Enthos AI Privacy Policy

Enthos AI, a product of Masi Enterprises LLC ("Enthos AI," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at enthos.ai, our desktop application, our mobile application, and any related services (collectively, the "Services").

By using Enthos AI, you agree to this policy.

Information We Collect

We collect information in several categories depending on how you interact with our Services.

Information You Provide to Us

Account Information. When you create an account, we collect your name, email address, password (stored in hashed form), and optionally your phone number, profile photograph, and professional title.
Payment Information. When you subscribe to a paid plan, we collect payment information through our third-party payment processor (Stripe, Inc.). We do not directly store your full credit card number, debit card number, or bank account number. We receive and store a tokenized payment identifier, your billing address, and transaction history.
Communications. When you contact us for support, provide feedback, or otherwise communicate with us, we collect the content of those communications, your email address, and any other information you choose to provide.
User Content. We collect content you create, upload, or input into the Services, including text, prompts, instructions, documents, and files you provide for AI processing.
Preferences and Settings. We collect your preferences, settings, and configuration choices within the Services.

Information Collected Automatically

Usage Data. We automatically collect information about how you use the Services, including features accessed, actions taken, frequency and duration of use, error logs, and performance data.
Device Information. We collect information about the device you use to access the Services, including device type, operating system and version, browser type and version, screen resolution, unique device identifiers, and language preferences.
Log Data. Our servers automatically record information when you access the Services, including your Internet Protocol (IP) address, the date and time of your request, referring URL, pages viewed, and actions taken.
Location Data. We collect approximate location data derived from your IP address. We do not collect precise geolocation data unless you explicitly enable such features and provide consent.

Screen Capture Data

If you enable the screen capture feature, we collect visual data from your screen as described in the Screen Capture Data section below. Screen capture is an optional feature that requires your explicit, affirmative consent before activation.

Memory and Context Data

Our Services include a persistent memory feature that stores contextual information to improve your experience over time. This is described in the Memory and Context Data section below.

AI Interaction Data

We collect the content of your interactions with our AI systems, including:

Prompts and instructions you provide to the AI.
AI-generated responses and content.
Conversation history and context used to generate responses.
Metadata about AI interactions, including model used, response time, and quality metrics.

Information from Third-Party Integrations

If you connect third-party services to Enthos AI (such as email, calendar, file storage, or other integrations), we may collect information from those services as necessary to provide the requested functionality. The information collected depends on the specific integration and your authorization settings. We only access information from third-party services that you explicitly authorize.

How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery and Operation

To provide, maintain, and improve the Services.
To process your transactions and manage your subscription.
To personalize your experience based on your preferences, usage patterns, and stored context.
To provide AI-powered features, including content generation, task management, workflow automation, and intelligent assistance.
To process screen capture data for contextual AI assistance (when enabled by you).
To maintain and improve the memory system that personalizes your experience.

Communication

To send you service-related notifications, including account verification, technical notices, updates, security alerts, and support messages.
To respond to your inquiries, comments, and requests.
To send you marketing communications, where you have opted in to receive them. You may opt out at any time.

Safety, Security, and Compliance

To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
To enforce our Terms of Service, Acceptable Use Policy, and other agreements.
To comply with applicable legal obligations, legal processes, and government requests.
To protect the rights, property, and safety of Enthos AI, our users, and the public.

Research and Improvement

To analyze usage patterns and trends to improve the Services.
To conduct research and development on new features and capabilities.
To measure the effectiveness and performance of our AI systems.

Important: We do NOT use your personal content, conversations, screen capture data, or memory data to train AI models. Our AI improvement processes use only aggregated, anonymized, and de-identified data that cannot be linked back to individual users.

We do not sell your personal information. We share your information only in the following circumstances:

AI Model Providers (Sub-processors)

We work with multiple AI model providers to deliver our services. These providers process your data solely to generate responses and do not retain your data after processing. The specific providers used may change as we optimize our services. Data shared with these providers is limited to query text and conversation context necessary to generate responses.

We maintain contractual agreements with each provider that prohibit them from using your data for any purpose other than providing services to Enthos AI, including prohibitions on using your data to train their models.

Service Providers

We share information with third-party service providers who perform services on our behalf:

Payment Processing: Stripe, Inc. processes your payment information.
Infrastructure: Our cloud hosting provider provides server and infrastructure services.
Content Delivery and Security: We use industry-standard CDN and security services to protect and deliver our platform.
Analytics: We may use analytics providers to understand usage patterns. Any analytics data is aggregated and de-identified.
Email: We may use email service providers for transactional and marketing communications.

Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, including to meet national security or law enforcement requirements.

Protection of Rights

We may disclose your information if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers

If Enthos AI is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website of any change in ownership or use of your personal information, as well as any choices you may have.

We may share your information with third parties when you have given us your explicit consent to do so.

Screen Capture Data

What We Capture

When you enable the screen capture feature, our desktop application periodically captures visual data from your screen to provide contextual AI assistance. This may include:

Visual content displayed on your screen, including text, images, application interfaces, and documents.
Metadata about the active application, window title, and screen region.

Screen capture is disabled by default and requires your explicit, affirmative consent to activate.
You may pause or disable screen capture at any time through the application settings.
You may exclude specific applications or windows from capture.
You may view and delete captured screen data at any time.
You will see a visible indicator when screen capture is active.

How We Process Screen Capture Data

Screen captures are processed to extract contextual information (text, application context, task context).
Raw screen capture images are processed locally where possible and are deleted from our servers within seventy-two (72) hours of processing.
Extracted contextual information (not raw images) may be stored in your memory profile to improve service personalization.
We implement automated filtering to detect and exclude sensitive content, including password fields and financial information, where technically feasible.

Your Responsibilities

You are responsible for ensuring that you have the right to capture content displayed on your screen, including content belonging to third parties.
Screen capture may process information belonging to third parties who have not consented to such processing. You should be aware of this when enabling the feature.
If you use Enthos AI in a workplace setting, you must comply with applicable employee monitoring laws and workplace policies.

What We Do Not Do With Screen Captures

We do NOT use screen capture data to train AI models.
We do NOT sell or share raw screen capture data with third parties.
We do NOT process biometric data (facial recognition, fingerprint data) from screen captures.
We do NOT retain raw screen capture images beyond the processing period described above.

Memory and Context Data

What the Memory System Stores

Our persistent memory feature stores contextual information derived from your interactions with the Services, including:

Preferences: Your stated preferences, settings, and working styles.
Factual Context: Information you share about yourself, such as your role, projects, goals, and relationships.
Behavioral Patterns: Observed patterns in how you use the Services, such as preferred workflows and common tasks.
Interaction History: Summaries and key points from your past interactions with the AI.

Purpose

The memory system exists to personalize and improve your experience over time. It allows the AI to:

Remember your preferences and context between sessions.
Provide increasingly relevant and accurate assistance.
Avoid repetitive questions about information you have already provided.
Connect information across your various tasks and projects.

Your Control Over Memory

View: You may view all information stored in your memory at any time.
Edit: You may correct or modify any stored memory entry.
Delete: You may delete individual memory entries or your entire memory at any time.
Export: You may export your memory data in a machine-readable format (JSON).
Disable: You may disable the memory feature entirely, in which case no persistent context will be stored.

Local Data Scoping

Local data is per-user. Each authenticated session on a device has its own local memory vault, scoped to your Supabase user identifier. When a different user signs in on the same device, they cannot read, export, or delete your local memory. Anonymous use (no account signed in) shares a legacy machine-scoped local vault for backwards compatibility; signing in transparently migrates that legacy vault into your per-user vault on first sign-in.

Memory and Third-Party Data

If you share information about other individuals during your interactions, that information may be stored in your memory. This may include names, roles, contact information, or other details about people you interact with. You are responsible for ensuring you have a lawful basis to share such information with the Services.

Memory Retention

Memory data is retained for the duration of your active subscription.
Upon account cancellation, memory data is deleted within thirty (30) days unless you request earlier deletion.
Backup copies of memory data are deleted within ninety (90) days of account cancellation.

AI-Generated Content

Ownership

You retain ownership of all content you create using the Services, including AI-generated content produced in response to your prompts and instructions, to the extent permitted by applicable law.

No Copyright Guarantee

The copyrightability of AI-generated content varies by jurisdiction and is an evolving area of law. Enthos AI makes no representation or warranty that AI-generated content is copyrightable or protectable under intellectual property laws.

Accuracy

AI-generated content may contain errors, inaccuracies, or biases. You are responsible for reviewing and verifying AI-generated content before relying on it or publishing it.

Our Use of AI-Generated Content

We do not claim ownership of AI-generated content created through your use of the Services. We do not use your AI-generated content to train AI models. We may use aggregated, anonymized metadata about AI interactions (such as response quality scores and error rates) to improve the Services.

Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Data Category	Retention Period	Notes
Account Information	Duration of account + 30 days	Deleted upon account closure
Payment Records	7 years	Required by tax and financial regulations
Usage Data	12 months	Aggregated/anonymized after 90 days
AI Interaction Data	90 days (detailed) / 12 months (aggregated)	Individual interactions deleted; aggregated metrics retained
Screen Capture (raw images)	72 hours	Deleted after processing
Screen Capture (extracted context)	Duration of account + 30 days	Stored as memory, subject to memory retention
Memory Data	Duration of account + 30 days	User may delete at any time
Log Data	90 days	Security and troubleshooting
Support Communications	3 years	Customer service records
Marketing Consent Records	Duration of consent + 3 years	Legal compliance

Upon account termination:

Active data is deleted within 30 days.
Backup copies are deleted within 90 days.
We may retain data longer if required by law (e.g., tax records, legal holds, regulatory obligations).

Data Security

We implement appropriate technical and organizational security measures designed to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

Technical Measures

Encryption at Rest: All personal data and user content is encrypted using AES-256 encryption.
Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3.
Access Controls: Role-based access controls with the principle of least privilege. Multi-factor authentication for administrative access.
Network Security: Firewalls, intrusion detection systems, DDoS protection, and network segmentation.
Application Security: Input validation, output encoding, CSRF protection, SQL injection prevention, and regular security testing.
Monitoring: Continuous security monitoring, logging, and automated alerting for suspicious activity.

Organizational Measures

Security awareness training for all personnel with access to personal data.
Confidentiality agreements for all employees and contractors.
Regular security assessments and penetration testing.
Documented incident response procedures.
Vendor security assessments for all sub-processors.

Incident Response

In the event of a data breach that affects your personal information, we will:

Notify affected users without undue delay, and in no event later than seventy-two (72) hours after becoming aware of the breach, where required by applicable law.
Notify relevant supervisory authorities as required by applicable law.
Provide information about the nature of the breach, the data affected, and the measures taken to address it.
Take immediate steps to contain and remediate the breach.

Limitations

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. We encourage you to use strong passwords, enable multi-factor authentication, and take appropriate precautions to protect your account credentials.

International Data Transfers

Data Location

Our primary servers are located in the United States. Your information may be transferred to and processed in the United States and other countries where our service providers operate.

Transfer Mechanisms

For transfers of personal data from the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland to the United States or other countries that have not received an adequacy decision, we rely on the following transfer mechanisms:

Standard Contractual Clauses (SCCs): We have entered into Standard Contractual Clauses approved by the European Commission for transfers to countries without adequate data protection.
UK International Data Transfer Agreement / Addendum: For transfers from the UK, we use the UK Secretary of State's International Data Transfer Agreement or the International Data Transfer Addendum to the EU SCCs.
Supplementary Measures: Where necessary, we implement additional technical, organizational, and contractual measures to ensure an essentially equivalent level of data protection.

Sub-processor Data Locations

Our AI model providers and infrastructure providers are primarily located in the United States. A current list of sub-processors and their data processing locations is available at enthos.ai/legal/sub-processors.

Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

Universal Rights

Regardless of your location, all Enthos AI users have the right to:

Access the personal information we hold about you.
Correct inaccurate personal information.
Delete your personal information (subject to legal retention requirements).
Export your data in a machine-readable format.
Manage your memory data (view, edit, delete individual entries or all data).
Control screen capture settings (enable, disable, pause, exclude applications).
Opt out of marketing communications.

How to Exercise Your Rights

You may exercise your rights by:

Using the privacy controls built into the Services (Settings > Privacy).
Emailing us at privacy@enthos.ai.
Writing to us at: Enthos AI, Attn: Privacy, New Jersey, United States.

We will respond to your request within thirty (30) days. If we need additional time, we will notify you of the reason and extension period (up to an additional 60 days).

Verification

We may need to verify your identity before processing your request. We will ask you to provide information that matches the information we have on file.

Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not deny you services, charge different prices, or provide a different level of quality based on your exercise of privacy rights.

If you are located in the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland, the following additional provisions apply to you under the General Data Protection Regulation ("GDPR") and UK GDPR.

