Privacy Policy

Who we are

Enoki is operated by EthicGate BV (enterprise number BE 1035.446.294), Hubert Frère-Orbanlaan 376, 9000 Gent, Belgium. We are the controller of the personal data described here. Contact us at privacy@enokilabs.ai.

Data we collect

• When you request access or contact us: your name and work email, and optionally your phone number and the size of your engineering team.
• When you create an account: your name and email, through Google sign-in or an email address and password.
• As you use Enoki: the workspaces you belong to, your role, and security records such as sign-in events and the related IP address.
• Content you provide: the AI systems you connect and the tests you configure and run.

How and why we use it

Access to Enoki is by invitation, not open sign-up. We use your account data (name and email) to give you access to your organization's workspace and to run the service, and we keep limited security logs, such as sign-in events and IP address, to protect accounts. Our legal basis is our legitimate interest in providing the service your organization has engaged us for. We do not sell your data and we do not use it for advertising.

Where Enoki processes data on your organization's behalf, we do so under our agreement with them, including a data processing agreement.

Signing in with Google

Google sign-in is handled by our authentication provider, Supabase, using only the basic scopes email and profile. Here is how we handle the Google data this provides:

• Data we access: your email address, name, and Google account identifier. We do not access Gmail, Drive, Calendar, Contacts, or any other Google or Workspace data.
• How we use it: to sign you in and identify your Enoki account. We do not use it for advertising.
• How we share it: we never sell it or share it for advertising; only the service providers below process it to run Enoki.
• Storage and protection: stored in our database on Google Cloud in the EU. We never receive your Google password and do not store your Google OAuth tokens; data is encrypted in transit and access is restricted.
• Retention and deletion: kept while your account is active. Email privacy@enokilabs.ai to delete it within 30 days.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We share personal data only with providers that process it on our behalf to run Enoki and our website, under data-processing agreements: hosting and database, authentication, error monitoring, email, product analytics (PostHog, on its European infrastructure), our customer relationship management system (HubSpot, on its European infrastructure, which receives the details you send us when you request access), and AI model inference for the test content you submit. Our core hosting, database, and authentication run on Google Cloud and Supabase in the EU. We do not sell your data. A current list of all our subprocessors is available on request at privacy@enokilabs.ai.

Storage and international transfers

Your account data is stored in the European Union (Google Cloud in region europe-west1, and Supabase in Ireland). Some of our providers are based outside the EU; where personal data is transferred outside the EU or EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We protect data with encryption in transit (TLS), managed secret storage, and access limited to authorized staff.

Retention and deletion

We keep your data for as long as your account is active. To delete your account and its data, email privacy@enokilabs.ai; we remove it within 30 days, except where we must keep limited records to meet a legal obligation.

Analytics

We use PostHog, hosted in the European Union, to see where people get stuck. It sets no cookies and stores nothing on your device, which is why you see no cookie banner.

We record pages viewed, the referring site, and product actions such as an assessment being started. Events may carry the workspace they belong to, never the individual. We never send your name, email or user identifier, the address of any agent you test, any credential, or the content of any prompt, response or finding; our code enforces this with an allowlist.

Our legal basis is our legitimate interest in improving a service we operate (Article 6(1)(f) GDPR). You can object at any time using the contact address below.

Your rights and cookies

You can ask to access, correct, export, or delete your data, or to object to or restrict its processing, by emailing privacy@enokilabs.ai. You can also complain to your local data protection authority. We use only essential cookies needed to sign you in and keep your session; we do not use advertising cookies, and our analytics sets none.

Changes to this policy

We will update this page and the date above when our practices change, and we will notify you of material changes.