Privacy policy
What we collect, why we have it, where it lives, who else touches it and how to get it back or get rid of it. Written so that you can actually check us on it.
Nine promises, then the detail. We do not sell your data, we do not train AI on your content, this site sets no cookies, your workspace lives in the region you picked, you can export everything at any time for free, and self-hosted Tenon sends us nothing at all. Section 1 is the summary. Everything after it is the evidence.
1. The short version
The detail below is long because privacy law asks for detail. Here is the whole of it in nine lines.
- We do not sell or share your personal data for advertising. We never have and the business model does not depend on it.
- We do not use your content to train AI models, ours or anyone else's.
- This website sets no cookies and runs no cross-site tracking.
- On Tenon Cloud, your workspace content is yours. We hold it as your processor and store it in the region you chose.
- Each organization is isolated at the database level, not just in the interface.
- Staff access to customer content happens only for support you asked for, or to keep the service running, and it is logged.
- You can export everything, at any time, at no cost, on every plan.
- Self-hosted Tenon sends us nothing. No telemetry, no analytics, no content.
- Whatever country you are in, we apply the strongest rights in this policy to everyone.
2. What this policy covers
Tenon exists in three situations, and the answer to "who holds your data" is different in each. Find your row before reading on.
| Situation | Who holds the data | What applies |
|---|---|---|
| Visiting this website at https://www.thetenon.com | UTSL | Sections 3, 4, 5 and 12 to 18 |
| Using Tenon Cloud | UTSL, as your processor, in your chosen region | All of this policy |
| Running self-hosted Tenon | You, on your own infrastructure. We hold nothing. | Section 9, and your own privacy policy |
This policy sits alongside the terms of use. Where you have signed a data processing agreement with us, that agreement governs our handling of personal data in your workspace and prevails over this page if the two ever conflict.
3. Who we are and what role we play
UTSL ("we", "us", "Tenon") publishes the Tenon software and operates this website and Tenon Cloud. Data protection law splits responsibility into two roles, and we occupy both depending on the data.
| Data | Our role | What that means |
|---|---|---|
| Your workspace content: projects, tickets, pages, canvases, messages, files, comments | Processor | You decide what goes in and why. We act on your instructions, and we do not use it for our own purposes. |
| Account and billing data: names, work email addresses, roles, plan, invoices | Controller | We decide how this is handled, because we need it to run the business and meet our legal duties. |
| Service logs: sign-ins, IP addresses, API calls, error traces | Controller | We decide how this is handled, for security, abuse prevention and reliability. |
| Website visitor data | Controller | Server logs and anything you choose to send us through the contact form. |
Reach us about any of it at hello@thetenon.com. We have not appointed a statutory Data Protection Officer because our scale and processing do not require one; the address above reaches the people who actually make these decisions.
4. What this website collects
Very little, and none of it follows you around the internet.
| Data | When | Why, and the legal basis | Kept for |
|---|---|---|---|
| Name, email, company, message, plan interest | You submit the contact form or email us | To answer you and, if you asked about pricing, to follow up. Legitimate interest and steps taken at your request before a contract. | Up to 24 months after our last exchange |
| Server logs: IP address, user agent, URL, referrer, response code, timestamp | Every request | Keeping the site online, blocking abuse, diagnosing faults. Legitimate interest in a secure, working service. | 30 days, then deleted |
| Aggregate page counts | Every page view, if analytics is enabled | Knowing which pages are read. No cookie, no device identifier, no profile. Legitimate interest in improving the site. | Aggregated, no individual record |
| Email address | You subscribe to something we offer | Sending only what you asked for. Consent, withdrawable in one click in every message. | Until you unsubscribe |
We do not buy personal data, enrich what you give us with data brokers, or run advertising pixels. If you write to us about a job, a partnership or a security report, we keep that correspondence for as long as it is useful and no longer.
