Privacy · Tenuit

What we don’t do

No cookies — the analytics below sets none.
No advertising trackers, and no cross-site tracking. Page views are counted by Cloudflare Web Analytics, which stores no personal profile and keeps aggregate counts for 30 days.
One third-party script — the Cloudflare analytics beacon. Fonts and everything else are served from tenuit.co.
We don’t sell personal information, from this site or from the product. The product shares data only with the providers that run it, listed in the register.

What we collect

If you submit the request-access form, we receive the name, firm, and work email you provide. The form is processed by Formspree, which delivers it to our inbox; we use it only to respond to your request. If you email us directly, we have whatever your email contains.

The form also includes the page you first landed on and any campaign tags in that link, so we know which door you came through. That is stored only in your browser tab and only sent if you submit.

This site is hosted on GitHub Pages. GitHub may log standard request data (such as IP addresses) to operate the service; see GitHub’s privacy statement.

Using Tenuit inside Claude

If your firm turns on the Tenuit connector and you connect it to Claude, Claude reads household records from Tenuit when you ask: names, members and their contact details, account balances, life events, and facts with their sources. What it reads goes into your firm’s own Claude workspace, and from there it is governed by your firm’s agreement with Anthropic and your firm’s Claude settings. For that flow Anthropic is a provider your firm chose, not a processor we engage. Our own use of Anthropic, to run Tenuit’s agents, is listed separately in the register.

What the connector collects and why

Your Tenuit sign-in, so Claude acts as you and sees only what your seat in Tenuit lets you see.
What you ask Claude to look up or file: a household name to find, words to search facts by, and the text of a draft, a noted fact or a follow-up. These are used only to answer that request.
Fact searches by meaning: the words you search with are sent to OpenAI to be turned into numbers that can be compared with your firm’s facts, when your firm has meaning search on. Without it, Tenuit searches by keyword and sends nothing.

Before anything leaves Tenuit through the connector, a pattern check replaces Social Security numbers, card numbers and ID-like numbers in free text with “[withheld]”. Names, contact details and balances are passed on purpose, because they are what you asked for.

What we keep, and for how long

Each connection: who made it, for which app, when, and when it was last used. A connection lasts at most 90 days, and one left unused for 30 days must sign in again. Sign-in tokens are stored only as one-way digests and deleted 30 days after they expire, whether or not they were revoked. The record that the connection existed is kept no longer than six years.
Each household Claude reads, on your firm’s access ledger. The ledger cannot be edited, and is kept no longer than six years.
Each draft, noted fact or follow-up filed from Claude, on your firm’s Record, attributed to the person who asked. These are your firm’s records, kept no longer than six years. An approved draft is archived write-once, for no longer than six years.
Our logs do not record names, search words, questions or draft text.

You can revoke your own connection, and your firm’s admin can revoke anyone’s or turn the connector off for the whole firm. The help page says how.

Google user data

An advisor can connect their own Google account to Tenuit. Each connection is separate, asks for its own permission on Google’s consent screen, and can be disconnected on its own.

Google Calendar. Tenuit reads your upcoming events (title, time, attendees, organiser and meeting link) to find meetings with your clients, prepare a brief for each, and send a notetaker when you ask for one. If your firm turns on calendar write-back, Tenuit adds a link to the brief in the event’s description. It does not create, move or delete events. Tenuit also reads your Google account’s email address, to show which account is connected.
Google Drive. Tenuit lists the folders you choose and imports the meeting transcripts in them, including the ones Google Meet saves, so facts from a meeting can be added to the client’s record. It never writes to, moves or deletes anything in your Drive.
Gmail. Tenuit reads unread messages in your inbox and matches the sender against your firm’s clients. Mail from anyone who is not a client is marked read and left alone. For a client’s message, Tenuit prepares a reply and saves it in your Gmail Drafts, where you review it and send it yourself, then marks the original as read. Tenuit sends a reply on your behalf only if your firm has turned automatic replies on.

