Privacy Policy
Last updated: October 20, 2026
Anygraph Inc. and its subsidiaries and group affiliates (“Anygraph,” “we,” “us,” or “our”) are committed to respecting your privacy and protecting any information you share with us. This Privacy Policy explains how we collect, use, share, and process your personal information when you visit our website, use our software, communicate with us, or otherwise interact with Anygraph (the “Service”).
This Privacy Policy applies when Anygraph acts as a controller of personal information. Except where expressly described below, this Privacy Policy does not apply to documents, files, prompts, data, instructions, messages, outputs, or other content that a customer or its authorized users submit to, make available to, or process through the Service, or that the Service generates for them (“Customer Content”). For Customer Content, Anygraph generally acts as a processor or service provider under the applicable customer agreement, including any applicable Data Processing Addendum.
Personal information we collect
We collect personal information when you use the Service or communicate with us. This includes:
- Account information: we collect identifiers, such as your name and email address, to create and administer your account and to communicate with you about the Service.
- Billing and transaction information: we collect billing contact information, invoice details, payment status, and related transaction records. Our payment providers may collect and process payment details to process payments for the Service.
- Communication information: if you communicate with us or provide feedback, we collect your name, contact information, and the contents of any messages you send.
- Usage information: we collect information about your use of the Service, such as the dates and times of access, performance and error logs, and other information about how you use the Service.
We do not knowingly collect sensitive or special category personal information about website visitors, account users, or business contacts, such as genetic data, biometric data for the purpose of uniquely identifying a natural person, health information, or religious information.
Declining to provide information. We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.
How we use personal information
We use personal information for the following purposes:
- To provide, operate, maintain, and support the Service.
- To create, manage, and administer accounts, including authentication, billing, and customer support.
- To respond to your inquiries, demo requests, feedback, and other communications.
- To send you service updates, administrative notices, security alerts, and information about Anygraph where permitted by law.
- To analyze usage, understand our users, debug issues, conduct research, and develop, improve, and add features to the Service.
- To detect, prevent, and investigate fraud, abuse, security incidents, and violations of our terms or policies.
- To comply with legal obligations, resolve disputes, enforce our agreements, and protect the rights, safety, privacy, and property of Anygraph, our users, and others.
How we share personal information
We may share personal information in the following circumstances:
- Vendors and service providers: vendors and service providers that help us provide the Service, including cloud hosting, model inference, logging, analytics, authentication, payments, support, security, and communications providers.
- Customer organizations and administrators: your organization and its administrators, if your account is provided by or associated with an organization.
- Professional advisors: professional advisors, such as lawyers, accountants, auditors, insurers, and financial advisors.
- Legal compliance: government authorities, regulators, courts, or other third parties when we believe disclosure is required by law or necessary to protect the rights, safety, privacy, security, or integrity of the Service.
- Business transfers: parties involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising.
Anygraph maintains the current list of Subprocessors on trust.anygraph.ai.
Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Service and comply with legal obligations. We may retain information in an anonymous or aggregated form where it would not identify you personally.
Retention of records under Anygraph’s control:
| Record | Location | Retention |
|---|---|---|
| Application telemetry (Pydantic Logfire) | Netherlands | 30 days, then deleted automatically. Holds user identifiers and operational metadata, not request bodies or files. |
| Gateway container logs (Railway) | Netherlands | 7 days. |
| Account, workspace, usage, billing, configuration, and library-access records (PlanetScale) | Germany | Life of the account; deactivated within 30 days after the account ends, and deleted within 30 days of a written request. |
| Sign-in identity (WorkOS) | United States | Life of the account; deactivated within 30 days after the account ends, and deleted within 30 days of a written request. |
Security
We implement commercially reasonable technical and organizational measures intended to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction.
Your privacy rights
Depending on where you live, you may have certain rights regarding your personal information, including:
- Right to access: request copies of your personal information.
- Right to rectification: request correction of inaccurate information or completion of incomplete information.
- Right to erasure: request deletion of your personal information under certain conditions.
- Right to restrict processing: request that we restrict processing of your personal information, under certain conditions.
- Right to object to processing: object to our processing of your personal information, under certain conditions.
- Right to data portability: request transfer of your personal information to another organization or directly to you, under certain conditions.
To exercise any of these rights, please contact us at founders@anygraph.ai and include your location (state, province, or country). We will verify your identity before fulfilling requests.
International data transfer
We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.
