Privacy Policy

Ena (“we,” “us,” “our”) is a product of Ena Intelligence. We provide an AI client concierge for entrepreneurship support organizations (ESOs), accelerators, incubators, and economic development organizations to help them support their entrepreneurs and small-business clients. The product is hosted at ena.chat; our company site is enaintelligence.com.

This policy explains what data we collect, how we use it, who we share it with, and the rights you have over your information. If you have any questions, email privacy@enaintelligence.com.

Most of the data we hold is on behalf of an organization customer (an ESO that has licensed Ena). For that data, the organization is the data controller and we are the data processor — the organization decides how the data is used and we act on its instructions.

A smaller amount of data we hold directly, as a controller — for example, account-creation information for staff members and administrators who sign up for Ena, and the contents of any support request you send us. The sections below distinguish the two where it matters.

• Provide the product to the organization that licensed it — running the AI concierge, generating summaries and memories, scheduling meetings, sending warm-intro emails when an entrepreneur and coach decide to introduce a third party.
• Generate analytics and reporting for the organization’s admins about their own clients and resources.
• Authenticate users and keep accounts secure.
• Improve product reliability and detect abuse. We do not train large language models on customer content. Conversations, transcripts, documents, and meeting summaries are not fed back into model training, by us or our LLM providers (we use providers whose terms forbid training on API inputs by default).
• Communicate with you about account, billing, security, and product-update matters.

To run the platform we rely on a small set of vendors (“sub-processors”). Each is contractually bound to confidentiality and processes data only on our instructions. By category:

• Cloud database, authentication, and file storage — holds the canonical copy of customer data.
• Application hosting and error monitoring — serves the application; error diagnostics can incidentally include identifiers such as a user id.
• AI model providers — generate summaries, memories, Ask Ena answers, and chat responses, and index uploaded documents for retrieval. Their commercial terms prohibit training on our content.
• Voice and meeting-capture providers — carry audio during voice sessions, and record and transcribe the meetings a coach has opted in to capture.
• Transactional email provider — delivers notifications, warm introductions, and campaign email.

We name the specific company in each category in our data-processing agreement, and we will share the current list with any customer who asks — email privacy@enaintelligence.com.

Services you connect yourself are named here, because you choose them: Google or Microsoft for calendar scheduling (including the Meet or Teams link on a booked meeting), and your own CRM — for example HubSpot or Salesforce — if your organization connects one. A CRM you connect is your organization’s own system, governed by its agreement with that vendor, not ours.

We do not sell personal information to anyone. We do not share data with advertisers. We do not use customer content to train AI models.

The platform is hosted in the United States, and customer data is stored in a US region. Some sub-processors may process data in other regions to deliver their service (for example, meeting capture may run in the recording region the organization selects). If your organization has data-residency requirements, contact us before onboarding so we can configure the workspace accordingly.

• Customer data (conversations, documents, recordings, applications, coach notes) is retained for as long as the organization’s subscription is active and for up to 90 days after termination, after which it is deleted unless the organization has requested earlier deletion or an extended retention.
• Account data for individual users is retained while the account is active and for up to 30 days after deletion.
• Server logs are kept up to 30 days.
• Google OAuth tokens are deleted immediately when a coach disconnects Google or when the staff account is deleted.

You can access, correct, export, or delete your personal data by emailing privacy@enaintelligence.com. If you are a client of an organization using Ena, we will direct your request to that organization’s administrators, who control the data, and assist them in responding. Depending on your jurisdiction (GDPR, CCPA, PIPEDA, etc.), you may also have rights to object to processing, restrict processing, or lodge a complaint with your data protection authority. We honor those rights and will respond within the timelines required by applicable law.

We use industry-standard practices to protect your data: transport encryption (TLS) in transit, encryption at rest on the database and storage layers, row-level security to enforce tenant isolation at the database, OAuth refresh tokens stored encrypted, and least-privilege access for our team. No system is perfectly secure. We disclose security incidents that materially affect customer data without undue delay and in accordance with applicable law.

Ena is a B2B product for adult professionals and entrepreneurs. We do not knowingly collect data from anyone under 16. If you believe a minor has provided information, contact us and we will delete it.

We may update this policy from time to time. Material changes will be announced via email to administrators of organizations using Ena and reflected in the “Last updated” date at the top of this page.

Questions, requests, or complaints related to this policy: privacy@enaintelligence.com.