Privacy Policy

Eniyan, Inc., 99 Wall Street #2444, New York, NY 10005, United States, provides the Services. Depending on how you interact with us, we act in one of two roles.

When we decide how your information is used (controller)

We are the controller (or “business,” under United States state privacy laws) of personal information about:

• visitors to our website, including people who use our Product Guide chat assistant or the Discover questionnaire;
• people who hold a Personal Account (PACH 1, the Personal Agent Control Hub);
• people who sign in to an Organization Account (EACH 1, the Enterprise Agent Control Hub), for their own account, sign-in, security and billing information;
• people who contact us for sales, support or partnership purposes, and the business contacts we keep about prospective and current customers.

When we process information for an Organization Account customer (processor)

Organization Account customers use the Services to govern their own Agents, people and consumers. When a customer gives us personal information about its workforce or its consumers so that we can provide the Services to it, we process that information on the customer’s behalf and under its instructions, as its processor (or “service provider”). Examples include employee directory files uploaded for HR reconciliation, member and group data sent by the customer’s identity provider or entitlement feed, the pseudonymous consumer records used in Consumer Delegation, and the people a vendor names to manage a sealed Agent for its own customer. Our Data Processing Agreement governs that processing.

If your information reached us through an Organization Account customer, that customer decides how it is used and is responsible for its own privacy notice. Please direct requests about that information to the customer. If you contact us, we will pass your request to the customer and help it respond.

This policy does not cover the practices of third parties you connect to the Services, such as the AI apps your Agents run in, your identity provider, merchants your Agents buy from, or websites your Agents visit. Their own privacy policies apply.

Information you give us

• Account information: your name, email address, the name of your account or organization, and, if you choose to add them, your job title and phone number.
• Sign-in information: if you choose a password, we store only a one-way hash of it; a password is optional on a Personal Account. If you add a passkey, we store its public key, never the private key, which stays on your device. If you turn on two-step verification, we store its secret in encrypted form. The sign-in links and password reset links we email you are stored only as hashes.
• Agent information: the names and purposes of the Agents you register, the permissions you declare or grant them, the AI model and framework they use, the sites, folders, mail settings and spending limits you set, and the approvals, refusals and other decisions you make about them.
• Content you type into the dashboard: for example notes on a decision, justifications for a permission request, test cases you record for an Agent, and the list of folders you allow an Agent to use. See Section 3 for how test evidence and folder lists are handled.
• Seal and verification submissions: if you apply for a public verification seal for an Agent, the details you declare and the documents you upload for review, such as a system prompt or tool list.
• Communications: messages you send our support, sales or security teams, and the details you give when you request a demo or contact us.

Information collected automatically when you use the Services

• Security and usage records: your IP address, browser user agent, the time of each sign-in, and an audit log of actions taken in your account, such as changes to settings, Agents and permissions. Audit logs are made tamper evident so that you and we can rely on them.
• Agent activity metadata: when your Agents check with the Services before acting, we record which Agent asked, what kind of action it requested, the decision, and the limited metadata described in Section 3.
• Device and diagnostic information: error reports from our website and servers. Before an error report leaves our systems, we remove request bodies, cookies, query strings and most headers.
• Cookies and browser storage: described in Section 6.

Information from your organization and your identity provider

If you use an Organization Account, your organization may connect its identity provider (single sign-on and automatic provisioning) or send us an entitlement feed. These send us your name, email address, account status, and the groups or entitlements you hold. An administrator of your organization may also invite you, assign you a role or department, and upload an HR directory file that includes you.

Information from your devices, through the Local Software

The Local Software sends us limited metadata about what your Agents attempt and what your AI tools are configured to reach. Section 3 lists what it sends and what it never sends.

Information from other companies

• Stripe processes payments for our subscriptions and runs optional identity checks. We receive a customer reference, your plan and invoice status, the brand and last four digits of your card, and the result of any identity check. Stripe holds your full card number; we never receive it. See Section 2A below and our Biometric Information Notice.
• GitHub, only if your organization installs our GitHub app for agent discovery: read-only repository metadata and the contents of the files the app is permitted to read, used to find the Agents in your code.
• Platforms that use Consumer Delegation send us pseudonymous records about their consumers (see Section 1 and Section 2B).

