Introduction
ANOXY ("we", "our", "us") is a privacy-first text anonymization platform operated by ESKOM AI Sp. z o.o. (NIP: 5253040096), with registered office at ul. Zimna 2/24, 00-138 Warszawa, Poland. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website, API, and related services in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").
Information We Collect
We collect the following categories of personal data:
Account Information
When you create an account, we collect your email address and authentication credentials via our self-hosted identity provider (Keycloak). We do not store passwords directly — authentication is handled via OpenID Connect.
Usage Data
We collect anonymized usage metrics including API request counts, response times, document types processed, and quota consumption. This data is used solely to provide and improve the Service.
Text Data (Processing Sessions)
Text submitted for anonymization is processed in-memory and stored temporarily in encrypted sessions (AES-256-GCM) with a configurable TTL (default: 1 hour). After the session expires, all original text and entity mappings are permanently and irrecoverably deleted. We do not retain, index, or log any PII from processed documents.
Community Plan — Anonymized Training Data (GDPR Art. 6(1)(a)): If you use the free Community plan, your anonymized output (text where all PII has been replaced by non-reversible tokens) is retained for up to 30 days to improve our NER detection algorithms. This processing is based on your explicit consent, which is a condition of the Community plan. The original text containing real personal data is never stored. You may withdraw this consent at any time by upgrading to a paid plan or deleting your account (GDPR Art. 7(3)), upon which all training data is immediately and permanently erased (Art. 17).
How We Use Your Data
We process your personal data based on the following legal bases (GDPR Art. 6):
- Contract performance (Art. 6(1)(b)): To provide the anonymization service, manage your account, and process billing
- Legitimate interest (Art. 6(1)(f)): To monitor service health, detect abuse, and improve the platform
- Legal obligation (Art. 6(1)(c)): To comply with tax and financial regulations for billing records
- Consent (Art. 6(1)(a)): For optional training data contribution and marketing communications
Data Retention
Processing sessions: Automatically deleted after TTL expiry (default: 1 hour)
Community plan anonymized data: Retained for up to 30 days for AI training, then automatically deleted
Account data: Retained while your account is active, deleted within 30 days of account closure
Usage logs: Retained for up to 90 days, then aggregated or deleted
Audit logs: Retained for 1 year (365 days) for security purposes
Billing records: Retained as required by Polish tax regulations (5 years)
Third-Party Services
We share data with the following processors:
- Stripe (payment processing) — processes billing information under their own privacy policy
- Sentry (error monitoring, EU region) — receives anonymized error reports with PII scrubbed
We do not sell your personal data. We do not share your data with advertising networks.
Your Rights (GDPR Art. 12-22)
Under GDPR, you have the following rights:
- Right of access (Art. 15): Request a copy of your personal data
- Right to rectification (Art. 16): Correct inaccurate personal data
- Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interests
- Right to restrict processing (Art. 18): Request limitation of data processing
- Right to withdraw consent (Art. 7(3)): Withdraw consent at any time for consent-based processing
To exercise your rights, contact us at anoxy@eskom.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority (UODO — Urząd Ochrony Danych Osobowych).
International Data Transfers
Your data is processed and stored within the European Union (servers located in Germany). We do not transfer personal data outside the EEA. Third-party processors (Stripe, Sentry) maintain EU-region data processing.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email at least 30 days before taking effect. The "Last updated" date at the top indicates when the policy was last revised.
Contact & Data Protection
Data Controller: ESKOM AI Sp. z o.o.
ul. Zimna 2/24, 00-138 Warszawa, Poland
NIP: 5253040096, KRS: 0001163211
Email: anoxy@eskom.ai
Phone: +48 22 100 55 80
Supervisory Authority: UODO (Urząd Ochrony Danych Osobowych)
ul. Stawki 2, 00-193 Warszawa
Website: uodo.gov.pl
This Privacy Policy complies with the EU General Data Protection Regulation (GDPR) and applicable Polish data protection laws.
Data Protection Officer: anoxy@eskom.ai