This Privacy Policy explains how TENEKSAI OÜ ("we", "our", "us") collects, uses, stores and protects your information when you use our services: our web application, our macOS and Windows desktop applications, and our iOS and Android applications.
EU AI Act Position
Teneks’ Live‑Call Assistance and Post‑Call Analysis features are powered by AI. Banners or footnotes that read “AI assistance active” or “Generated with AI” indicate automatically generated content. Teneks is offered solely as a limited‑risk AI system under Regulation (EU) 2024/1689 and must not be used for Annex III high‑risk purposes such as employee monitoring or automated decision‑making that produces legal or similarly significant effects.
1. Introduction
Teneks is a platform designed to help sales teams and professionals improve their communication skills through conversation analysis, recording insights, team collaboration and performance analytics. This Privacy Policy describes what data we collect, how it is used and your rights regarding your personal information.
Who Is Responsible for Your Data
TENEKS is provided by TENEKSAI OÜ (registry code 16901834, Kuklase tn 18, 13423 Tallinn, Estonia; contact@teneks.ai). Who is the controller of your personal data depends on the data:
Workspace content: recordings, transcripts and analytics in a TENEKS workspace, meetings synced from calendars its users connect, and meeting reminders sent from the workspace. The customer that holds the workspace (usually your employer; if you signed up on your own, you) is the controller, and TENEKSAI OÜ processes this data on the customer's behalf as its processor (GDPR Art 28). Requests about this data are best sent to that organisation; if you send them to us, we pass them on and help it answer.
Data TENEKSAI OÜ controls: your account data (such as your name, email address, login and billing details), the record of each calendar connection (see Calendar integrations), and the list of email addresses that bounced permanently or reported a TENEKS email as spam, which we keep across all customers to protect the delivery of our email.
2. Information We Collect
Recording and Audio Data
Audio Recordings: When you upload or create recordings through our platform, we store and process the audio content to provide transcription, analysis and insights.
Microphone Audio: Our desktop (macOS and Windows), iOS and Android apps capture audio through your device's microphone only when you deliberately start or join a recording. Recording participants must be informed and consent obtained where required by applicable law.
Video Recordings: If applicable, video content you upload for analysis and review purposes.
Transcriptions: Text transcriptions generated from your audio recordings.
Analysis Data: Metrics and insights derived from your recordings, including speaker ratios, sentiment analysis, conversation flow and performance indicators.
Model provenance: Language processing is performed by proprietary in‑house models and by foundation models from providers that are signatories to the EU GPAI Code of Practice (currently OpenAI, Anthropic, Google, Microsoft and Mistral AI), engaged under agreements that prohibit the use of your content for model training.Customer Content Data, including audio recordings, transcripts and conversation analytics, is processed solely to provide the Service and is not used to train, fine‑tune or improve Teneks models or any third‑party models.
Calendar Data (only if you connect a calendar)
If you connect your Google Calendar or Microsoft Outlook calendar, we read your upcoming meetings from it, read-only. This includes the names and email addresses of the people invited, including people outside your organisation. If your organisation switches on meeting reminders, we email reminders to those outside guests on its behalf. See Calendar integrations and Meeting reminders sent via TENEKS.
Who Can Access Your Data
Access to customer content data (audio recordings, transcripts, conversation analytics) is strictly limited:
Your Organisation: Users within your organisation can access data according to role‑based permissions (User, Manager, Admin).
Teneks Founder / CEO: For administrative and support purposes only, under strict confidentiality obligations.
Designated Account Manager: If an account manager is assigned to your organisation in the future, they will be bound by a non‑disclosure agreement (NDA). You will be notified before any such assignment.
Teneks employees do not have access to your audio recordings, transcripts or conversation analytics. Technical infrastructure access is limited to system administrators who can only access anonymised metadata for operational purposes.
Usage Data vs. Customer Content Data
We draw a clear distinction between usage data and customer content data:
Customer Content Data (audio recordings, transcripts, conversation analytics) is only ever processed to deliver the Service to you. It is never sold, never used for platform improvement, and never accessed by Teneks employees; it is shared only with the processors listed in Section 7, to the extent necessary to deliver the Service.
Usage Data (feature‑usage patterns, page views, session durations, button clicks) describes how you interact with the platform interface. This data is fully anonymised and aggregated before any analysis, making re‑identification impossible (GDPR Recital 26). We use this data solely to improve the platform experience.
3. How We Use Your Information
Service Delivery: To provide our core services including recording analysis, transcription, insights generation and team collaboration features.
Analysis Processing: To analyse your recordings to provide conversation insights, performance metrics and improvement suggestions.