2A. Identity checks

Some features let a person prove who they are with an identity document check run by Stripe Identity: the optional ID check for operator verification, and identity checks a platform may require of its consumers. Stripe collects the document images and, in most configurations, a selfie that it compares with the document photo. We receive the result (whether the document and selfie checks passed, any fraud signals Stripe reports, and Stripe’s reference for its report). We do not receive or store the document images, the selfie, or any facial geometry. We record your consent before the check starts. Operator verification can always be completed without an identity check, for example by a teammate’s approval. Our Biometric Information Notice explains this in detail.

2B. Consumer Delegation

Consumer Delegation lets a platform govern Agents that act for the platform’s own consumers. We do not receive the consumer’s name or email for this feature. Each consumer is represented by a pseudonymous identifier, a keyed hash of the platform’s own customer reference, together with consent records, the limits the consumer set, amounts, counterparties, and the outcome of any approval or identity check the platform requires. The platform is responsible for its relationship with its consumers, and we process this information as its processor.

The Local Software is the eniyan package and its command-line tools that run on your devices: the gates that sit between your AI tools and your files, websites, email and other Agents, and the scanner that lists the AI tools on your computer. It is designed to make decisions on your device and send us only what the Services need to enforce your settings and keep an audit trail.

What it sends

• the Agent and the kind of action it attempted, and whether it was allowed or refused, with the reason as a short code;
• the domain name of a website, the name you gave a folder, or the alias of a mailbox folder, rather than the full address or path;
• one-way hashes that let the Services recognize the same item again without learning what it is;
• for data-protection features, the kind of sensitive data detected and how many times, never the data itself;
• from the scanner on a Personal Account: the names of AI tools and the services they are set up to reach, public host names, and hashes that are salted per device, so the same item on two computers produces different hashes.

What it never sends

• the contents of your files, or full file paths;
• the content of web pages, or full web addresses (query strings are always removed);
• the text of your prompts or of your AI tools' conversations;
• the body of your emails;
• your card number. A payment card you allow an Agent to use is stored only in your device's own credential store (such as the macOS Keychain or Windows Credential Manager) and is never sent to us;
• from the scanner: the contents of configuration files, usernames, command arguments, tokens, passwords or other secrets.

Two things you type that we do store

Two kinds of information are exceptions to the rule above, because you enter them in the dashboard yourself rather than having the Local Software observe them:

• Test evidence. When you record a test case for an Agent, the test prompt and the expected and actual outcomes you type are stored, but only after an administrator of the account acknowledges that this text will be kept. We screen it for patterns that look like card or government identification numbers, keep a hash beside it, and remove the text on a schedule your account sets.
• Folder lists. When you allow an Agent to use certain folders, we store the folder paths you type so the gates on your devices can follow your settings. We never receive the names of files inside those folders.

We use personal information for the purposes below. If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on the legal basis shown for each purpose.

• To provide the Services, including creating and securing your account, registering and governing your Agents, enforcing the permissions and limits you set, routing approvals, running stop switches, and keeping audit logs. Legal basis: performance of our contract with you.
• To bill you and manage trials, renewals, cancellations and refunds. Legal basis: contract; legal obligation for tax and accounting records.
• To keep the Services and our users safe, including detecting abuse, fraud, account takeover and security incidents, rate limiting, and investigating suspected violations of our Acceptable Use Policy. Legal basis: our legitimate interests in security, and legal obligation.
• To communicate with you about your account, security alerts, approvals waiting for you, changes to the Services or these policies, and support requests. Legal basis: contract; legitimate interests.
• To review seal applications and decide whether to publish a verification seal. Legal basis: contract.
• To improve the Services using aggregated or de-identified information about how features are used. We do not use the content of your Customer Data to train AI models. Legal basis: legitimate interests.
• To market our Services to business contacts and people who ask to hear from us. Where the law requires consent, we ask for it, and every marketing email has an unsubscribe link. Legal basis: consent, or legitimate interests for business contacts.
• To run identity checks you or a platform start. Legal basis: your explicit consent, which you can withdraw.
• To comply with law and to establish, exercise or defend legal claims. Legal basis: legal obligation; legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights and you can object (Section 10). Where we rely on consent, you can withdraw it at any time; withdrawal does not affect processing that already took place.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Some features show people advisory signals, such as a risk score or a hint about whether an Agent’s permission request is expected. A person decides what to do with them.

