Privacy Policy

This Privacy Policy explains how Entelligent, a sole proprietorship based in California (“Entelligent”, “we”, “us”), collects, uses, and protects information when you use the Platform.

Account Data. Your email address, a display name, and — for email/password accounts — a bcrypt hash of your password. We never store your password itself. If you sign in with Google or Microsoft we also store the identifier that provider gives us. Access is gated: every sign-up path additionally requires a one-time registration key issued by us.

User Content. Documents you upload, and the messages you send to the Associate assistant. We accept plain-text formats and PDFs only; images and other binaries are rejected. Limits are 20 files per account and 10 MB per file. We do not retain the original file — we extract its text, store that text in chunks with a numeric embedding, and discard the upload.

Usage and Security Data. Server logs, and a record of every sign-in attempt — successful or not — containing the email address submitted, your IP address, your browser user-agent and a timestamp. Research queries are logged with your IP address and user-agent. Support tickets store your name, email, message, IP address and user-agent.

Sign-in Sessions. For each sign-in session we keep the IP address, the browser and device details your browser reports, how you signed in, when the session began and when it was last active, and an approximate location (city, region and country) that we derive on our own server from the IP address using the DB-IP database, and we delete a session 30 days after it ends; you can see and revoke your sessions in Dashboard → Settings → Sessions.

Account Email. We record whether your address is verified. Links we email you carry single-use codes; we store only a one-way hash of each code. While you change your address we hold the new address until you confirm it. For each account email we send we keep the kind of email, the time, a one-way hash of the address and the IP address that requested it. A new-sign-in email contains the IP address, the approximate place and the device of that sign-in.

Waitlist. If you join the waitlist we store your email address, the name and company you give us and when you joined. We email you a confirmation, and our team receives an email with those same details (never your IP address). If we invite you, we email you a sign-up link carrying a one-time registration key; we store only a one-way hash of each key, with when it was issued and which account used it. We record these emails as we record account email.

Cookies and Browser Storage. Strictly-necessary cookies only — see section 13. We use no analytics, advertising or tracking cookies.

We do not intentionally collect special-category personal data, and you should not upload it.

• Provide and maintain the Platform;
• Answer your questions and run research on your behalf, including retrieving passages from documents you uploaded;
• Detect and prevent fraud, automated abuse and unauthorised access;
• Send you account and security email, which the Platform cannot run without;
• Answer a waitlist request: confirm it to you, tell our team, and invite you when we can offer access;
• Respond to your support requests;
• Comply with legal obligations.

While you are signed in, entity names detected in your messages build a private record of the companies you have asked about, linked to your account, which we use to make your own results more relevant. Separately we count how often pairs of companies appear together in prompts across all users; that counter holds no user identifier and no message text.

We do not use your content to train or fine-tune AI models. The Platform contains no training code, and your uploads are not pooled into any shared or community index.

We share data only:

• With service providers processing data on our behalf under written terms — AI model providers, our bot-detection vendors, hosting, error tracking, our email provider (Microsoft, through Microsoft 365), and (if you pay by card) our payment processor;
• For legal compliance — with law enforcement or courts where required;
• With takedown complainants, limited to what is necessary;
• As aggregated or de-identified statistics that cannot reasonably identify you.

We do not sell or share your personal information for advertising, and we operate no advertising or analytics technology.

Section 14 sets out exactly which providers receive your prompts and documents. Our error tracking provider receives crash reports — an error message, a stack trace and the page it happened on — and is configured to receive neither your prompts nor your application-log lines.

Data originating from the EEA or UK may be transferred to the United States under EU Standard Contractual Clauses incorporated into our Data-Processing Addendum. Several providers described in section 14 process data in the United States. Our Microsoft 365 tenant, which sends account email, is registered in the United States.

We state retention as it is actually implemented, including where nothing is deleted automatically:

• Server and access logs, including application logs that may contain email addresses: rotated by size — each service keeps a bounded number of log files and the oldest are overwritten as new entries arrive. We do not currently run a time-based purge of these.
• Operational metrics: deleted after 7 days.
• Database backups: kept 7 days, on the same server, in a directory restricted to the system administrator.
• Sign-in sessions: a session that runs out is recorded as ended when it does, and an hourly job deletes every session 30 days after it ended.
• Account email codes: deleted within 30 days after they are used or expire.
• The record of account emails sent: deleted after 30 days.
• Accounts whose address is never verified: deleted 7 days after creation.
• At our email provider: no copy of the email is kept in our mailbox; Microsoft keeps delivery records (sender, recipient, subject, time) for 90 days.
• Account records, chat transcripts, uploaded document chunks, sign-in attempts, usage logs, support tickets, waitlist entries and registration-key records: retained until deleted on request — no scheduled purge currently runs for these.

Deleted data may persist in the backups above for up to a further 7 days.

Where applicable you may request access, correction, deletion, portability, or restriction of your data, or object to processing. Export and deletion are available in the app under Dashboard → Settings → Security → Account; for every other request, or if you cannot sign in, email support@entelligent.co. We will respond within 30 days.

How these requests work today. Deleting individual uploaded documents is self-service and immediate, from the attachment controls in the Associate composer. Account deletion and data export are self-service and immediate from Dashboard → Settings → Security → Account (or by emailing us). Account deletion removes your account record, sessions, settings, conversations, saved prompts and your private document subgraph, and clears our note on the registration key you used (the key’s record stays, with no link to you). Some records are kept afterwards where we need them for security or legal reasons: sign-in attempt logs (which contain your email address and IP addresses), support tickets, waitlist and enterprise enquiries, the email address recorded on any change request you submitted, and — if you made or approved a change to the knowledge graph — the email address recorded against that change as its provenance. Ask us and we will remove those too.