Account Management: To manage your account, process payments through Stripe and provide customer support.
Team Collaboration: To enable sharing and collaboration features within your team or organisation.
Calendar and Meeting Reminders: If you connect a calendar, to show you your upcoming meetings and, when your organisation switches meeting reminders on, to email reminders about those meetings to guests from outside your organisation on its behalf. We do not use calendar data for anything else.
Performance Analytics: To generate insights, reports and analytics about your conversation performance and team metrics.
Platform Improvement: To improve our services and develop new features we use only fully anonymised and aggregated usage data — such as feature‑usage patterns, page views and session durations — that describes how users interact with the platform. We never use customer content data (audio recordings, transcripts or conversation analytics) for platform improvement. All usage data is aggregated and anonymised so that it cannot be linked back to any individual or organisation (GDPR Recital 26).
Security and Compliance: To protect our platform, prevent abuse and comply with legal obligations.
Purpose
Legal basis (GDPR Art 6)
Service delivery & account management
Art 6 (1)(b) – contract performance
Team collaboration features
Art 6 (1)(b) – contract performance
Calendar connection: the connected account, encrypted access tokens and the connection's security record
Art 6 (1)(f) – legitimate interest (operating a secure integration you asked for); TENEKSAI OÜ is the controller
Syncing meetings and sending meeting reminders to their guests
We process this as processor for your organisation, which is the controller (Art 28). Its legal basis is normally Art 6 (1)(f) – legitimate interest in meetings taking place as planned
Blocking addresses that bounced or reported a reminder as spam, across all customers
Art 6 (1)(f) – legitimate interest (email deliverability and preventing abuse of our sending domain); TENEKSAI OÜ is the controller
Payment processing
Art 6 (1)(b) – contract performance
Security & fraud prevention
Art 6 (1)(f) – legitimate interest
Authentication reliability and abuse diagnostics
Art 6 (1)(f) – legitimate interest
Platform improvement (anonymised usage data only)
Art 6 (1)(f) – legitimate interest (fully aggregated & anonymised; zero re‑identification per Recital 26)
Marketing emails (opt‑in)
Art 6 (1)(a) – consent
4. Data Retention
Account Data: Retained as long as your account is active or as needed to provide services.
Audio Recordings: Retained for 30 days by default (customisable).
Transcriptions: Retained per customer‑specified requirements.
Analytics Data: Aggregated, anonymised analytics may be retained longer for service improvement.
Technical logs: Access logs (timestamp, user ID, API route) are retained for security and audit purposes for up to 2 years, or longer only where needed to establish, exercise or defend legal claims.
Content access log: When someone opens a recording, reads its transcript or summary, plays its audio or downloads it as a PDF, we record who did it (user ID, email address and role), when, from which IP address and browser or app, and which recording it was and whose. When Teneks staff browse your organisation's recording lists, we record that too. This record lets us check who accessed your recordings. It is used only for security and audit purposes and retained for up to 2 years, or longer only where needed to establish, exercise or defend legal claims.
Desktop login diagnostics: Fixed, identity-free authentication events are retained for up to 90 days.
Calendar data: meetings synced from a connected calendar are deleted 2 days after the meeting ends (cancelled meetings too, once their scheduled end has passed), whatever the state of the connection, and immediately when you disconnect the calendar. The access tokens are deleted when you disconnect.
Calendar connection record: after you disconnect, we keep a record that the calendar was connected (provider, account email address, connection and disconnection dates) as part of your account's security record, for as long as your TENEKS account exists.
Meeting reminder log: for each reminder sent, the recipient's email address and name, the meeting time, the reminder step and its delivery status, deleted 90 days after the meeting.
Reminder opt-outs: kept for as long as needed to respect the opt-out. Opt-outs from one organisation's reminders are deleted when that organisation's workspace is deleted.
Email block list: an address that bounced permanently or reported a TENEKS email as spam is kept for as long as the address keeps bouncing or the complaint stands, and at most 24 months after the last event.
Deletion Rights: You can request deletion of your data at any time.
5. Your Rights and Controls
Access and Portability: Access, download and export your data.
Correction and Updates: Update and correct personal information.
Restriction: ask us to restrict the processing of your data in the cases set out in GDPR Art 18.
Withdrawing consent: where we rely on your consent (marketing emails, analytics and marketing cookies), you can withdraw it at any time; this does not affect processing before the withdrawal.
Automated decisions: we do not make decisions based solely on automated processing that produce legal or similarly significant effects for you (GDPR Art 22).
