally requiredto provide us with personal data. However, certain personal data is necessaryfor us to respond to your request, create or administer an account, process atransaction, or provide the relevant Services. If you do not provide such data,we may be unable to perform the applicable action or provide the relevantService.

2.How and Why, We Use Personal Data

We use personal data to provide and respond to yourrequests and inquiries; set up and manage accounts; process and send invoicesand communications; operate, secure, and improve the Website and our Services;conduct marketing and advertising (subject to your choices); maintain securityand prevent fraud; and comply with legal obligations. Where the GDPR or UK GDPRapplies, our legal bases are:

Purpose

Legal basis

Responding to inquiries; providing  requested information

Performance of a contract / steps prior  to a contract; legitimate interests

Operating, securing, analyzing and  improving the Website and Services

Legitimate interests (in operating,  protecting and improving our business and Services)

Marketing communications and advertising

Consent where required; otherwise,  legitimate interests

Creating and managing accounts; billing  and service administration

Performance of a contract, where  applicable; legal obligation; and legitimate interests in managing customer  relationships and administering the Services

Compliance, legal claims, and security

Legal obligation; legitimate interests

3.How We Share Personal Data

We may share personal data with:

• service providers acting on our behalf, includingproviders of cloud hosting, data storage, security, analytics, email, CRM,payment processing, customer support and other business and technical services;

• advertising and analytics partners, subject to yourcookie choices and as further described in our Cookie Policy;

• the customer organization through which you access theServices, its administrators, and other authorized users of the relevantworkspace. Depending on how the customer configures and uses the collaborativefeatures of the Services, personal data and content you submit or makeavailable, including your profile information, comments, contributions, edits,approvals and related activity, may be visible to other authorized users;

• providers of third-party services and integrationsthat you or the relevant customer choose to connect to or use with theServices;

• our affiliates, where reasonably necessary to operateour business and provide the Services;

• professional advisors, auditors, financialinstitutions and insurers;

• competent authorities and other third parties wherereasonably necessary to comply with applicable law or legal process, enforceour agreements, investigate suspected fraud, security incidents or unlawfulactivity, establish, exercise or defend legal claims, or protect the rights,property or safety of Anchor AI, our customers, users or others;

• prospective or actual investors, acquirers,successors, counterparties and their advisors in connection with a financing,merger, acquisition, reorganization, sale of assets or similar corporatetransaction; and

• other third parties at your direction, at thedirection of the relevant customer, or with your consent.

We require service providers acting on our behalf toprotect personal data and to process it only for the purposes for which it wasdisclosed to them, subject to applicable law and appropriate contractualobligations.

4.International Transfers

We operate globally and may transfer personal data to,and process it in, countries other than your own, including Israel and thecountries where our service providers operate. Where we transfer personal datafrom the EEA, UK, or Switzerland to a country without an adequacy decision, weuse appropriate safeguards such as the European Commission’s StandardContractual Clauses and the UK Addendum, together with supplementary measureswhere required. You may request a copy of the relevant safeguards using the contactdetails below.

5.Retention

We retain personal data for no longer than reasonablynecessary for the purposes described in this Policy, including to provide,operate and secure the Services, detect and prevent fraud and securityincidents, comply with legal, regulatory, accounting, audit and insurancerequirements, resolve disputes, and establish, exercise or defend legal claims:

• Account and customer-administration data is generallyretained for the duration of the relevant customer relationship and thereafteras necessary to manage our records, resolve disputes, and establish, exerciseor defend legal claims.

• Inquiry and communication data is retained for as longas necessary to respond to and document the relevant communication and forreasonable follow-up.

• Billing and transaction data is retained for theperiods required under applicable tax, accounting and other legal requirements.

• Marketing data is retained for as long as it remainsrelevant to our business relationship or until you opt out. We may retainlimited information necessary to record and honor your opt-out.

• Usage, device and security data is retained forperiods reasonably necessary to operate, secure, analyze and improve theWebsite and Services.

Retention periods may be extended where reasonablynecessary in connection with a security incident, suspected fraud or unlawfulactivity, an audit or insurance claim, a dispute or legal proceeding, or alegal hold. In such circumstances, we will retain the relevant personal dataonly for as long as reasonably necessary for the applicable matter and willlimit its use accordingly.

When personal data is no longer required, we delete orde-identify it, unless continued retention is required or permitted byapplicable law. Residual copies may remain in routine backup systems for alimited period until deleted or overwritten through our ordinary backup anddisaster-recovery cycles. While retained, such copies remain protected and arenot used for other purposes.

6.Your Rights

Depending on where you live, you may have rights toaccess, correct, delete, or receive a portable copy of your personal data; toobject to or restrict certain processing; to withdraw consent; and to opt outof marketing. To exercise these rights, contact us at privacy@getanchor.ai.We will respond within the time required by applicable law. You may also lodgea complaint with your local supervisory authority. We will not discriminateagainst you for exercising your rights.

To protect personal data and prevent unauthorizeddisclosure, we may request information reasonably necessary to verify youridentity or authority before responding to a request. If we cannot verify youridentity or authority, we may be unable to fulfill the request. Where permittedby applicable law, you may submit a request through an authorized agent, inwhich case we may require evidence of the agent’s authority to act on yourbehalf.

6.1 EEA/UK/Swiss residents. You have the rights described above under the GDPR, UK GDPR, andFADP, including the right not to be subject to a decision based solely onautomated processing that produces legal or similarly significant effects.

6.2 US state residents (including California).

Depending on your state of residence and subject toapplicable law, you may have the right to: (i) confirm whether we process yourpersonal data; (ii) request access to and a copy of your personal data; (iii)request correction or deletion of your personal data; (iv) obtain certainpersonal data in a portable format; (v) opt out of the sale or sharing ofpersonal data, targeted advertising, or profiling in furtherance of decisionsthat produce legal or similarly significant effects; and (vi) limit certainuses and disclosures of sensitive personal data. You may also have the right toappeal our refusal to act on a request. These rights are subject to applicableexceptions and limitations.

We will not discriminate against you for exercising yourprivacy rights. You may submit a request or appeal by contacting us at privacy@getanchor.ai. You mayalso exercise applicable opt-out rights through the “Do Not Sell or Share MyPersonal Information” or “Cookie Settings” control available on our Website.

7.Direct Marketing

We may send you marketing communications about ourServices where permitted. You can opt out at any time by using the unsubscribelink in our emails or contacting us. We may still send you non-promotionalservice messages (e.g., about security or important changes).

8.Cookies and Tracking

We use cookies and similar technologies as described inour Cookie Policy. Where required, we obtain consent for non-essentialcookies through our cookie banner, and you can change your choices at any timevia “Cookie Settings.”

9.Security

We maintain administrative, technical, and physicalsafeguards designed to protect personal data. No method of transmission orstorage is completely secure, and we cannot guarantee absolute security.

10.Children

The Services are not directed to children, and we do notknowingly collect personal data from anyone under 18. If you believe a childhas provided us personal data, contact us and we will delete it.

11.Changes; Contact

We may update this Policy from time to time to reflectchanges in our practices, Services or legal requirements. Unless otherwisestated, an updated Policy will become effective when posted on our website andwill apply from the next time you access, use or otherwise interact with theWebsite or Services. We will indicate the date of the latest update at the topof the Policy. Where applicable law requires additional notice or consent inrelation to a material change, we will provide such notice or obtain suchconsent as required. For questions or requests, contact privacy@getanchor.ai, or AnchorAI Ltd., Kibbutz Ga’ash, Israel 6095000.

‍