We use TLS 1.2 or higher in transit, bcrypt password hashing, least-privilege access controls, per-account rate limiting, and account lockout after repeated failed sign-ins.

For accuracy: our databases and backups are not separately encrypted at rest beyond the underlying disk, and we do not currently hold SOC 2 certification or run a scheduled external penetration test. We describe only controls we actually operate.

The Platform is not directed to anyone under 18, consistent with the eligibility requirement in our Terms of Service, and we do not knowingly collect data from children. We do not collect a date of birth, so this is a condition of use rather than a technical control.

We may update this Policy. Changes take effect when we post the revised Policy on this page and update the “Last Updated” date below. We send account email only: confirming a waitlist request and inviting you to create an account, verifying your address, resetting your password, telling you when your password or address changes, and telling you about a sign-in from a new network or device. We do not email you about changes to this Policy; check this page.

Entelligent, Attn: Privacy Officer.
Email: support@entelligent.co

We protect our sign-in, registration, password-reset, verification-link and waitlist forms with two bot-detection services: Cloudflare Turnstile, shown as a visible “Verify you are human” control, and Google reCAPTCHA Enterprise, which runs invisibly and asks you to solve nothing. This site is protected by reCAPTCHA.

When you submit those forms we send your IP address and browser user-agent to Google, and your challenge response and IP address to Cloudflare. Both also receive browser and device characteristics and interaction signals directly from your browser, and may set or read their own cookies. Both services load only on the sign-in screen and the forms it opens, and on the waitlist form once you start filling it in — browsing the rest of the site, including this page, contacts neither of them.

We use this strictly to tell human visitors from automated abuse such as credential stuffing and scripted sign-ups. It is not used for advertising, ad personalisation or profiling. Where the GDPR applies, our legal basis is our legitimate interest in securing accounts.

Who controls this data. Entelligent is the data controller; Google and Cloudflare act as our processors under the Google Cloud Data Processing Addendum and Cloudflare’s Customer Data Processing Addendum. Since 2 April 2026 Google is a processor of reCAPTCHA data rather than an independent controller, so Google’s own consumer privacy policy and terms do not govern this processing — your rights under this Policy do.

We set no advertising, analytics or tracking cookies. Every cookie we set is strictly necessary to operate the service, so no consent banner is required:

• auth_token and refresh_token — keep you signed in. Both are httpOnly, secure and SameSite=Lax, and are not readable by JavaScript.
• oauth_state, oauth_code_verifier and oauth_temp_data — short-lived (10 minute) cookies protecting the Google/Microsoft sign-in exchange against cross-site request forgery.

Your session is a sliding window: signing in issues a one-hour access token, and the cookie is renewed while you remain active, so an idle session ends on its own.

We also use your browser’s local and session storage for functional preferences you chose — theme, selected model and sources, panel sizes, active conversation, and the query you typed before signing in so it can be replayed once afterwards. Your session token is never placed in local storage. The bot-detection services in section 12 may set their own cookies, governed by their terms.

Running the Associate assistant necessarily sends your message — and any passages retrieved from documents you uploaded — to a language model. You should assume your prompts leave our servers. Specifically:

• By default your chat message is processed by Ollama Cloud under our platform account, with a model running on our own server as the fallback.
• If you choose the platform's local model, your message is processed on our own server; a question too large for it, or one it fails to answer, is sent to Ollama Cloud instead, and the answer says so.
• If you choose a hosted model in the composer, your chat message is processed by Scaleway (Paris) instead, with the two platform models above as the fallback. Scaleway is the only outside provider we route chat messages to: its contract commits to zero retention by default and to not using the data to train or improve models. No other language-model vendor receives your message.
• Web search and page-fetch tools send your query, and the page being read, to Firecrawl. General web search also queries DuckDuckGo.
• Six research tool servers receive the queries the assistant sends them: DeepWiki and Hugging Face, which are enabled by default, and Exa, Tavily, GitHub and Context7, which are enabled whenever we hold a platform key for them. All six are enabled today.
• Twenty-four public research and data APIs receive only the search terms plus a generic platform user-agent and contact address, and no user identifier. Two of them — Exa and Tavily — are commercial search vendors rather than public research bodies, and one, Semantic Scholar, restricts what we may pass on.

Embeddings for search are computed on our own server and are sent to no third party.

Your uploaded documents are private to your account. Extracted text and embeddings live in a subgraph belonging to your user record, and retrieval only ever matches documents you uploaded. They are not added to any shared index and are not used to train models.

Our knowledge graph holds information about individuals who are not users of the Platform — typically company executives, founders and board members. This may include name, role, employer, a public profile link, and attributes such as education, past roles and place of residence. For officers, directors and ten-percent owners of listed companies we also hold the transactions and holdings they report to the SEC under Section 16 of the Securities Exchange Act, which the SEC publishes.

We obtain this from public sources including Wikidata, Wikipedia and SEC filings, and from People Data Labs, a commercial data provider, to which we send a person’s name and company in order to retrieve a profile. Our legal basis is our legitimate interest in providing business research about public companies and their leadership.

If you are named in our knowledge graph and want your information corrected or removed, email support@entelligent.co and we will action it. You may also object to the processing.