Deletion: Delete specific recordings or request full account deletion.
Sharing Controls: Manage what data is shared within your team.
Opt‑Out: Opt out of certain processing where legally permissible.
Calendar Controls: in Settings → Integrations → Calendar you can switch reminders off for all your meetings or for a single meeting, or disconnect your calendar. Disconnecting deletes the synced meetings and the access tokens.
Objection: you can object at any time to processing based on legitimate interest (GDPR Art 21). If you received a meeting reminder, the unsubscribe link in it does this in one click.
AI Explanation: Request a concise explanation of how an AI‑generated insight was produced by emailing contact@teneks.ai.
Complaints: you can lodge a complaint with a data protection supervisory authority: in Estonia, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, www.aki.ee), or the authority where you live or work.
6. Cookies & Website Analytics
Our website uses cookies and similar technologies (such as localStorage). Apart from strictly necessary items, we only set them after you give consent via the cookie banner shown on your first visit. If you choose "Necessary only", no analytics or marketing cookies are set.
Strictly necessary (no consent required)
Cookie consent choice (localStorage: teneks_cookie_consent) — remembers whether you accepted or declined cookies.
Language preference (localStorage: teneks_language) — remembers your selected interface language.
Authentication tokens (app users only) — keep you logged in to the Teneks application.
Desktop login diagnostics (sessionStorage, one login attempt only) — records fixed stages and reason codes needed to detect a broken browser-to-desktop sign-in. It uses a random per-attempt identifier and may include platform and app version, but never includes the callback URL, OAuth state, credentials, email, account or organisation identifiers, a persistent browser identifier, or a device fingerprint. These first-party operational events are processed independently of analytics consent and are not shared with advertising or analytics providers.
Analytics (only with your consent)
Google Analytics 4 (via Google Tag Manager) — anonymous statistics about page visits, traffic sources and site usage. Without consent, Google receives only cookieless, non-identifying pings.
Microsoft Clarity — anonymised session recordings and heatmaps that help us understand how the website is used and where it is confusing.
First-party attribution (localStorage: teneks_anon_id, teneks_first_touch) — records which website or campaign referred you to us (e.g. a search engine, an AI assistant, or LinkedIn), and your optional answer to the "How did you hear about us?" question. This data is stored on our own EU servers and is not shared with third parties.
Marketing (only with your consent)
LinkedIn Insight Tag — measures the effectiveness of our LinkedIn campaigns and enables audience building on LinkedIn.
X (Twitter) Pixel — measures the effectiveness of our advertising on X and enables audience building on X.
The legal basis for analytics and marketing cookies is your consent (GDPR Art 6(1)(a) and the ePrivacy Directive). You can withdraw consent at any time — your choice will be asked again on your next page load:
7. Third-Party Integrations
Our platform integrates with several third-party services to provide our functionality:
Google: For sign-in with Google and, if you connect it, read-only access to your Google Calendar (see Calendar integrations)
Microsoft: Microsoft Azure for cloud infrastructure and data storage (France Central, with backups in West Europe) and, if you connect it, read-only access to your Outlook calendar through Microsoft Graph (see Calendar integrations)
Stripe: For secure payment processing
Resend (Plus Five Five, Inc., USA): For delivering the emails we send, such as account emails, coaching and report emails, and meeting reminders. We send from Resend's EU (Ireland) sending region, but Resend's primary processing takes place in the United States. Resend keeps each email's content and metadata for up to 30 days in the United States, for delivery and troubleshooting (see International Data Transfers)
AI model providers: Where third‑party foundation models are used for transcription or analysis, they are limited to EU GPAI Code of Practice signatories, under data processing agreements that prohibit the use of your content for model training
When you use these integrations, you are also subject to the privacy policies of those third-party services. We encourage you to review their respective privacy policies.
CRM integrations (Pipedrive, HubSpot)
A workspace owner or admin can connect a CRM (Pipedrive or HubSpot) to their TENEKS workspace. The connection is optional, is made with OAuth, and applies to the whole workspace. TENEKSAI OÜ is the controller of the data TENEKS stores about the connection; the customer controls the data in its own CRM.
What we access: only what the permissions granted at install allow and the connecting CRM user can see: the connected account and company (id, name, domain); deals, persons or contacts, and organizations or companies, including their names, email addresses, phone numbers and field definitions; CRM users' names and email addresses; and search results. We use this to match a conversation to the right record and to credit each note to the right salesperson.
