Privacy policy
Enlaye Privacy Policy
Last updated: October 19, 2026
This policy is published in English, French and Spanish. All versions have the same meaning. English is the prevailing language, except where the law requires otherwise.
1. Who we are
Enlaye, Inc., a Delaware corporation, operates the Enlaye Risk Lifecycle Management™ Platform (the "Platform") and our websites (including www.enlaye.com and www.enlaye.app). Enlaye SAS, our wholly owned French subsidiary, contracts with customers in the European Union and has Enlaye, Inc. deliver the service. In this policy, "Enlaye", "we" and "us" mean both. Enlaye, Inc. is the controller for the personal data we hold as controller (see below).
We hold personal data in one of two roles:
| Role | When | Who you contact |
|---|---|---|
| Controller | Data we collect for our own purposes: website visitors, sales and marketing contacts, job candidates, and Platform account details | Enlaye; privacy@enlaye.com |
| Processor | Data a customer uploads to the Platform ("Customer Data"), such as project documents | The customer that gave you access. We pass requests to them and help them respond. |
If you use the Platform through a customer, the customer's signed agreement with us (the "Customer Agreement") governs Customer Data. Where this policy and the Customer Agreement differ, the Customer Agreement controls. Rights the law gives you cannot be reduced by either document.
2. What we collect
We collect only what we need to run the service and our business.
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, work email, phone, company, job title | You or your employer |
| Sales prospect data | Name, work email, job title, company, professional profile | Business-data providers and public professional sources |
| Account and sign-in data | User ID, session data, sign-in events. Passwords are handled by our identity provider, never stored by us. | You, our identity provider |
| Customer Data | Project documents, drawings, contracts, schedules, prompts and AI outputs, and any personal data your organization includes in them | Your organization |
| Usage and device data | IP address and approximate location derived from it, browser, device, pages and features used, and Platform session recordings (see Section 4) | Automatically, through the Platform and website |
| Communications | Support emails and tickets, and call recordings where you were told the call is recorded | You |
| Marketing and events | Preferences, opt-in status, event attendance | You |
| Candidates | CV, work history, contact details | You |
We do not ask for sensitive data such as health, religion or biometrics. If it appears in Customer Data, we apply our strictest handling rules. Payment card details are handled by our payment processor, not stored by us.
You do not have to give us personal data. Without account details we cannot give you access to the Platform, and without contact details we cannot reply to you. No law requires you to provide it.
Our services are for people aged 18 and over. We do not knowingly collect personal data from children; if you believe we have, contact privacy@enlaye.com and we will delete it.
3. How we use it
We use personal data to:
- provide, support and secure the Platform for our customers and their users;
- create accounts and control access;
- understand how the Platform and website are used, so we can fix and improve them;
- run sales, marketing and events, with your consent where the law requires it;
- recruit;
- prevent fraud and abuse, meet legal obligations, and handle legal claims.
The Platform produces AI recommendations. People at your organization review them and make the decisions. We do not make automated decisions that have legal or similarly significant effects on you.
We do not sell personal data, and we do not use it for advertising.
4. Customer Data, AI and staff access
The customer owns its Customer Data. We use it only to provide, secure, support and troubleshoot the Platform for that customer, and as the Customer Agreement permits. The customer decides what it uploads and is responsible for giving any notices and obtaining any consents the law requires for personal data it includes. We do not use Customer Data for marketing, and our personnel do not put it into AI productivity tools outside our sub-processor controls.
AI model training. We do not use Customer Data to develop, train, fine-tune, evaluate or improve machine learning models without the customer's prior written agreement. Our AI model provider is configured not to retain Customer Data or train on it. We may use service metadata and aggregated statistics that cannot identify a customer, user or individual to operate and improve the Platform, and we do not attempt to re-identify them. Where a customer agrees to training, its Customer Data is de-identified or aggregated first, and we do not use it in a way that could reveal the customer's confidential information or identify the customer or any individual.
Enlaye staff access. A small standing support group of authorized Enlaye personnel holds accounts in customer organizations on the Platform, and other personnel may be given temporary access for a specific task. They may view Customer Data, including documents, prompts and AI outputs, only to provide support, maintain security, troubleshoot, or where the law requires it. Membership of the standing group, and each temporary grant, needs CTO approval and a recorded business reason. Temporary grants end when the work is done. All access is logged and included in our periodic access reviews. Personnel with access are bound by confidentiality obligations and complete security training, and employees are background-screened.
Session recording. The Platform records user sessions to help users, troubleshoot problems and keep the service secure. We do not use recordings that contain Customer Data for product development. A recording can capture what is on your screen and the actions you take, so it may include Customer Data. Text you type into fields is masked. Users in the EU, UK and Quebec are asked for consent before analytics and session recording start, and can change their choice in account settings. Only a small named group of Enlaye staff can view production recordings. Where the Customer Agreement restricts or turns off session recording, the agreement controls.
5. Who we share it with
- Sub-processors that help us run the service: hosting, database, identity, AI inference, product analytics, logging, and corporate tools. Each is bound by a written contract covering confidentiality, security and breach notification. The current list is available upon written request. Customers are told about material changes to the list as our data processing agreement provides.
- Your organization. Its administrators can see your Platform activity, such as who opened which document.
- Integrations your organization turns on. Data flows to those services under their own terms.
- Professional advisors such as lawyers, auditors and insurers, under confidentiality.
- Authorities, when the law requires it or to protect people's rights and safety.
