Privacy Policy

Enkeon stores memory on behalf of the people who build on it. This explains exactly what we hold, where it lives, and what you can demand of us.

Original effective date 21 July 2026Updated 23 October 2026Version v2026-10-23

Contents

1. Our two roles

Enkeon plays two different roles, and the distinction decides which rights apply to whom. Reading this section first will make the rest of the document make sense.

Role	Data	Who to ask
Controller	Your account with us: email, handle, organisation, billing records, and how you use the Console.	Us, directly. This policy governs it.
Processor	Customer Content — the memories, documents and facts you or your end-users store in a project.	The customer who operates the application. We act only on their instructions.

If you are an end-user of an application built on Enkeon and you want your memories corrected or deleted, the operator of that application is your first point of contact. We will help them act on your request, and our Data Processing Addendum obliges us to.

2. What we collect

The categories below describe account, service and optional measurement data. Customer Content is described separately in section 3.

Data	Why	Notes
Email address	Account creation, verification, service notices, billing receipts.	Stored once per account, plus a copy per linked SSO provider.
Handle and display name	Identifying you in the Console and within your organisation.	Chosen by you.
Password	Authenticating you.	Stored only as an Argon2id hash with a per-password random salt. We cannot read it. Accounts created through Google or GitHub have no password at all.
Session and API tokens	Keeping you signed in; authenticating SDK and API calls.	Stored only as BLAKE3 hashes. The plaintext is shown to you once and never persisted.
Organisation and role	Team membership and access control.
Billing records	Subscriptions, invoices, credit top-ups, tax.	Amounts, status and Stripe identifiers only.
Audit log	Security, abuse investigation, and answering your own 'who did what' questions.	Actor, action, target, result, timestamp.
Site analytics	Understanding which pages are read.	With consent: first-party events containing a daily salted IP hash, approximate geography, referring site and public page path; Google Analytics also processes browser/device information and analytics identifiers.
How you found us	Knowing which campaigns and sites bring the people who sign up.	Kept once with your account when it is made: the campaign tags of the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the name of the site that sent you and the public page you arrived on. No IP address, device identifier or full referring address. Without analytics consent only the signup page itself is read; with it, the first page of your visit is remembered in your browser for up to 30 days. Erased when you delete your account.

Two things we deliberately do not do. We do not record your IP address or browser user-agent against your login sessions — the database columns exist but we pass nothing into them. And we never see, transmit or store payment card numbers: checkout is hosted entirely by Stripe, and no card field of any kind exists anywhere in our systems.

First-party audience measurement uses a salted IP hash that rotates daily. We treat these event records as personal data. Hosting and security providers also process IP addresses and request information to deliver and protect the service; the daily-hash description does not apply to their operational logs or to Google Analytics.

3. Your content and connected workflows

Customer Content includes documents, memories, extracted facts, relationships, questions, saved conversations, chat messages and content imported from authorised connectors. Browser features may submit the context you choose to use. Recording and transcription features process audio and the resulting transcript when you activate them.

Enkeon-E can process shared agent progress, questions, decisions, feedback and proposed procedures where enabled. Review generated answers and procedures before relying on them. You are responsible for notices, permissions and recording consent required for the people whose data you submit, including meeting participants.

Project graphs use per-project engine storage. Shared control-plane storage also holds account records, connector records and chat content. Access depends on project and team permissions; sharing a public agent or embedding it in an application can make the content exposed through that agent available to its users. Check permissions before publishing.

Connecting AI tools.When you connect an AI tool such as Claude, ChatGPT or Cursor to a project — by signing in, or with a project key — the tool can look up and save that project's context. Enkeon receives only what each tool call sends: the words looked up and the text saved. It never receives the conversation itself. Each call is recorded with the tool used, the time, the name of the AI tool and the branch, so you can see in the Console what was read and saved. Saved items are kept like any other Customer Content (see Retention and deletion). You can disconnect a tool from its own settings at any time.

