1.1 Account Information

When you create an account, we collect your name, corporate email address, company name, and job title. We require corporate email addresses — public email domains (Gmail, Yahoo, Outlook, etc.) are not accepted for account creation.

1.2 Meeting and Call Data

Our desktop application captures system audio from your sales calls for real-time transcription and intelligence. This includes:

• Audio streams captured locally on your device and streamed to our servers for transcription
• Meeting transcripts generated from your calls
• Meeting metadata such as meeting titles, participants (as detected from audio), timestamps, and platform (Zoom, Teams, Google Meet, etc.)
• AI-generated meeting summaries and extracted action items

1.3 Knowledge Base Content

Content you upload or connect to Tenali AI for use as your organization's knowledge base, including documents, presentations, PDFs, and content from connected integrations (Google Drive, OneDrive, SharePoint, Slack, etc.).

1.4 Query and Usage Data

Questions you ask during or after calls, answers generated by our AI, and your interactions with the platform (feature usage, session data, page views).

1.5 Integration Data

When you connect third-party services, we access data within the scopes you authorize:

• CRM data from Salesforce or HubSpot (deal context, account information)
• Calendar data from Google Calendar or Outlook Calendar (meeting schedules)
• Call recordings from Gong or Fireflies.ai (transcripts and summaries)
• Files from Google Drive, OneDrive, or SharePoint (knowledge base documents)
• Notifications via Slack (channel-based alerts)

1.6 Device and Technical Data

We collect device identifiers, operating system version, application version, IP address, browser type, and error/crash reports. Our desktop application logs are sanitized to remove personally identifiable information before transmission.

1.7 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or bank account details on our servers. We retain only the transaction identifiers necessary for billing and subscription management.

We use the information we collect to:

• Provide, operate, and maintain the Services, including real-time transcription and AI-powered answer generation
• Process and store your knowledge base content for retrieval during calls
• Generate meeting summaries, transcripts, and post-call intelligence
• Authenticate your identity and manage your account
• Communicate with you about the Services, including product updates and support
• Monitor and improve the performance, reliability, and security of the Services
• Comply with legal obligations and enforce our Terms of Use
• Detect, prevent, and respond to security incidents or fraudulent activity

Tenali AI uses a Retrieval-Augmented Generation (RAG) architecture to deliver real-time answers. It is important to understand:

We do NOT use your data to train or fine-tune any AI model. Your transcripts, documents, knowledge base content, and queries are never used to train, improve, or fine-tune any large language model (LLM).

Your data is used only at inference time. When you ask a question during a call, we retrieve relevant content from your organization's knowledge base and pass it to an LLM to generate a contextual answer. This happens in real-time and your content is not retained by the LLM provider.

Enterprise LLM providers. We use enterprise-tier APIs from Anthropic (Claude) and OpenAI, under data processing agreements that contractually prohibit the use of customer data for model training.

Audio transcription. Audio is transcribed using AssemblyAI's enterprise API. Audio data is processed in real-time and is not stored by the transcription provider beyond the processing window.

Vector embeddings. Your knowledge base content is converted into vector embeddings for semantic search. These embeddings are tenant-scoped — they cannot be accessed by other organizations.

We do not sell your personal information. We share information only in the following circumstances:

4.1 Service Providers (Sub-processors)

We use third-party service providers to operate the Services. These providers process data on our behalf under contractual obligations to protect your information:

• Amazon Web Services (AWS) — Cloud infrastructure, compute, storage, and content delivery
• MongoDB Atlas — Database hosting and management
• Auth0 (Okta) — Authentication and identity management
• Anthropic — Large language model API for answer generation
• OpenAI — Large language model API for answer generation
• AssemblyAI — Real-time audio transcription
• Voyage AI — Vector embedding generation for semantic search
• Stripe — Payment processing and subscription management
• Sentry — Application error monitoring (with sensitive data scrubbing)
• Google LLC (Google Analytics 4) — Website analytics
• PostHog, Inc. — Product analytics and session recording

4.2 Third-Party Integrations

When you connect integrations (Salesforce, HubSpot, Slack, Google Drive, etc.), data flows between Tenali AI and these services based on the OAuth scopes you authorize. We access only the data necessary for the integration's stated purpose.

4.3 Legal Requirements

We may disclose information if required by law, subpoena, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change.

5.1 Infrastructure

All data is hosted on Amazon Web Services (AWS) in the United States (US-West-2 region). Our backend services run within private, network-isolated environments.

5.2 Encryption

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256 encryption
• Authentication tokens on the desktop application are encrypted using the macOS Keychain
• All credentials and API keys are managed through AWS Secrets Manager — no secrets are hardcoded

5.3 Access Controls

• Authentication via Auth0 with RS256 JWT tokens (web), OAuth 2.0 PKCE (desktop), and OAuth 2.0 WebAuth (mobile)
• Role-based access control (RBAC) restricting data access based on user roles
• Tenant-level data isolation ensuring organizations can only access their own data

5.4 Monitoring

We use application monitoring, distributed tracing, and automated health checks across all services. Sensitive data (tokens, credentials) is scrubbed from all logs and error reports before storage or transmission.

For more details, request our Security Overview document at security@tenali.ai.

• Customer data (transcripts, recordings, summaries, knowledge base content) is retained for the duration of your active subscription.
• Upon account termination or customer request, all associated data is permanently deleted from our systems, including backups, within 30 days.
• You may request deletion of specific data at any time by contacting us at admin@tenali.ai.
• Payment records are retained as required by applicable tax and financial regulations.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your personal information for certain purposes.
• Restriction: Request that we restrict processing of your personal information.
• Withdraw Consent: Where processing is based on consent, withdraw your consent at any time.

To exercise any of these rights, contact us at admin@tenali.ai. We will respond within 30 days.

California Residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

European Residents (GDPR): We process personal data on the basis of contractual necessity (to provide the Services), legitimate interests (to improve and secure the Services), and consent (where applicable). For data subject requests, contact admin@tenali.ai.

We use cookies that the site needs to work, including one that remembers your cookie choice. With your consent, we also use Google Analytics and PostHog to understand how people use our website and docs: the pages they visit, how they found us, their browser and device, and what they click. PostHog may also record page interactions, with anything you type hidden. If you later sign up, these visits may be linked to your account. We don't use this data for advertising or sell it.

If you reject analytics cookies, PostHog still counts visits without setting cookies or storing an identifier on your device. It uses a code made from your IP address and browser that changes every day, so it can't follow you over time.

You can change your choice at any time in Cookie Preferences, in the website footer or the docs sidebar. We keep analytics data for up to 14 months and session recordings for 30 days. We rely on your consent for analytics cookies and on our legitimate interest for cookie-free visit counts. Google and PostHog process this data for us in the United States.

Tenali AI processes and stores data in the United States. If you access the Services from outside the United States, your data will be transferred to and processed in the United States. We ensure appropriate safeguards are in place for international transfers in compliance with applicable data protection laws.

The Services are designed for business use and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Services after changes constitutes acceptance of the updated policy.

Enterprise customers may request a Data Processing Agreement (DPA) for GDPR compliance. Contact us at security@tenali.ai to request a DPA.

For questions about this Privacy Policy or our data practices:

• General inquiries: admin@tenali.ai
• Security and compliance: security@tenali.ai
• Mailing address: Provided upon request