Data Controller

The data controller for your personal data is:

Enthos AI

New Jersey, United States

Email: privacy@enthos.ai

EU/UK Representative

Pursuant to Article 27 of the GDPR, our representative in the European Union is:

[To be appointed before EU launch – required if processing data of EU residents without an EU establishment]

Lawful Basis for Processing

We process your personal data on the following legal bases:

Processing Activity	Lawful Basis	GDPR Article
Account creation and service delivery	Performance of a contract	Art. 6(1)(b)
Payment processing	Performance of a contract	Art. 6(1)(b)
Screen capture processing	Explicit consent	Art. 6(1)(a)
Memory and personalization	Legitimate interest (service improvement)	Art. 6(1)(f)
AI interaction processing	Performance of a contract	Art. 6(1)(b)
Security and fraud prevention	Legitimate interest (security)	Art. 6(1)(f)
Legal compliance	Legal obligation	Art. 6(1)(c)
Marketing communications	Consent	Art. 6(1)(a)
Analytics and improvement	Legitimate interest (improvement)	Art. 6(1)(f)

In addition to the universal rights above, you have the right to:

Restriction of Processing (Article 18): You may request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when the processing is unlawful.
Right to Object (Article 21): You have the right to object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Our AI personalization does not make decisions with legal or similarly significant effects without human involvement.
Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Data Protection Officer

We have designated a Data Protection Officer who can be contacted at:

Email: dpo@enthos.ai

Mail: Enthos AI, Attn: Data Protection Officer, New Jersey, United States

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to the rights and freedoms of individuals, including our screen capture feature and memory/personalization system.

Cross-Border Transfers

See the International Data Transfers section for information about international data transfers and the safeguards we use.

CCPA/CPRA – California Residents

If you are a California resident, the following additional provisions apply to you under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of personal information:

Category (per CCPA 1798.140(v))	Examples	Collected?
A. Identifiers	Name, email, IP address, account name	Yes
B. Personal information per Cal. Civ. Code 1798.80(e)	Name, address, telephone number	Yes
C. Protected classification characteristics	Age (for age verification only)	Limited
D. Commercial information	Subscription records, purchase history	Yes
E. Biometric information	None	No
F. Internet or electronic network activity	Browsing history, usage data, interactions	Yes
G. Geolocation data	Approximate location from IP address	Yes
H. Sensory data	Screen captures (with consent)	Yes (opt-in)
I. Professional or employment-related information	Job title (if provided)	Yes (optional)
J. Non-public education information	None	No
K. Inferences drawn from other PI	Preferences, characteristics, behavior patterns	Yes
L. Sensitive personal information	Account credentials	Yes (limited)

How We Use Personal Information

We use personal information for the business and commercial purposes described in the How We Use Your Information section. We do not use or disclose sensitive personal information for purposes other than those permitted by CCPA Section 1798.121.

We do NOT sell your personal information. We have not sold personal information in the preceding twelve (12) months.

We do NOT share your personal information for cross-context behavioral advertising. We may share personal information with service providers and AI model providers as described in the How We Share Your Information section, solely for business purposes under written contracts that restrict the use of personal information to the specified business purposes.

Your CCPA/CPRA Rights

Right to Know (Section 1798.110): You have the right to request that we disclose the categories and specific pieces of personal information we have collected, the sources, the business purposes for collection, and the categories of third parties with whom we share it.
Right to Delete (Section 1798.105): You have the right to request that we delete your personal information, subject to certain exceptions.
Right to Correct (Section 1798.106): You have the right to request that we correct inaccurate personal information.
Right to Opt-Out of Sale/Sharing (Section 1798.120): While we do not sell or share personal information for advertising, you may submit an opt-out request, and we will honor it.
Right to Limit Use of Sensitive Personal Information (Section 1798.121): You have the right to limit our use of sensitive personal information to purposes permitted by law.
Right to Non-Discrimination (Section 1798.125): We will not discriminate against you for exercising your CCPA/CPRA rights.

How to Submit a Request

Email: privacy@enthos.ai
In-app: Settings > Privacy > My Data Rights
Toll-free (if required): [To be established]

We will verify your identity by asking you to confirm information associated with your account. You may designate an authorized agent to submit a request on your behalf by providing written authorization.

Metrics

We will publish annual metrics regarding consumer requests received, complied with, and denied, as required by CCPA regulations.

New Jersey Data Privacy Act

If you are a New Jersey resident, the following provisions apply under the New Jersey Data Privacy Act ("NJDPA"), effective January 15, 2025.