6. Tenon Cloud: account data
This is the data we need in order to give you an account, bill you correctly and keep the service safe. We are the controller of it.
| Data | Why we have it | Legal basis |
|---|---|---|
| Name, work email address, avatar, role, organization name | Creating accounts, showing who did what, sending invitations and notifications | Performance of our contract with you |
| Authentication data: password hash, single sign-on identifiers, multi-factor secrets, active sessions and devices | Signing you in and letting administrators revoke access | Performance of contract, and our legitimate interest in securing accounts |
| Billing data: plan, member count, billing contact, billing address, tax identifiers, invoice history | Charging the right amount and meeting tax and accounting law | Performance of contract, and legal obligation |
| Payment card details | We never see or store them. Our payment provider handles the card and returns only a token and the last four digits. | Performance of contract |
| Usage and security logs: sign-in times, IP addresses, API calls, admin actions, error traces | Detecting abuse, investigating incidents, producing the activity log your plan includes, keeping the service reliable | Legitimate interest in a secure and reliable service |
| Support correspondence | Answering you, and remembering the context next time | Legitimate interest in supporting customers |
We use this data to operate and secure the service, to bill you, to tell you about changes that affect you, and, on paid plans, to let us contact you about your account. We do not use it to advertise to you or to build a profile of you. Product announcement emails carry an unsubscribe link; service and security emails do not, because you need those.
7. Tenon Cloud: your workspace content
Everything you and your members create inside Tenon is your content. You are the controller of it, we are your processor, and we act on your instructions.
- Where it lives. Workspace content, files and backups sit in the data region you selected when your organization was created, the European Union or the United States, and we do not move them to the other region without your instruction.
- Isolation. Every row of your data carries your organization identifier and is protected by row-level security in the database, so isolation is enforced by the database itself rather than by application code that could be bypassed. The security page explains the model, and the product ships a self-test that proves the policies are active.
- Who can see it. Your members, according to the roles you give them. Your administrators can see everything in the organization, including private channels and direct messages if your policies require that; tell your members what your policy is.
- Staff access. Our engineers access customer content only when you ask us to look at something, or where we must to restore the service or investigate a security incident. Access needs an authenticated, logged path and is reviewed. We do not browse customer workspaces.
- We do not mine it. Not for analytics, not for benchmarks, not for AI training, not for product research. If we ever want to use aggregate, fully anonymised statistics that cannot identify you or your organization, we will say so here first.
- Your export. An administrator can export the whole organization at any time, in open formats, at no cost. See section 11 of the terms.
You decide what goes into Tenon. If you put special category data, health records, children's data or government-classified material into Tenon Cloud, you take on the obligations that come with it, and section 7 of the terms explains which of those categories the hosted service is not built for. When that is your situation, self-hosting is the right answer.
8. Brain, AI providers and your data
This is the part people most want a straight answer on, so here it is.
- Tenon does not run an AI model. Brain is a layer that talks to a provider you choose and connect with your own key. Until you connect one, nothing is sent anywhere.
- What leaves your workspace. When someone asks Brain something, the question plus the workspace context needed to answer it, such as the relevant pages, tickets or messages, goes to your chosen provider. Nothing else.
- Whose terms apply. Once it reaches that provider, their privacy policy and retention terms govern it. Read them, particularly whether they retain prompts and whether they train on them. Most business tiers do not; most free tiers do.
- We do not train on your content and we do not permit our sub-processors to.
- Keeping it in house. On the self-hosted Enterprise edition you can point Brain at a model running inside your own network, so no prompt ever crosses your boundary. See the Brain page.
- Automated decisions. Brain writes summaries, drafts and suggestions. It does not make decisions with legal or similarly significant effects about anyone, and we do not carry out automated decision-making or profiling of the kind that gives you a right to object under Article 22 of the GDPR.
- Labelling. AI generated and AI assisted output is labelled in the interface so readers know what they are looking at.
9. Self-hosted Tenon
If you run Tenon on your own infrastructure, we are not involved in your data at all. There is no account with us, no synchronisation, and nothing to opt out of.
- The software sends us no telemetry, no analytics, no usage statistics, no crash reports and no content. There is no phone-home to disable because there is none to begin with.
- The only outbound connections it makes are to services you configure: your own Supabase project, your email provider, your identity provider, and the AI provider you select. Your agreements with those services govern that data, not this policy.
- Licence keys for the Pro and Enterprise editions are validated locally. The check does not transmit your data to us.
- You are the controller and, in practice, the processor. Retention, access requests, breach notification, transfer rules and your own privacy notice are all yours to run.
- If you contact us for support, whatever you choose to send us, such as a log extract or a screenshot, is covered by section 4 of this policy. Redact it first if it contains personal data.
10. Who else touches the data
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose it in four situations only, and they are all listed here.
