Data providers and handling.

What we don’t do.

• —We do not train models on your content, and our agreements with the AI providers above exclude it too.
• —We do not sell data, and there are no advertising or marketing tags, in the product or on public pages.
• —Lumi answers from your material, not the open internet — when it lacks evidence, it says so. Web research is a separate, explicit action.
• —Two-factor authentication is on the roadmap for Pro and Team tiers rather than shipped today — stated plainly here because a security page that hides a gap is worse than one that names it.

Providers we choose.

Infrastructure and AI services tentus itself relies on. Region is where requests are sent; formal region commitments and DPAs are available from privacy@tentus.io.

Supabase

Their policy

Database, authentication, file storage — the app's primary backend.Sees Everything in your workspace: notes, sources, transcripts, calendar metadata, and account records.Region US (AWS us-west-2)·Kept As long as your account exists; deleted content is removed from the live database within 30 days of deletion, longer in encrypted backups that rotate out.

Vercel

Their policy

Application hosting, edge network, and privacy-respecting product analytics.Sees Requests to the app (IP, user agent, timing). Vercel Analytics is aggregate and cookieless.Region Global edge; serverless compute in the US·Kept Request logs rotate on a short window (days), per Vercel's standard retention.

Anthropic (Claude)

Their policy

The primary AI model behind Lumi — answers, summaries, agents, drafts, the free tools.Sees The specific content a request needs: your prompt, the retrieved passages it answers from, and any text the feature is processing.Region US·Kept Processed under Anthropic's commercial API terms, which exclude training on our content. Anthropic may retain inputs briefly for abuse monitoring per their published policy.

OpenAI

Their policy

Embeddings for semantic search, and entity extraction on captured sources.Sees Text sent for embedding or extraction. Embeddings are vectors derived from your content and stored in your workspace. No audio is sent here — transcription moved to ElevenLabs in 2026.Region US·Kept Processed under OpenAI's API terms, which exclude training on API data. Short abuse-monitoring retention per their policy.

TypeSafe (Jev)

Their policy

Decision model used to score how well a retrieved passage answers a query, so search results rank better. It returns a relevance rating and a confidence, never generated text.Sees Result titles and the first few hundred characters of each retrieved passage, plus your query. Only the excerpt judged for relevance is sent — never the whole note or document.Region Not verified. Confirm before enabling — this row was written from the vendor's documentation, which does not state the processing region.·Kept Their legal page commits not to train models on user data, and offers zero data retention for enterprise customers. It publishes no retention period for the standard tier, and this row must not guess one: formal retention and DPA terms are the thing to obtain at privacy@tentus.io before the rerank flag is turned on. Off by default — no request is sent while that flag is unset.

ElevenLabs

Their policy

Real-time speech-to-text in the browser (live dictation and meeting capture).Sees Audio streamed from your microphone for the duration of a recording session.Region US/global·Kept Audio is transcribed in stream; per ElevenLabs' API terms, we do not permit use of your audio for model training.

Soniox

Their policy

Real-time speech-to-text in the Mac app (dictation on desktop).Sees Audio streamed from the Mac app's microphone during dictation.Region US·Kept Per Soniox's API terms; transcription is in stream, training on customer audio is not permitted in our agreement.

Deepgramlegacy

Their policy

Legacy transcription provider — replaced in May 2026.Sees Nothing today. The host remains in our security allowlist from the earlier audio pipeline; no request has been sent since the migration.Region US·Kept Not applicable — no data is sent.

Resend

Their policy

Sending email — waitlist confirmations, free download delivery, digests, receipts, reminders.Sees Your email address and the content of the email being sent (which may quote your own notes in digests).Region US·Kept Delivery logs per Resend's policy; email content is not used for anything but delivery.

Upstash

Their policy

Rate limiting — the counters that stop abuse of public endpoints.Sees IP addresses, endpoint names and, on free download requests, a hash of the email address, as counter keys. No content.Region US/global·Kept Counters expire within their rate-limit window (seconds to hours).

Sentry

Their policy

Error monitoring — so a broken page gets fixed before it is reported.Sees Error reports (stack traces, request paths). We scrub note content and tokens before sending; where possible, only the error's shape leaves.Region US·Kept 90 days per our Sentry plan.

