Legal
Privacy Policy
Version: 2026-11-02Effective: November 4, 2026
This policy tells you what personal data Sanning Inc. ("Sanning", "we", "us") collects, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to our websites (sanning.io, docs.sanning.io and verify.sanning.io), the Sanning console (console.sanning.io), our APIs and SDKs (together, the "Services"), and the conversations we have with people who are interested in Sanning.
The short version
- We do not sell personal data. We do not use advertising or tracking cookies, and our websites do not use analytics.
- Our product does not receive the content of what your AI agents do. Your SDK hashes each event on your systems and sends us a signed envelope. It also sends some fields in clear, such as a case id and a run id. The section "Records that customers send us" lists them.
- We publish stamps to a public record. A stamp holds no personal data and does not name an organization or an agent. A stamp cannot be deleted.
- To ask a question, make a complaint or use your rights, email privacy@sanning.io.
Who we are
Sanning Inc. is a Delaware corporation. Our address is 500 Paterson Plank Rd #32854, Union City, NJ 07087, USA. For the personal data this policy describes, Sanning is the controller, except where the section "Records that customers send us" says otherwise.
The law does not require us to appoint a data protection officer for the processing we do, and we have not appointed one. Our privacy contact is privacy@sanning.io.
Two roles: controller and processor
As a controller, we decide why and how we use personal data. This applies to visitors to our websites, people who contact us or meet with us, the people who use the console, and billing contacts.
As a processor (a "service provider" in US terms), we handle personal data for our customers, on their instructions. This applies to any personal data in the records that a customer's agents send us. The customer is the controller of that data, and the customer's own privacy notice applies to it. If you are a person whose data a customer sent us, contact that customer first. We help our customers answer requests about this data.
What we collect and why
The following tables show, for each group of people, what we collect, why, the legal basis under the EU and UK GDPR, and how long we keep it.
Visitors to our websites
| What we collect | Why | Legal basis | How long |
|---|---|---|---|
| Technical data that every web request sends: IP address, browser type, the page requested and the time | To deliver the pages and protect the sites from abuse | Our legitimate interest in running secure websites | Kept by our hosting providers for a short period that they set, then deleted |
| Questions that you type into the documentation assistant on docs.sanning.io | To answer your question | Our legitimate interest in helping you use our documentation | Kept by Mintlify, our documentation host. Do not type personal data into the assistant |
The section "Cookies and similar technologies" lists what the sites store on your device.
People who contact us, book a demo or meet with us
This includes prospective customers, partners and investors.
| What we collect | Why | Legal basis | How long |
|---|---|---|---|
| Your name, work email, company, job title, and what you tell us | To answer you, arrange a meeting and follow up about Sanning | Our legitimate interest in talking with businesses and investors that are interested in Sanning, or steps that you ask us to take before a contract | 24 months after our last contact with you, unless your organization becomes a customer or an investor |
| The booking that you make on our Google Calendar booking page | To arrange the meeting | Same as above | Same as above |
| Notes and a transcript of a call, made with a meeting notes tool | To keep an accurate record of what we discussed | Our legitimate interest in an accurate record. We tell you at the start of the call, and we do not transcribe if you object | Same as above |
| Emails and messages that you send us | To answer you and keep a record of our conversation | Our legitimate interest in running our business | Same as above |
We do not send marketing emails or newsletters. If we start, we will ask for your consent where the law requires it, and every email will have a way to unsubscribe.
People who use the console
If your organization's administrator invited you, we got your name and email address from your organization.
| What we collect | Why | Legal basis | How long |
|---|---|---|---|
| Your name, work email, organization and role | To give you an account and let your organization manage its users | Our contract with your organization, and our legitimate interest in providing the Services to it | Until your organization removes you or its account closes. Then we delete it, except as the following rows say |
| Your password, stored only as an Argon2id hash. API keys, stored only as HMAC-SHA256 hashes | To sign you in and to authorize API calls | Same as above | Same as above |
| Security records: sign-ins, API key use, administrative actions, IP addresses | To protect the Services and investigate misuse | Our legitimate interest in security, and our legal obligations | For as long as we run the Services, because these records form a hash-chained audit trail |
| A record that you accepted a version of our terms: the document, its version, a SHA-256 digest of its text, the time and your IP address | To prove which terms apply | Our legitimate interest in proving our agreements | For as long as the agreement lasts, and after it for the time limits for legal claims |
| Support messages | To help you | Our contract with your organization | 24 months after the request is closed |
| Service emails that we send you (for example invitations, password resets and notices) | To run your account | Our contract with your organization | Until your organization removes you or its account closes |
You must give us an email address to have an account. Without it we cannot sign you in or contact you about your account.
