Effective date: September 13, 2026 · Version 3.0 · Supersedes version 2.1 of March 2, 2026
1. Who we are
AnterisLab is a product operated by SAASDEVSOLUTIONS LTD, a company registered in England and Wales, Company Number 17362476, with its registered office at 167-169 Great Portland Street, 5th Floor, London, United Kingdom (“we”, “us”). We are the controller for the personal data described in this policy. Our contact address for privacy matters is privacy@anterislab.com.
2. What we collect
- Account data — name, work email, company, role, authentication identifiers issued by your identity provider.
- Billing data — plan, invoice history and tax identifiers. Card details are handled by our payment processor and never reach our systems.
- Service data — decision requests you send to the API, the policies you author, and the resulting audit records. Decision context may contain personal data that you choose to include; you remain the controller of that content.
- Technical data — IP address, user agent, timestamps and error diagnostics, used for security and reliability.
- Site analytics — aggregated, cookie-free page counts. No cross-site identifiers, no fingerprinting, no advertising profiles.
3. Why we process it
- To provide and operate the service, including evaluating and recording agent actions.
- To authenticate users and protect the service against abuse, fraud and unauthorized access.
- To bill you and meet our accounting obligations.
- To respond to support requests, security reports and legal requests.
- To improve reliability and performance, using aggregated and de-identified measurements.
4. Legal bases
We rely on performance of a contract (providing the service you signed up for), legitimate interests (securing the service, preventing abuse, improving reliability), legal obligation (tax and accounting records) and consent (which you may withdraw at any time) for optional communications. To withdraw consent, click the unsubscribe link in any optional email, or write to privacy@anterislab.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and does not affect processing based on other legal bases (such as contract or legal obligation).
5. Retention
| Data | Default retention |
|---|---|
| Decision context | 30 days (configurable 7–365 days) |
| Audit records | Contract term, then 90 days |
| Account & billing records | Term of contract plus statutory period |
| Security logs | 12 months |
6. Sharing
We do not sell personal data. We share it only with sub-processors that operate the service under written data-processing terms (see Compliance — Sub-processors), and where legally compelled, with authorities after validating the request.
7. Your rights
Subject to applicable law you may request access, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interests. Write to privacy@anterislab.com; we respond within 30 days. You may also lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local supervisory authority if you are in the EEA. As a UK-registered controller we are registered with the ICO and are subject to the UK GDPR.
8. International transfers
Customer data is stored in the European Union (Ireland). Our application and edge delivery run on Vercel in the United States, so requests are served in the US while the database and its backups remain in the EU (Ireland). Where personal data is transferred outside the UK or the EEA — including to the United States for application hosting and for billing — we rely on the UK International Data Transfer Addendum and the European Commission Standard Contractual Clauses, together with supplementary technical measures including encryption in transit and at rest. Where an importer is certified under the EU-US Data Privacy Framework, that framework is relied on in the first instance for transfers from the EEA.
9. Security
We apply the controls described on our Security page, including encryption, least-privilege access, rate limiting and tamper-evident audit logging. No system is perfect; if a breach affecting your data occurs we will notify you and the competent authority within 72 hours of becoming aware.
10. Contact
SAASDEVSOLUTIONS LTD — Privacy Office · 167-169 Great Portland Street, 5th Floor, London, United Kingdom · Company Number 17362476 · privacy@anterislab.com