Tally

Their policy

The Founding 100 application form, embedded on /beta — so the questions can change without a deploy.Sees Whatever an applicant types into it: name, email, a professional profile if they give one, and free-text answers about how they work. Each submission is copied into our own database within seconds, but Tally holds it too.Region EU — Tally BV is registered in Belgium and states that data is hosted within the European Union.·Kept Until it is deleted from the Tally workspace. Our own copy in `waitlist` is what the product reads, and it is not deleted when the Tally one is.

Cloudflare Turnstile

Their policy

Bot protection on public forms (waitlist, contact, free tools).Sees Browser signals used to score whether you are human. No cross-site tracking per Cloudflare's design.Region Global·Kept Per Cloudflare's policy; Turnstile is designed to avoid persistent identifiers.

Nango

Their policy

OAuth plumbing for some connectors (Notion, Confluence) — it brokers the authorization handshake.Sees OAuth tokens for connectors you choose to connect, and the requests made through them.Region US·Kept Tokens last as long as the connection exists; disconnecting removes them.

Composio

Their policy

Connects Lumi actions and some read syncs to the apps you choose, and holds the OAuth grants for them.Sees OAuth tokens for apps you connect through it, and the data each action or sync reads from or sends to that app.Region US·Kept Tokens last as long as the connection exists; disconnecting revokes them. Retention of request data is not documented for our tier.

PostHog

Their policy

Product analytics and session replay for people who accept analytics in the cookie banner. For everyone else, anonymous event counts only.Sees With consent: pageviews, clicks and an account ID, with text masked, and never note content. Without consent: an event name and a label such as which download or campaign, with no email, hash or person ID.Region US·Kept 12 months per our plan.

Whop

Their policy

Payment processing for paid plans.Sees Billing details and subscription status. Card numbers go to Whop, never to tentus.Region US·Kept Per Whop's policy and tax requirements.

Sanity

Their policy

The blog's content management — public articles only.Sees Published blog content. No user or workspace data.Region US·Kept Published content lives until unpublished.

Unsplash

Their policy

Image search inside the editor's Insert menu.Sees The search terms you type into the image picker.Region Global·Kept Per Unsplash's policy; queries are not tied to your account.

Google APIs (Calendar, Drive, Identity)

Their policy

Calendar and Drive when you connect them; the Google sign-in button.Sees Only what you authorize: the Drive files you pick, the calendars you connect, and your basic profile at sign-in.Region US/global·Kept Access is live while the connection exists; revoking access (in Google or in tentus) ends it.

Connectors you choose.

These services receive your data only because you connected them, and only what you authorized — a different relationship from the providers above. Everything is revocable: disconnect in tentus, or revoke access on the provider’s own settings page, and the flow stops.

Readwise & Reader

Highlights and your read-later library

RSS feeds

Posts from feeds you subscribe to

Notion

Pages you choose, via Notion's own authorization

Google Calendar & Drive

Calendars you connect; Drive files you pick in the Google file picker

Microsoft 365

Outlook calendars; OneDrive files you pick

Apple iCloud

iCloud Calendar and Mail, via an app-specific password you create and can revoke

Slack

Channels you explicitly add tentus to

Fireflies

Meeting transcripts you choose to bring in

Granola

Meeting notes you export or sync

Zoom

Cloud recordings for meetings you capture

Zotero

Your reference library

Dropbox

Files you pick

Confluence

Spaces you choose

Gmail

Messages you label for capture; the Inbox Digest reads your mailbox when you turn it on

GitHub

Repos you star, for the weekly digest

Figma

File names and unresolved comments — never canvas content

Linear

Issues assigned to you; action items filed back

Instapaper

Your saved articles

What happens to your content.

Capture

Content lands in your workspace's own rows, isolated by row-level security. Nothing is shared between workspaces, ever.

Processing

AI features send the minimum needed for the request to the provider listed above. Transcripts and embeddings are stored in your workspace; raw audio is transcribed and then discarded.

Disconnect a source

The connection and its stored content go together: deleting a source removes its text and its search index entries, so it stops appearing in Lumi's answers immediately.

Delete your account

Deletion removes your content from the live database; encrypted backups rotate it out within 30 days, and it is fully unrecoverable per GDPR.

Export

Everything is exportable at any time — JSON, Markdown, or PDF — on every plan, paid or not. This is the same guarantee the pricing page makes, because it is the same code path.