Your Rights Under the NJDPA

Right to confirm whether we are processing your personal data.
Right to access your personal data.
Right to correct inaccuracies in your personal data.
Right to delete your personal data.
Right to obtain a copy of your personal data in a portable format.
Right to opt out of: (i) the sale of your personal data, (ii) targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

Sensitive Data

Under the NJDPA, we will obtain your consent before processing sensitive data, which includes precise geolocation data, racial or ethnic origin data, religious beliefs, health data, sexual orientation data, citizenship/immigration status, genetic or biometric data, data of known children, and Social Security numbers.

How to Exercise Your NJDPA Rights

You may exercise your NJDPA rights through the same channels described in the Your Privacy Rights section. We will respond within forty-five (45) days of receipt of your request. We may extend this period by an additional forty-five (45) days where reasonably necessary.

Appeals

If we decline to take action on your request, you have the right to appeal. You may submit an appeal to privacy@enthos.ai within sixty (60) days of receiving our decision. We will respond to your appeal within sixty (60) days. If your appeal is denied, you may file a complaint with the New Jersey Division of Consumer Affairs.

Other U.S. State Privacy Laws

We comply with other state privacy laws applicable to our users, including but not limited to:

Virginia Consumer Data Protection Act (VCDPA)
Colorado Privacy Act (CPA)
Connecticut Data Privacy Act (CTDPA)
Utah Consumer Privacy Act (UCPA)
Texas Data Privacy and Security Act (TDPSA)
Montana Consumer Data Privacy Act (MCDPA)

If you are a resident of any of these states, you may exercise your rights by contacting us at privacy@enthos.ai. We will honor your request in accordance with the applicable state law.

Children's Privacy

Age Requirement

Our Services are not directed to children under the age of sixteen (16). We do not knowingly collect personal information from children under 16. If you are under 16, please do not use the Services or provide any personal information to us.

Parental Notification

If we learn that we have collected personal information from a child under 16, we will take steps to delete that information as quickly as possible. If you believe we have collected information from a child under 16, please contact us at privacy@enthos.ai.

COPPA Compliance

For children under 13 in the United States, we comply with the Children's Online Privacy Protection Act ("COPPA"). We do not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent.

Cookies and Tracking Technologies

Types of Cookies We Use

Cookie Type	Purpose	Duration	Can You Opt Out?
Strictly Necessary	Authentication, security, load balancing	Session / Persistent	No (required for service)
Functional	Preferences, language, display settings	Persistent (up to 1 year)	Yes
Analytics	Usage patterns, feature adoption, performance	Persistent (up to 2 years)	Yes
Marketing	Campaign attribution (only with consent)	Persistent (up to 1 year)	Yes

Managing Cookies

Cookie Consent Banner: When you first visit our website, you will see a cookie consent banner that allows you to accept or reject non-essential cookies.
Cookie Preference Center: You may change your cookie preferences at any time through our Cookie Preference Center, accessible from the footer of our website.
Browser Settings: You may also manage cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

Other Tracking Technologies

We may use the following technologies in addition to cookies:

Local Storage: To store user preferences and session data in your browser.
Pixel Tags / Web Beacons: To measure the effectiveness of email campaigns and web pages.
Device Fingerprinting: We do NOT use device fingerprinting for tracking purposes.

Third-Party Services and Links

The Services may contain links to third-party websites or services. This Privacy Policy does not apply to third-party websites or services. We encourage you to read the privacy policies of any third-party services you access through the Services.

When you connect third-party integrations to Enthos AI, you are subject to both our Privacy Policy and the privacy policy of the third-party service. We are not responsible for the privacy practices of third-party services.

Do Not Track Signals

Our Services respond to Do Not Track ("DNT") signals and Global Privacy Control ("GPC") signals. When we detect a DNT or GPC signal from your browser, we will not engage in cross-site tracking or share your personal information for advertising purposes.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last Updated" date.
Notify you by email at least thirty (30) days before material changes take effect.
Provide a prominent notice on our website.
Where required by law, obtain your consent to material changes.

Your continued use of the Services after the effective date of changes constitutes your acceptance of the updated Privacy Policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

Enthos AI

Privacy Inquiries: privacy@enthos.ai
Data Protection Officer: dpo@enthos.ai
General Legal: legal@enthos.ai
Mail: Enthos AI, Attn: Privacy Department, New Jersey, United States
Website: enthos.ai/privacy

For data subject requests, please use the in-app privacy controls (Settings > Privacy > My Data Rights) or email privacy@enthos.ai.

_Effective as of April 10, 2026. Last updated March 27, 2026._