Your content is processed to provide the features you use. It is not a shared public knowledge pool. Project sharing and public-agent access follow the settings you authorise.

4. AI processing and training

Producing memory from your content requires sending parts of it to a large language model for extraction and synthesis. We use Microsoft Azure OpenAI Service for extraction and synthesis, and AWS Bedrock for supported agent model calls. Query text and the content being processed are sent; the results come back into your project.

We do not train or fine-tune any model on Customer Content. We use business API services rather than consumer chat accounts for this processing. Provider retention and abuse-monitoring terms can differ; using a provider does not imply a zero-retention commitment.

One consequence worth stating plainly, because most vendors leave it vague: embedding and reranking — the operations that run over every memory you store — are performed by models that ship inside our own engine and execute on our own infrastructure. No third party receives your memory text in order to embed or rank it.

Enkeon does not make automated decisions that produce legal or similarly significant effects about anyone. If you build such a decision on top of our output, you are responsible for the disclosures and safeguards that attach to it, and our Data Processing Addendum commits us to giving you the information you need.

5. Legal bases (EEA and UK)

Purpose	Basis
Creating and operating your account	Performance of a contract (Art 6(1)(b))
Processing Customer Content	On the instructions of our customer, who determines the basis
Billing, invoicing and tax records	Contract, and legal obligation (Art 6(1)(c))
Security, abuse prevention, audit logging	Legitimate interests — keeping the service and its users safe (Art 6(1)(f))
Service and security emails	Contract
Marketing emails	Consent (Art 6(1)(a)), withdrawable at any time
Analytics cookies and measurement	Consent

7. Processing locations and international transfers

Enkeon uses cloud and database infrastructure including AWS, Microsoft Azure, Neon Postgres, Vercel and Cloudflare to manage project graphs, account data and web traffic. The configured graph and control-plane infrastructure is in Frankfurt, with Azure model processing in Sweden. This is not an EU-only service: the listed audio resource and secondary backup storage are in the United States, and web delivery and security use global edge networks. Other providers may process data outside the EEA. Service administration takes place from India.

The provider list describes these flows. An EU hosting region alone does not establish that all access, support, backups and onward processing stay in the EU.

Where applicable law restricts a transfer, a valid transfer mechanism is required, such as an applicable adequacy decision or Standard Contractual Clauses with the relevant UK provisions and supplementary measures where needed. Contact [email protected] for the safeguards applicable to your deployment. This notice does not certify that a particular provider contract, transfer assessment or residency requirement has been approved for your use.

8. Retention and deletion

Category	Retention and deletion
Project knowledge	Retained while the project is active unless you delete it. Use project and source controls to remove content; deleting an account is a separate operation.
Team and agent chat	Retained according to the organisation’s configured chat policy. The default has no automatic expiry; available policies include 30, 90 and 365 days. Chat expiry does not delete project knowledge or generated procedures.
Account and linked identities	Account closure deactivates the account, overwrites its primary email and handle, erases the password hash and revokes sessions and refresh tokens. Residual profile, linked-provider and historical records may remain; request erasure for a review of those records.
Billing, audit and consent	Retained where necessary for legal obligations, security investigations, disputes and evidence of agreement. The applicable obligation or unresolved matter determines the period; restricted records are not used to reactivate a closed account.
Optional analytics	First-party measurement stores individual event rows, not only aggregates. Consent withdrawal stops future measurement; it does not itself erase existing events. Contact us about access or deletion of retained measurement data.
Backups and provider records	Backup snapshots, object versions and provider logs may outlive deletion from the active service. Their lifecycle and any legal hold determine final removal; deletion is not guaranteed within a single backup cycle.

Owners must remove active projects before account closure. Deleting your account does not erase an organisation’s shared content that other members continue to use. For a coordinated export or deletion request, contact [email protected] before closing access. Backup restoration must preserve deletion instructions rather than reintroduce deleted content into active use.