- A buyer or successor in a merger or acquisition, financing, reorganization or sale of assets, who must keep protecting the data under this policy or one at least as protective.
6. Where your data is stored
We host customers in the European Union or the United States. EU customers are hosted in the EU. Customers in the United States and Canada are hosted in the United States.
| Data | Where it is held |
|---|---|
| Customer project content: documents, derived data, project memory, conversation history | European Union; United States for U.S. and Canadian customers |
| AI processing of that content | European Union; United States for U.S. and Canadian customers |
| Application logs and product analytics, including session recordings | European Union; United States for U.S. and Canadian customers |
| Account and sign-in data: name, email, sign-in factors | United States, with our identity provider |
Where personal data leaves the EU or Canada, we protect it with contracts and with encryption, access control and logging. For EU data we use the EU Standard Contractual Clauses, or the EU-U.S. Data Privacy Framework where the recipient participates. For data from Quebec, we assess the protection the United States offers before transferring it. You can ask us for a copy of the transfer terms. Enlaye personnel in the United States may also access data held in the European Union remotely, to provide support and respond to incidents; that access is covered by the same safeguards. Cross-border processing can vary with a customer's configuration, the integrations it turns on and the terms of its Customer Agreement.
7. How long we keep it
We keep personal data only as long as we need it, or longer where the law or a legal hold requires.
| Data | How long |
|---|---|
| Customer Data | For the term of the Customer Agreement. When it ends, we handle Customer Data as that agreement provides. |
| Backups | Overwritten within 35 days |
| Account data | While your access is authorized |
| Security and application logs | Up to 12 months |
| Product analytics and session recordings | For the term of the Customer Agreement, plus up to 90 days |
| Marketing data | Until you opt out, or after 2 years of no engagement |
| Unsuccessful candidates | Up to 12 months after the role closes, unless you agree to longer |
| Contracts, sales and financial records | 7 years |
8. Security
We run a security program aligned with the AICPA SOC 2 Security criteria. It includes encryption of data in transit, least-privilege access, multi-factor authentication on systems holding Customer Data, managed and monitored company laptops, code review and change control, vulnerability management, and an incident response process. Our current security documentation is at trust.enlaye.com.
9. Your rights
To use any right, email privacy@enlaye.com. We will verify who you are before acting. If your request concerns Customer Data, we pass it to the customer that controls it and help them respond. An authorized agent may make a request for you if they show written permission from you. Customers can ask for our data processing agreement. We may decline a request that is manifestly unfounded or excessive, or where a legal exception applies; if we do, we will tell you why and how you can challenge the decision.
| Where you live | Your rights | We respond within | Complaints |
|---|---|---|---|
| EU, EEA, UK | Access, correct, delete, restrict, port, object (always, for direct marketing), withdraw consent | 1 month, extendable by 2 for complex requests | Your local data protection authority where you live or work, or where the issue arose (France: CNIL; UK: ICO) |
| Canada | Access, correct, withdraw consent. Quebec adds portability, an explanation of automated decisions, and de-indexation. | 30 days | Office of the Privacy Commissioner of Canada, or your provincial commissioner (Quebec: CAI) |
| California | Know, delete, correct, opt out of sale or sharing, limit use of sensitive data, no discrimination for using your rights | Acknowledge in 10 business days; answer in 45 days, extendable by 45 | California Privacy Protection Agency |
| Other U.S. states with privacy laws (where the law applies to us) | Access, correct, delete, port, opt out, and appeal a refusal within 60 days | 45 days, extendable by 45 | Your state Attorney General |
Our legal bases (EU and UK). We rely on performing our contract with your organization to provide the service; on our legitimate interests to secure, analyse and improve it and for business-to-business marketing; on your consent for marketing and non-essential cookies, and for Platform analytics and session recording, where the law requires it; and on legal obligations. You can ask for our legitimate-interests assessment. For recruiting, we rely on steps you ask us to take before entering into a contract, and on your consent to keep your application for future roles. To establish, exercise or defend legal claims, we rely on our legitimate interests.
Consent (Canada). In Canada, we rely on implied consent for processing a user of a business platform would reasonably expect, such as signing you in, logging activity for security and supporting you. We ask for express consent where the information is sensitive or the law requires it, including under Quebec Law 25. You may withdraw consent at any time, subject to legal or contractual restrictions; doing so may affect our ability to give you access to the Platform.
Representatives. We have not appointed a Data Protection Officer because the law does not require one for our processing. Our Privacy & Security Manager, at privacy@enlaye.com, is accountable for privacy, including as the designated person under Quebec Law 25. Enlaye SAS is our establishment in the European Union. We have not appointed a UK representative.
10. Breaches, changes and contact
If there is a breach. For Customer Data, we tell the affected customer without undue delay and help it meet its own notification duties. For data we control, we notify the relevant authority within 72 hours where the law requires it, and tell you directly if the breach is likely to put you at high risk.
Changes. We will post updates here with a new date. For material changes we give at least 30 days' notice through the Platform, unless the law requires a change sooner. Where the law requires, we will also tell you directly. Previous versions are available on request.
Cookies. How we use cookies and similar technologies is set out in our Cookie Policy.
Links to other sites. Our websites and the Platform may link to third-party sites. We are not responsible for their content or privacy practices, so please read their privacy policies before giving them personal data.
Contact. privacy@enlaye.com · General enquiries: contact@enlaye.com · Enlaye, Inc., 114 Western Avenue, Boston, MA 02134, USA · Enlaye SAS, 3 rue Albert Priolet, Saint-Germain-en-Laye, France