We use a third-party AI model provider, Anthropic, for two features:

• The Product Guide, the chat assistant on our website. It is an automated AI system, not a person. The messages you type are sent to Anthropic to generate a reply. We do not store the text of your messages or of the replies; we keep a one-way hash of your IP address and counts of turns, usage and refused requests, to prevent abuse. Please do not type personal or confidential information into it. Its answers may be wrong and are not legal, financial or professional advice.
• A first-pass review of seal applications. When you apply for a verification seal, the Agent details you declare and the documents you upload are sent to Anthropic for an automated first review that helps our staff. Our staff make every decision about a seal.

Under Anthropic’s commercial terms for its API, information we send through the API is not used to train its models. We do not use Customer Data to train AI models, ours or anyone else’s.

We do not use advertising cookies, and we do not use third-party analytics or tracking tools on our website. We use a small number of cookies and browser storage entries that are strictly necessary for the Services or that remember a choice you made:

• Sign-in: secure cookies or browser storage that hold your session so you stay signed in, and a setting that remembers whether you asked us to keep you signed in. These are strictly necessary.
• Audience preference: a cookie named audience that remembers whether you were looking at our PACH 1 or EACH 1 pages. It lasts one year and holds only that one word.
• Sign-in side: browser storage that remembers which sign-in form you used last.
• Drafts: browser storage that keeps your answers to the Discover questionnaire, and the first Agent name you typed at signup, on your device until you finish. To show you a plan, your questionnaire answers are sent to our servers, used and discarded; they are not stored or logged there unless you create an account, when they become your first assessment.

When you pay or complete an identity check, you use pages hosted by Stripe, which sets its own cookies for security and fraud prevention under its own policy. You can clear or block cookies and browser storage in your browser settings; if you block the sign-in entries, you will not be able to stay signed in.

Our public seal verification pages count how many times a seal was checked each day. They record nothing about the visitor.

We do not sell personal information. We share it only as described here:

• With service providers (sub-processors) that host, secure and support the Services under contracts that limit their use of the information to providing services to us. Our current list is on the Sub-processors page.
• Within your organization. If you use an Organization Account, its administrators can see your account details, your role, and the actions you take in it, including in its audit log.
• On public pages you choose to publish. If you obtain a verification seal for an Agent, its public page shows the details you chose to disclose about that Agent.
• With people you direct us to share with, such as the customer managers a vendor names for a sealed Agent, or a platform that requested a consumer approval.
• For legal reasons, when we believe in good faith that disclosure is required by law, legal process or a government request, or is necessary to protect the rights, property or safety of Eniyan, our users or the public. Where the law allows, we will tell the affected customer before we disclose its data.
• In a business transaction, such as a merger, acquisition, financing, or sale of assets, subject to confidentiality protections and this policy, and with notice to you where required.
• With your consent, or at your direction.

We do not “sell” or “share” personal information as those terms are defined under California law, and we do not use it for targeted advertising or cross-context behavioral advertising. We honor the Global Privacy Control signal as a request to opt out of any sale or sharing.

We keep personal information for as long as your account is active, and for up to seven years after it closes, so that records of what happened in the account remain available for security, dispute resolution, audit and legal purposes. Some categories are deleted or anonymized sooner:

• records your Agents report about their own runs are deleted after 180 days;
• identity-check session records, and records of credentials that have been revoked, are anonymized after five years;
• consent records for identity checks are kept for seven years, as evidence of consent;
• audit logs are kept for seven years;
• HR reconciliation findings and recorded test evidence are deleted on the schedule your organization sets;
• the Product Guide keeps no message text at all (Section 5).

Backups are kept for a limited period and are overwritten on our hosting provider’s schedule. We may keep information longer where the law requires it, where we need it to resolve a dispute or enforce our agreements, or in de-identified or aggregated form that can no longer reasonably be linked to you. Information we process for an Organization Account customer is kept and deleted as our Data Processing Agreement provides.