Notice to European users
General
Where this notice applies. The information in this “Notice to European users” section applies only to individuals in the United Kingdom, the European Economic Area, and Switzerland (together, “Europe”).
Controller. Anygraph Inc. is the controller for the processing of your personal information covered by this Privacy Policy for purposes of European data protection laws. See the “Contact information” section below for our contact details.
Our GDPR representatives. We have appointed the following representatives in the EU and the UK, as required by the EU GDPR and the UK GDPR (together, the “GDPR”). You can also contact them directly.
Our representative in the EU. Our EU representative appointed under the EU GDPR is Euverify Ltd (Ireland). You can contact them by email at gdpr@euverify.com or by mail at Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland.
Our representative in the UK. Our UK representative appointed under the UK GDPR is Euverify Ltd (UK). You can contact them by email at gdpr@euverify.com or by mail at 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom.
Our data protection officer. We have appointed a data protection officer, who independently oversees and advises us on our compliance with the GDPR, including the practices described in this Privacy Policy. You can email our data protection officer at bryan@anygraph.ai.
Our legal bases for processing
For each purpose for which we use your personal information, the GDPR requires us to have a “legal basis” for that use. Our legal bases for processing your personal information described in this Privacy Policy are listed below.
- Where we need to perform a contract we are about to enter into, or have entered into, with you (“Contractual Necessity”).
- Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests (“Legitimate Interests”). More detail about the specific legitimate interests pursued for each purpose is set out in the table below.
- Where we need to comply with a legal or regulatory obligation (“Compliance with Law”).
- Where we have your specific consent to carry out the processing for the purpose in question (“Consent”).
The table below sets out the legal bases we rely on for each purpose for which we use your personal information. For more on these purposes and the information involved, see “How we use personal information.”
| Purpose | Categories of personal information involved | Legal basis |
|---|---|---|
| Service delivery and operations | Account information, billing and transaction information, communication information, and usage information | Contractual Necessity |
| Security | Account information and usage information | Compliance with Law. Legitimate Interests. We have a legitimate interest in ensuring the ongoing security and proper operation of the Service and associated IT services, systems, and networks. |
| Service improvement and analytics | Usage information and communication information | Legitimate Interests. We have a legitimate interest in providing you with a good service that is personalized to you and remembers your selections and preferences. |
| Direct marketing | Account information and communication information | Legitimate Interests. We have a legitimate interest in promoting our operations and goals as an organization and in sending marketing communications for that purpose. Consent, where applicable data protection laws require consent to send a given marketing communication. |
| Compliance and protection | Account information, and billing and transaction information | Compliance with Law. Legitimate Interests. Where Compliance with Law is not applicable, we and any relevant third parties have a legitimate interest in participating in, supporting, and following legal process and requests, including through cooperation with authorities. We and any relevant third parties may also have a legitimate interest in ensuring the protection, maintenance, and enforcement of our and their rights, property, or safety. |
No automated decision-making or profiling
As part of the Service, we do not engage in automated decision-making or profiling that produces legal or similarly significant effects.
Your rights
General. European data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions regarding personal information that we hold:
- Right to object: object to our processing of your personal information where we rely on Legitimate Interests, or where we process it for direct marketing.
- Right to withdraw consent: where we rely on Consent, you can withdraw your consent at any time.
Your right to lodge a complaint with your supervisory authority
In addition to your rights outlined above, if you are not satisfied with our response to a request you make, or how we process your personal information, you can make a complaint to the data protection regulator in your habitual place of residence.
Data processing outside Europe
Where we share your personal information with third parties based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented:
- Transfers to territories with an adequacy decision: we may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the European Commission, the UK Government, or the Swiss Federal Council, as applicable.
- Transfers to territories without an adequacy decision: we may transfer your personal information to countries or territories whose laws have not been deemed to provide such an adequate level of protection. In these cases, we may use appropriate safeguards designed to give your personal information effectively the same protection it has in Europe, such as standard contracts approved by the relevant authorities. In limited circumstances, we may instead rely on an exception, or “derogation,” that permits the transfer without an “adequacy decision” or “appropriate safeguards,” such as your explicit consent to that transfer.
You may contact us if you want further information on the specific mechanism we use when transferring your personal information out of Europe. You may have the right to receive a copy of the appropriate safeguards under which your personal information is transferred by contacting us at founders@anygraph.ai.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date. When required by law, we will notify you of material changes.
Contact information
We encourage you to contact us at founders@anygraph.ai if you have any questions about this Privacy Policy.