Privacy Policy — tentus

Effective: June 2, 2026

tentus is a personal knowledge management product built by elmt studio. This policy explains what we collect, why, who we share it with, and the control you have. We've kept it plain on purpose — if anything here is unclear, email us.

1. Who we are

tentus is operated by elmt studio. For any privacy question or request, contact juan@tentus.io.

2. Data we collect

2.1 Information you give us

Email address — when you join the waitlist or create an account.
Profile and preferences — name and the settings you choose, including the tone and context answers captured during onboarding.
Your content — the notes, files, voice memos, and clips you capture. This is yours; we store and process it only to run the service for you.

2.2 Information collected automatically

Product analytics — we use Vercel Analytics (privacy-respecting, no cross-site tracking) to understand which features are used. Analytics are off until you consent via the cookie banner.
Cookies — see Section 6.
Operational logs — authentication events, API requests, and error logs, used to keep the service secure and working.

2.3 Data from connected services

If you connect an integration, we access only what you authorize and only to power features you've asked for:

Google (Calendar and Drive) via OAuth — read-only calendar event details (calendar.readonly), and only the specific Drive files you choose through Google's file picker (drive.file). We never request access to your entire Drive, and we never access Gmail.
Fireflies — meeting transcripts you choose to sync.
Granola — meeting notes (planned; covered here in advance).

You control these connections and can disconnect them at any time.

3. How we use your data

Run the service — store your content, power search and briefings, and let Lumi answer from your own material.
Improve the service — understand usage patterns and fix problems.
Keep it secure — detect and prevent unauthorized access and abuse.
Meet legal obligations — respond to data access and deletion requests.

We do not sell your personal data, and we do not use your content to train third-party AI models.

Google user data. Tentus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data accessed from Google is used only to provide the features you connect it to — it is never sold, never used for advertising, and never used to train AI models. No human reads this data except with your consent, where required for security or to comply with the law, or in aggregated and anonymized form.

4. Service providers we share data with

We rely on a small set of processors, each handling data only to provide their part of the service and under their own terms:

Vercel — hosting and privacy-respecting analytics.
Supabase — database, authentication, and file storage (United States).
Google — OAuth sign-in and, if connected, read-only calendar access and the individual Drive files you pick.
OpenAI — embeddings and audio transcription (Whisper).
Anthropic (Claude) — summarization and Lumi's answers.
Inngest — background job processing.
Resend — transactional and waitlist email delivery.
Granola — meeting notes (planned).

5. Where data is stored and how long we keep it

Location — primarily the United States (Supabase, Vercel).
Protection — encrypted in transit (HTTPS) and at rest by our providers.
Retention — we keep your data until you delete it or close your account. Waitlist emails are kept until launch outreach is complete or you ask us to remove you.

6. Cookies

Essential cookies keep you signed in and are always on.
Analytics and marketing cookies stay off until you opt in through the cookie banner. You can decline and still use the product.

7. Your rights (GDPR & CCPA)

You can:

Access / export your data — in Settings → Privacy where available.
Delete your account and associated data — in Settings → Privacy, or by emailing us.
Opt out of optional processing and analytics — via the cookie banner.
Correct inaccurate information — in-app.

To make a request, use Settings → Privacy or email juan@tentus.io. We respond within a reasonable time, typically within 30 days.

8. Changes to this policy

If we make a material change, we'll tell you by email or an in-app notice before it takes effect.

9. Contact

Questions or requests: juan@tentus.io (elmt studio).