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, access controls that limit our staff to the information their role requires, sign-in protections such as passkeys and two-step verification, tamper-evident audit logs, and, for the Local Software, keeping secrets in your operating system’s own credential store. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in methods, API keys and Agent credentials secret. If you believe your account has been compromised, contact security@eniyantrust.com.

If a security incident affects your personal information, we will notify you and the relevant authorities as the law requires.

Depending on where you live, you may have the rights below. To exercise them:

• About your Eniyan account (a Personal Account, or your user in an Organization Account): email privacy@eniyantrust.com. If you use an Organization Account, you may also ask an administrator of your organization, who manages that account. You can correct much of your account information yourself in the dashboard.
• About an identity check you took: use our privacy requests page, which finds identity-check records by the email address used for the check, or email privacy@eniyantrust.com.

EEA, United Kingdom and Switzerland

You have the right to access your personal information; to have it corrected; to have it erased; to restrict or object to our processing of it, including processing based on legitimate interests and any direct marketing; to receive it in a portable format; and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

United States

Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with comprehensive privacy laws may have the right to know what personal information we collect and how we use and disclose it; to access it and receive a portable copy; to correct inaccurate information; to delete it; to opt out of its sale, sharing for cross-context behavioral advertising, targeted advertising and certain profiling (we do none of these); and to limit the use of sensitive personal information. You may appeal our decision on a request by replying to our response or emailing privacy@eniyantrust.com with the subject “Appeal”; if we deny your appeal, you may contact your state attorney general.

How we handle requests

We will verify your identity before acting on a request, usually by confirming control of the email address on the account, and may ask for more information where needed to protect your account. You may use an authorized agent; we may ask the agent for proof of your permission and ask you to confirm your identity directly. We respond within the time the law requires, generally one month under European law and 45 days under United States state laws, and we will tell you if we need an extension. We will not discriminate against you for exercising your rights. Some rights have exceptions, for example where we must keep records to comply with the law or to protect the security of the Services; if we decline a request, we will tell you why.

If your information reached us through an Organization Account customer that uses us as its processor, please make your request to that customer (Section 1).

Additional information for California residents

In the past 12 months we collected the following categories of personal information, for the purposes in Section 4, from the sources in Section 2, and disclosed each category for a business purpose to the service providers and recipients in Section 7:

• identifiers, such as name, email address, IP address, account and Agent identifiers;
• customer records, such as phone number and billing references;
• commercial information, such as your plan, subscription history and the purchases your Agents request;
• internet or other electronic network activity, such as sign-in records, audit logs and Agent activity metadata;
• professional or employment-related information, such as job title, role, department and group memberships provided by you or your organization;
• sensitive personal information, limited to account sign-in credentials (stored as hashes or public keys) and the results of identity checks you choose to take. We use it only to provide the Services and keep them secure, and not to infer characteristics about you;
• approximate location inferred from IP address. We do not collect precise geolocation.

We do not sell or share any of these categories, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We keep each category for the periods described in Section 8. Under California’s “Shine the Light” law, you may ask whether we disclosed personal information to third parties for their own direct marketing; we do not.

Eniyan is based in the United States, and we host and process information in the United States. If you are outside the United States, your information will be transferred to and processed there, where the law may differ from the law where you live. When we transfer personal information from the EEA, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the United Kingdom’s International Data Transfer Addendum, and their Swiss equivalents, together with additional safeguards where appropriate. You can request a copy of the relevant safeguards by emailing privacy@eniyantrust.com.

The Services are not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@eniyantrust.com and we will delete it.

We may update this policy as the Services and the law change. We will post the updated policy here with a new “Last updated” date. If a change is material, we will tell you in advance by email or in the dashboard. Where the law requires your consent to a change, we will ask for it.

For questions about this policy or our practices, or to exercise your rights, email privacy@eniyantrust.com (for an identity check, you may also use our privacy requests page), or write to us at Eniyan, Inc., Attn: Privacy, 99 Wall Street #2444, New York, NY 10005, United States. To report a security issue, email security@eniyantrust.com.