Billing contacts
| What we collect | Why | Legal basis | How long |
|---|---|---|---|
| Billing name, email and address, and tax details | To bill and collect fees | Our contract, and our legal obligations under tax law | As long as tax and accounting law requires, usually up to seven years |
| Card details | To take payment | Same as above | Stripe, our payment processor, holds them under its own terms. We never receive or store full card numbers |
People who verify a pack on verify.sanning.io
The verify page checks a pack inside your browser. The pack does not leave your device. To confirm a stamp on the public record, your browser asks our read service for that stamp. Our read service sees your IP address and the stamp that it was asked for. We use this to run and protect the service, on the basis of our legitimate interest, and our hosting provider keeps the request logs for a short period.
People who follow or message us on social media
If you follow, message or mention Sanning on LinkedIn or X, we see what the platform shows us, such as your name, profile and message. We use it to reply and to understand who is interested in Sanning, on the basis of our legitimate interest. LinkedIn also gives us statistics about visits to our page. For those statistics, LinkedIn and Sanning are joint controllers under LinkedIn's Page Insights terms, and LinkedIn answers requests about them. The platforms' own privacy policies apply to everything else that they do.
People who report a security issue
If you send a report to security@sanning.io, we use your name, email and report to investigate the issue and reply to you. Our legitimate interest in keeping the Services secure is the legal basis. We keep reports for 24 months after the issue is closed.
Records that customers send us
This section describes data that we process as a processor, for our customers.
When a customer's agent records an event, the customer's SDK hashes the event on the customer's own systems. We do not receive the event itself or its content: no prompts, model outputs, tool inputs or outputs, documents or files.
We receive the following:
- The envelope: the hash of the event, the signature, the signing key's public key, the time it was signed, the environment it was signed for (development or production), its format version, an id, and where the event is stored in the customer's own log store. The SDK writes that location as an opaque value unless the customer changes it.
- Sent fields, copied in clear from the event so that the customer can find and group its records: the event type; the agent id; the case id and a chain key; run, conversation, tool call, model response, trace and span ids, and the ids of related events; the time a run started; the outcome status (for example, completed or failed) and its reason; record counts; the name and version of the SDK adapter; and how to read the record, such as its data mode and a list of what was not captured. Each sent field has a fixed format, such as an id, a time, a number or a word from a fixed list.
From the times and links in envelopes and sent fields, we can see the shape of a run: how long steps took, how operations ended and, where both sides of a hand-off use Sanning, which signing key sent a message to which.
The customer chooses its ids. If a customer uses a person's name, a customer number or another personal identifier as a case id or another id, that id is personal data. Our Terms of Service tell customers how to choose them.
We keep envelopes and sent fields while the customer's account is open. Sandbox records are deleted after 30 days. If a sent field is personal data, the customer can ask us to clear it, and we clear it within one month. When a customer's account ends, we clear its sent fields after the retrieval period in our Terms of Service, and we keep its envelopes, which hold no event content, unless the customer asks us to delete them.
What we publish to the public record
At the end of each interval, we publish one stamp for each organization that sent records in that interval. A stamp holds Merkle roots, hashes that commit to all the envelopes that we received from that organization in the interval, with the start and end time of the interval.
A stamp does not name the organization, its agents or any person. Instead, it uses a blinded reference for the organization and for each agent. The same organization and the same agent keep the same blinded reference in every stamp, so stamps from one organization can be linked to each other. A stamp also shows how many agents sent records in the interval and how many records each sent, as counts. A person who holds one of an organization's packs can use it to find that organization's other stamps, and so see when and how much it recorded.
We publish stamps to Arweave, a public network that keeps data permanently. Nobody, including Sanning, can delete or change a stamp after we publish it. Stamps hold no personal data. We never publish envelopes, sent fields or account data.