What we store: the OAuth tokens, encrypted at rest; the ids and display names of the CRM records a conversation is matched to; the CRM user ids and email addresses used to link TENEKS users to CRM users; the ids of the notes or activities we wrote; a hash of each written payload, to avoid duplicate writes; and an audit log of each write. We do not keep copies of your CRM records beyond these ids and display names.
What we write: a note (or, if your admin chooses, a call activity) with the conversation's title, date, duration, salesperson, summary, next steps and a link back to TENEKS, plus any CRM fields your admin maps. The transcript is written only if a workspace admin opts in. We never create deals, persons, contacts, organizations or companies.
Data in your CRM: anything written into your CRM is held and controlled by you, under your agreement with the CRM provider. Deleting a call or your account in TENEKS does not delete notes or fields already written to your CRM; remove them in the CRM if needed.
Revocation: when an admin disconnects the CRM in TENEKS, or the app is uninstalled in the CRM, we revoke our access where the CRM supports it, delete the stored tokens and stop all writes.
Calendar integrations (Google Calendar, Microsoft Outlook)
On plans that include it, each TENEKS user can choose to connect their own Google Calendar or Microsoft Outlook calendar. The connection is optional, is made with OAuth, is read-only and is personal: only you can connect your calendar. TENEKS never creates, changes or deletes calendar events and never sends email from your mailbox or account. TENEKSAI OÜ is the controller of the connection record (the connected account, the encrypted tokens and its security log). The meetings we sync, and any reminders, are processed on behalf of your organisation, which is the controller (see Who Is Responsible for Your Data).
What we access: only your primary (Google) or default (Outlook) calendar, and only events from one hour ago to eight days ahead, refreshed about every five minutes. With Google we ask for the permission “See the events on Google calendars you own” and your Google account's email address. With Microsoft we ask for Calendars.Read, User.Read, offline access and your sign-in email, and we read your account ID, email address or username, and display name. For each event we read its identifiers, title, start and end time and time zone, whether it is all-day, its status (confirmed, tentative or cancelled), its type (for example out of office), its visibility or sensitivity, the organizer's name and email address, each guest's name, email address and response, whether a guest is optional or a meeting room, the video-call link, and the link to the event in your calendar. We also read the event's location (and, for Google, its description) only to find a Zoom, Microsoft Teams or Google Meet link; we do not store the location or the description. We do not request event bodies or attachments from Microsoft, and we do not read your other calendars.
What we store: the event details listed above, except the location and description; the email address and account ID of the calendar account you connected and the permissions you granted; and the OAuth access and refresh tokens, encrypted at rest (AES-GCM).
Why we use it: (1) to show you your upcoming meetings in TENEKS, which of them will get reminders, and let you skip any of them; and (2) when your workspace has meeting reminders switched on, to email reminders before a meeting to its guests from outside your organisation (see Meeting reminders sent via TENEKS). Once your workspace switches reminders on, they are on for your meetings unless you switch them off. We use calendar data for nothing else. If we add a new use, we will update this policy and ask for your agreement before we use your calendar data that way.
Who can see it: you; the owners and admins of your workspace, who can see whether you have connected a calendar and, when they set up reminders, the titles and start times of upcoming meetings that match their rules (titles of private meetings are hidden unless the workspace includes private meetings in reminders) and a preview of the reminder for a real upcoming meeting, including the guest's name; and each external guest of a meeting, who receives their own reminder with the meeting's title, date and time, video-call link, and your name and email address (as the reply-to address). A reminder is addressed to one guest only and does not show other guests' addresses. TENEKS staff who help set up reminders for a workspace other than their own see only a sample reminder and the number and start times of matching meetings, without titles. Otherwise, TENEKS staff do not read your calendar data unless you give us permission (for example for a support request), it is necessary for security purposes (such as investigating abuse or a bug), or the law requires it.
Where it goes: calendar data is stored on Microsoft Azure in the EU (France Central, with backups in West Europe). Reminder emails are delivered by Resend, which keeps each email's content and metadata for up to 30 days in the United States, for delivery and troubleshooting (see International Data Transfers). We do not sell calendar data, share it with advertising platforms, data brokers or information resellers, or use it for advertising or marketing. We do not send calendar data to any AI model provider, and we do not use it to create, train or improve any machine-learning or artificial intelligence model, including foundational models.
How long we keep it: a meeting is deleted 2 days after it ends, and all of a calendar's meetings are deleted immediately when it is disconnected (see Data Retention for the reminder log and the connection record). If your TENEKS account or your organisation's workspace is deleted, the connection and its meetings are deleted with it.