1. Sub-processors who help us run the service
Each is bound by a written contract that limits them to acting on our instructions, requires appropriate security, and forbids using the data for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, file storage and backups for Tenon Cloud | EU or US, matching the region you chose |
| Vercel | Hosting and delivery for this website and the Tenon Cloud front end | Global edge network, origin in your region |
| Resend | Transactional email: invitations, notifications, contact form replies | US, with EU delivery infrastructure |
| Your AI provider | Only if you connect one. Prompts and the context needed to answer them. | Determined by the provider you choose |
The signed data processing agreement carries the authoritative, dated list. We give notice before adding a new sub-processor, and if you reasonably object we will either find an alternative or let you leave without penalty. Ask for the list or to be added to the change notifications at hello@thetenon.com.
2. People inside your own organization
Your members and administrators, according to the permissions you set. This is the largest source of access to your content by a wide margin, and it is under your control, not ours.
3. Professional advisers and a future owner of the business
Accountants, auditors and lawyers under confidentiality. If the business is ever sold or merges, data may transfer to the buyer under the same commitments, and we will tell you before it happens so that you can export and leave if you prefer.
4. Where the law compels us
We disclose data to a public authority only where we are legally required to. When we receive such a request we check that it is valid and properly scoped, we push back on requests that are not, and we notify the affected customer unless we are legally prohibited from doing so. We have never received a request to build a backdoor or to grant bulk access, and we would challenge one.
11. Where your data is stored, and international transfers
Data region. You choose the European Union or the United States when your organization is created. Workspace content, files and backups stay in that region. On the Business plan the region commitment is written into your contract.
What may still cross a border. Account and billing records, support correspondence and security logs may be handled by our team and our providers outside your chosen region, because that is how a small company answers support tickets and pays its bills. This is a much narrower set of data than your workspace content.
How we protect transfers out of the EEA and the UK. We rely on the European Commission's standard contractual clauses, and the UK addendum where the UK GDPR applies, together with a transfer risk assessment and technical measures including encryption in transit and at rest. Where a provider is certified under the EU-US Data Privacy Framework we note that, but we do not rely on it alone: the framework is the subject of a pending appeal before the Court of Justice of the European Union, so we keep the standard contractual clauses in place underneath it as a fallback that does not depend on the outcome.
If you need data to stay in one country, including full data sovereignty or an air-gapped environment, self-hosting is the only honest answer and we will help you plan it rather than sell you a hosted plan that cannot deliver it.
12. How long we keep things
We keep personal data no longer than we need it. In practice that means the following.
| What | Kept for |
|---|---|
| Workspace content, while your organization is active | As long as you keep it. You control deletion inside the product. |
| Workspace content after you delete the organization | Deleted within 30 days |
| Backups containing deleted content | Expire within a further 30 days, so 60 days at the outside |
| Content after a subscription ends, so you can still export | 30 days, then the deletion schedule above |
| Account records after closure | Up to 12 months, for reinstatement, disputes and abuse prevention |
| Invoices and tax records | As long as tax and company law requires, typically 7 years |
| Security and sign-in logs | 12 months |
| Website server logs | 30 days |
| Contact form and sales correspondence | Up to 24 months after our last exchange |
| Support tickets | 24 months after the ticket is closed |
Deleted means removed from the live systems and left to expire from backups on the cycle above, not merely hidden. Where we must keep something longer because of a legal hold or an open dispute, we keep only that, and only for as long as the reason lasts.
13. How we protect it
The security page goes into the architecture. In summary:
- Encryption. HTTPS with modern TLS everywhere in transit. Encryption at rest for databases, files and backups.
- Tenant isolation. Row-level security in the database, enforced per query, with a self-test that verifies the policies are live rather than assumed.
- Access control. Role-based permissions for your members. Single sign-on through SAML or OIDC, enforceable organization-wide, plus session listing and revocation on the Business plan.
- Internal access. Least privilege for our staff, access only through authenticated and logged paths, reviewed periodically, and revoked the day someone leaves.
- Resilience. Automated backups with tested restores, and an activity log that lets administrators see who did what.
- Development. Dependency and vulnerability scanning, code review before release, and security fixes shipped for the current release and the one before it.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If you find a weakness, email hello@thetenon.com. We will acknowledge it quickly, keep you updated, credit you if you want the credit, and we will not take legal action against good-faith research that stops at proof of concept and leaves other people's data alone.
14. Your rights, and how to use them
The rights you have depend on where you live, but we apply the same process to everyone: ask us, and we will do it, whether or not the law in your country compels us.