Who we share personal data with
We share personal data only with the providers that help us run Sanning, and only as they need it to do their work. The following table lists them:
| Provider | What it does for us | Where it processes data |
|---|---|---|
| Railway (with Tigris for file storage) | Hosts the console, the APIs, our databases and our storage | United States |
| Resend | Sends service emails | United States |
| Stripe | Processes payments | United States and other countries |
| Google (Google Workspace) | Email, calendar and the demo booking page | United States and other countries |
| Vercel | Hosts sanning.io and verify.sanning.io | United States and other countries |
| Mintlify | Hosts docs.sanning.io and its documentation assistant | United States |
| Granola | Makes meeting notes and transcripts | United States |
| GitHub | Stores our code and our internal records, including meeting records | United States |
| Anthropic | Provides AI assistants that help us run our business and operate the Services | United States |
We also use other business tools, for example for project tracking and team chat, which can hold names and work email addresses.
We can also share personal data:
- With our professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
- With authorities, when the law requires it, or to protect the rights, property or safety of Sanning, our customers or others.
- With a buyer or investor, if we sell or reorganize our business. This policy continues to apply to your data.
We do not sell personal data, and we do not share it for targeted advertising.
International transfers
Sanning is a US company. We store and process personal data in the United States, and our team works from the United States, Portugal and the United Kingdom. When you give us personal data from the European Economic Area, the United Kingdom or Switzerland, we process it in the United States.
When we give personal data to the providers in the preceding table, we rely on the provider's certification under the EU-U.S. Data Privacy Framework (with its UK Extension), or on the European Commission's Standard Contractual Clauses (with the UK Addendum) in our agreement with the provider. Email privacy@sanning.io for a copy of these safeguards.
A customer that sends us personal data, as the controller of that data, can put the Standard Contractual Clauses in place in a data processing agreement with us. Email privacy@sanning.io to ask for one.
Cookies and similar technologies
We do not set advertising or tracking cookies, and we do not let other companies track you across sites through our websites. The following list shows what our sites store on your device:
- sanning.io: nothing.
- The console: your sign-in session and what you type into filters and the API explorer, kept in your browser's session storage until you close the tab. This is necessary for the console to work. The console also keeps the choices that you make, such as light or dark mode, in your browser's local storage.
- verify.sanning.io: your choice of light or dark mode.
- docs.sanning.io: your display choices and, if you open it, the state of the documentation assistant.
- Other sites that we link to: our demo booking page is on Google's site, and a payment form, if you use one, comes from Stripe. Those companies' cookie policies apply to them.
Because we do not track you across sites, we do not change what we do when your browser sends a Do Not Track or Global Privacy Control signal.
Your rights
Depending on where you live, you can have the right to:
- Get a copy of the personal data that we hold about you.
- Correct personal data that is wrong.
- Delete your personal data.
- Get your personal data in a machine-readable format, and move it to another provider.
- Object to how we use your data, or ask us to use it less. You can always object to direct marketing.
- Withdraw your consent, where we rely on consent. This does not affect what we did before.
- Complain to us, and complain to a data protection authority. In the EU, this is the authority in the country where you live or work (the list of EU authorities). In the UK, it is the Information Commission, which was the Information Commissioner's Office (make a complaint).
People in some US states have similar rights under state law. We answer requests from anyone, wherever they live.
To use a right or to complain to us, email privacy@sanning.io. We confirm who you are before we act. We acknowledge a complaint within 30 days. We answer a request within one month, or tell you why we need more time, as the law allows. You can use an authorized agent where the law allows it. We do not treat you differently because you used a right.
The law limits some rights. For example, we cannot delete a stamp from the public record, and we keep some data for as long as tax law or a legal claim requires.
We do not make decisions about you by automated means that have legal or similarly significant effects on you.
Security
We protect personal data with measures that include:
- Encryption in transit (TLS) for connections to our websites, the console and our APIs.
- Passwords stored only as Argon2id hashes, and API keys stored only as HMAC-SHA256 hashes.
- API keys that carry only the permissions that they are given, with rate limits.
- A hash-chained audit log of administrative and security events.
No system is completely secure. Sanning does not hold a SOC 2 or ISO 27001 certification. If a breach affects your personal data, we tell you and the authorities as the law requires.
Children
The Services are for businesses. They are not for anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you think that we have, email privacy@sanning.io and we will delete it.
Changes to this policy
When we change this policy, we publish the new version with a new version date. If a change is material, we tell account holders by email or in the console before it takes effect. We keep every published version. Email us for an earlier one.
Contact
- Privacy questions, requests and complaints: privacy@sanning.io
- Legal notices: legal@sanning.io
- Post: Sanning Inc., 500 Paterson Plank Rd #32854, Union City, NJ 07087, USA