How it is processed: to prepare briefs, summaries and drafts, Tenuit sends the relevant message, event or transcript, with the client’s record, to Anthropic’s Claude models. Facts Tenuit saves to a client’s record are also sent to OpenAI to make them searchable. Both are providers that process data for us, under API terms that do not use it to train their models. Meeting audio from a notetaker you send goes to our recording and transcription providers. All of them are listed in the register.

How it is stored: in Tenuit’s database in AWS, encrypted at rest, with message and transcript text encrypted again at the field level. Each firm’s data is kept apart from every other firm’s. Connection tokens are stored encrypted, and our logs do not record message or transcript content.

Who can see it: people at your firm with access to that client. People at Tenuit see it only with your firm’s permission (for example to fix a problem you report), where needed for security, or where the law requires.

Limited Use: Tenuit’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features above. It is not used for advertising, not sold, and not used to train generalised AI or machine-learning models, by us or by our providers.

Disconnecting and deletion: you can disconnect any Google connection in Tenuit’s integrations settings, or remove Tenuit’s access at myaccount.google.com/permissions. Disconnecting revokes the permission at Google, deletes our copy of the connection’s tokens, and stops all further reads. What Tenuit has already imported, such as a transcript or a fact on a client’s record, stays part of your firm’s records, because advisory firms must keep certain records. To have it deleted, ask your firm’s admin, or email hello@tenuit.co, and we will delete it within 30 days, except where your firm or we must keep it by law.

Retention and your rights

Demo-request details are kept only as long as needed to follow up. To have that information corrected or deleted, email hello@tenuit.co and we’ll take care of it.

Client records in Tenuit belong to your firm. Advisory firms must keep books and records for six years under SEC Rule 204-2, so drafts, facts, follow-ups, connector connections and the access ledger are kept no longer than six years, and less if your firm asks us to delete them. Some things are removed sooner, on a schedule:

Custodian and CRM files your firm imports: 90 days after upload.
Meeting recordings: our copy, 90 days. Our notetaker provider, Recall.ai, deletes its copy once ours is saved, and within 72 hours at most.
Rendered previews of drafts: 30 days.
Agent sessions held at Anthropic: deleted 30 days after they end.
Professional associates looked up for a prospect: 90 days, unless an advisor adds one to their list.
Connector sign-in tokens: 30 days after they expire.

Approved artifacts are archived write-once and kept no longer than six years.

Deleting data

Tenuit acts on a household’s data only on its firm’s instructions, so a deletion request comes from the firm, in writing, to hello@tenuit.co. Within 30 days of it, we remove the firm’s or the household’s data from our live systems and instruct our providers to delete their copies. Meeting recordings and transcripts are deleted like any other data. What we keep:

Records the firm must keep under SEC Rule 204-2: the Record (the firm’s tamper-evident history, which holds ids, not names), the access ledger, and the archived copies of approved client pieces with their review decisions. Each is kept six years from its own date, then deleted.
Anything under a legal hold, until the hold ends.

Backups and logs are not edited. They expire on their own schedule: daily database backups after 35 days, manual database exports within six weeks, cache snapshots (which can hold encrypted copies of a live meeting’s last few hours of transcript) after 7 days, the monthly copy in a second AWS region after a year, and application logs, which are written to leave out client data but can still carry some, after 365 days. Everything has expired within about 13 months of a deletion. If we ever restore a backup, we apply the deletions again before it is used.

Removing a household in the app hides it; deleting it takes a written request from the firm.

When a firm leaves

The firm gets an export of its records. We then keep those records as its recordkeeper for no longer than six years, unless the firm instructs us in writing to delete them.

The providers that process client data for us, what reaches each and why, are listed in the subprocessor register.

Changes

If this policy changes, the date above changes with it. Questions: hello@tenuit.co.

Privacy policy