9. Your rights

Wherever you live, you may ask us to:

Access — get a copy of the personal data we hold about you.
Correct — fix anything inaccurate.
Delete — erase your data, subject to the retention rules above.
Port — receive your data in a machine-readable format.
Object or restrict — challenge processing we base on legitimate interests.
Withdraw consent — at any time, without affecting what was lawful beforehand.
Complain — to us, and to your supervisory authority.

Email [email protected]. We respond within the period required by applicable law. For EEA and UK requests this is normally one month; any permitted extension and its reason will be explained. We may verify identity and explain any lawful exception. We do not discriminate for exercising privacy rights. If your request concerns memories held inside an application built on Enkeon, we will route it to the operator of that application, who controls that data.

10. Regional notices

EEA and UK.You may lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office. You may contact the authority directly; contacting us first is not required.

India. The Digital Personal Data Protection Act 2023 and final Rules 2025 have phased commencement. Statutory obligations and remedies apply as the relevant provisions take effect; this policy does not represent that every DPDP provision is already in force. You can send access, correction, erasure and grievance requests now to [email protected]. We will explain the applicable process and response period.

United States.Residents of California and other states may, where their applicable law covers the service, have rights to know, delete, correct, and appeal a refusal. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no “Do Not Sell or Share” mechanism to offer — we would rather say that plainly than post a link that does nothing. We honour Global Privacy Control signals. Where we handle personal information on a business customer's behalf we act as a service provider and are contractually barred from using it for our own purposes.

Other regions. Your rights and available remedies depend on applicable local law; the same contact address reaches us.

11. Security

All traffic is encrypted in transit with TLS. Production access is subject to deployment access controls.
Passwords are hashed with Argon2id at OWASP-recommended parameters. Session and API tokens are stored only as BLAKE3 hashes with 192 bits of entropy.
Connector access tokens are encrypted at rest with XSalsa20-Poly1305 authenticated encryption. Plaintext never reaches the database.
Project secrets use sealed-box asymmetric encryption: the component that stores them holds only the public key and is cryptographically incapable of reading them back.
Each project is isolated at the container boundary with its own database volume, and each scoped end-user gets a separate store within it.
Our infrastructure providers encrypt data at rest on the underlying storage.

No system is perfectly secure. If you find a vulnerability, please report it to [email protected] — we will respond quickly and we will not pursue good-faith researchers. If a breach affects your personal data we will notify you and the relevant authorities within the time limits the law sets.

12. Cookies, local storage and measurement

Necessary storage supports authentication, session refresh, project navigation and your privacy choices. It includes more than one cookie, as well as local or session storage. Optional audience measurement is separate from storage required to deliver the service.

If you accept analytics, Google Analytics may set analytics cookies and process public-site page views, device information, referring-site information and approximate geography. First-party measurement also records consented visits. Private application routes are excluded from audience measurement. Vercel audience and speed measurement are disabled.

Rejecting analytics prevents these optional measurement components from loading. Necessary delivery, security and operational logs remain. We do not enable advertising cookies or personalised advertising. A browser Global Privacy Control signal is treated as a refusal of optional analytics.

at any time. Your choice is saved for up to twelve months. Withdrawal disables future analytics and clears accessible Google Analytics cookies; it does not automatically delete data previously received by a provider. Email [email protected] for an erasure request.

13. Children

Enkeon is for developers and is not directed at children. You must be at least 16, or the age of digital consent where you live if that is higher, to hold an account. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

14. Changes to this policy

Every version of this document is numbered and dated, and we keep the previous ones. If we make a material change we will email account holders before it takes effect. This policy was last updated on 23 October 2026 and is next scheduled for review by 9 October 2027.

15. Contact

Enkeon is the controller of the personal data described in this policy.

Reason	Address
Privacy, data rights	[email protected]
Grievances (India)	[email protected]
Security reports	[email protected]
Postal	Business postal address awaiting confirmation. Contact the privacy channel above.

We keep every previous version of this document. If you need the text that was in force on a particular date, write to [email protected] and we will send it.