If you are in the EU, the EEA, the UK or Switzerland
Under the GDPR and UK GDPR you can ask us to give you a copy of your personal data, correct it, delete it, restrict or stop a particular use, or hand it to another provider in a portable format. You can object to processing we carry out on the basis of legitimate interest, and withdraw consent at any time where consent was the basis. We respond within one month, extendable by two further months for genuinely complex requests, and we will tell you if we need the extension.
If you are in the United States
Comprehensive privacy laws now apply in 20 states and more arrive each year. Rather than sort you by state, we extend the strongest common set to every US resident: the right to know what we hold and why, to get a copy, to correct it, to delete it, and to appeal if we say no. You will not be treated differently for exercising any of them.
Two answers that are the same in every state: we do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months. We honour the Global Privacy Control as a valid opt-out signal anyway. We do not use or disclose sensitive personal information for any purpose that would require an opt-out, and we do not knowingly process the personal information of anyone under 16 for any such purpose. Under California law you may also designate an authorised agent to act for you; we will ask for proof of that authority. We respond within 45 days, extendable once by a further 45 days.
If you are in India
Under the Digital Personal Data Protection Act 2023 and the Rules notified in November 2025, you may ask for a summary of the personal data we process about you and how, ask us to correct, complete, update or erase it, nominate someone to exercise your rights if you die or become incapacitated, and withdraw consent as easily as you gave it. Send grievances to hello@thetenon.com, which is our grievance redressal contact. We will respond within 30 days, and if you are not satisfied you may complain to the Data Protection Board of India.
Everywhere else
Ask us anyway. We will treat the request on its merits rather than on your postcode.
How to make a request
Email hello@thetenon.com from the address you use with us, and tell us plainly what you want. We may need to verify your identity, and we will ask for the minimum needed to do that rather than collect more data in the process. Making a request is free; we charge only for a second copy of the same thing, or for a request that is genuinely excessive or repetitive, and we will tell you before we do.
A request about a workspace, not about us. If your personal data is inside someone else's Tenon organization, for example your employer's or a client's, they are the controller, not us. Ask them first. If you cannot reach them, write to us and we will pass the request on and help them answer it, but we cannot read, change or delete another company's workspace content on your say-so, and you would not want a provider that would.
15. Children
Tenon is a workplace tool. It is not directed at children, we do not market it to them, and the minimum age for an account is 16.
We do not knowingly collect personal data from anyone under 16. If you believe a child has an account, or that a child's personal data has been put into a workspace without a proper basis, write to hello@thetenon.com and we will investigate and delete what we find. Where a school or university deploys Tenon for students aged 16 and over, the institution is the controller and is responsible for the consent and notice arrangements.
16. If something goes wrong
If there is a personal data breach affecting your organization, we will tell you without undue delay and within 72 hours of becoming aware of it, and sooner if we can. We will not wait until the investigation is finished to make contact.
The notification will say what happened, what data was involved, what we have done to contain it, what we advise you to do, and who to talk to. As your processor we notify you, and you decide whether the people affected and your supervisory authority need to be told, though we will help you make and act on that decision. Where we are the controller, for example for account data, we notify the relevant authority and the people affected ourselves where the law requires it.
We publish a post-incident write-up for anything that affected the service materially, including what we changed so it does not happen again.
17. Changes to this policy
We update this page when our practices change or the law does. The date at the top always reflects the last substantive change.
- Minor changes, such as clearer wording or a corrected link, are published as they are made.
- Material changes, such as a new category of data, a new purpose, or a new sub-processor, are announced by email to administrators at least 30 days before they take effect.
- We do not apply a material change retroactively to data we already hold without telling you first.
Need the version that applied on a particular date, for an audit or a security questionnaire? Email hello@thetenon.com and we will send it.
18. Contact and complaints
- Privacy questions, data requests, the DPA and the sub-processor list: hello@thetenon.com
- Security reports: hello@thetenon.com
- Anything else: hello@thetenon.com or the contact page
If we have not resolved it. Tell us first and give us a chance to fix it, because we usually can. If you are still unhappy you have the right to complain to a supervisory authority: in the EEA, the data protection authority where you live or work; in the UK, the Information Commissioner's Office; in India, the Data Protection Board of India; in the United States, your state attorney general, and in California the California Privacy Protection Agency.