Your controls: in TENEKS, go to Settings → Integrations → Calendar to switch reminders off for all your meetings, skip a single meeting, or disconnect at any time. When you disconnect, we ask Google to revoke our access, delete the tokens and the synced meetings, and send no further reminders from that calendar. You can also remove TENEKS's access yourself at any time: for Google at myaccount.google.com/permissions; for Microsoft at myapps.microsoft.com (work or school account) or account.live.com/consent/Manage (personal account). Microsoft does not let an app withdraw its own access, so to remove TENEKS from a Microsoft account completely, disconnect in TENEKS and remove TENEKS at the Microsoft link above. If you remove access at Google or Microsoft first, TENEKS can no longer sync; the meetings already synced are deleted 2 days after each one ends, or at once when you also disconnect in TENEKS.
Meeting reminders sent via TENEKS (for people who receive them)
Companies that use TENEKS can send automatic reminders before meetings that their staff have in their calendars. If you received a reminder “via TENEKS”, this is what happened and what you can do.
Who is responsible: the company named in the reminder (“<Company> via TENEKS”) decides whether reminders are sent, to whom and what they say. It is the controller of your personal data for this purpose. TENEKSAI OÜ (registry code 16901834, Kuklase tn 18, 13423 Tallinn, Estonia) sends the reminders on that company's behalf as its processor. Replies to a reminder go to the person hosting the meeting.
Where your data came from: the calendar of an employee of that company, who connected it to TENEKS. You are a guest on one of their meetings.
What we process: your email address and name as they appear in the meeting invitation, your response to it, and the meeting's title, date, time, time zone and video-call link. Each reminder is addressed to you alone; other guests do not see your address.
Why, and on what basis: to remind you of the meeting shortly before it takes place (for example one day, two hours and ten minutes before; the company chooses the times). The company relies on its legitimate interest in meetings taking place as planned (GDPR Art 6(1)(f)). You will not receive reminders for meetings you have declined.
Who else receives your data: the meeting host and the company's TENEKS administrators; TENEKSAI OÜ; and its service providers Microsoft Azure (hosting, in the EU) and Resend (email delivery; Resend is a US company and keeps each email's content and metadata for up to 30 days in the United States, for delivery and troubleshooting; see International Data Transfers).
How long it is kept: the copy of the meeting is deleted 2 days after the meeting ends; the record of reminders sent to you is deleted 90 days after the meeting; an opt-out is kept for as long as needed to respect it.
Stopping reminders: every reminder has an “Unsubscribe from these reminders” link. One click stops all further reminders from that company via TENEKS. Reminders from other companies that use TENEKS are not affected. If an email to your address bounces permanently or you report a reminder as spam, TENEKSAI OÜ blocks your address for all reminders sent through TENEKS, to protect its email service. For that block list TENEKSAI OÜ is the controller and relies on its legitimate interest (GDPR Art 6(1)(f)). We keep only your address, the reason, the date and a delivery reference, for as long as the address keeps bouncing or the complaint stands, and at most 24 months after the last event.
Your rights: you can ask for access to, correction or erasure of your data, restrict or object to its use, and lodge a complaint with a data protection supervisory authority (in Estonia, the Andmekaitse Inspektsioon, www.aki.ee). Reply to the reminder to reach the company, or write to us at contact@teneks.ai. We pass requests about the company's data to the company and help it answer. You do not need a TENEKS account. If you ask us to erase an opt-out, reminders could start again, so we keep the address only to respect your choice.
Recording: a reminder may say that the meeting may be recorded and transcribed with TENEKS. Whether a meeting is recorded is decided by the host company, which must tell you and, where the law requires, ask for your consent. You can object at any time, including at the start of the call.
8. International Data Transfers
Your data is primarily processed and stored within the European Union, on Microsoft Azure in France Central with backups in West Europe. Some of our service providers are based outside the European Economic Area:
Resend (Plus Five Five, Inc., USA), which delivers our emails, including meeting reminders. We send from Resend's EU (Ireland) sending region, but Resend states that its primary processing operations take place in the United States. Resend keeps the content and metadata of each email it delivers for us for up to 30 days in the United States, for delivery and troubleshooting. The transfer relies on the EU–US Data Privacy Framework, under which Resend is certified, and on the European Commission's Standard Contractual Clauses in Resend's data processing agreement.
Where any other transfer outside the EEA is needed, we ensure appropriate safeguards are in place in accordance with the GDPR (an adequacy decision or the Standard Contractual Clauses). You can ask us for more information at contact@teneks.ai.
9. Children's Privacy
Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date and notify you of material changes through our platform or via email.
11. Contact Us
If you have any questions or concerns regarding this Privacy Policy or our data practices, please contact us at: