Privacy policy
This policy explains how Ajenzo handles personal data, in line with the EU General Data Protection Regulation (GDPR). For a plain explanation of what happens on your computer and what uses our cloud, see Privacy & control.
1. Who is responsible
Ajenzo is a trade name of matan works, registered with the Dutch Chamber of Commerce (KvK) under number 98277952, VAT number NL005321442B69, Nassaulaan 6, 1182 BA Amstelveen, the Netherlands. Email: info@ajenzo.com.
We are the controller for the data of our customers and users that we need to run our business: accounts, billing, support, security and our website. When an organisation uses Ajenzo, it is the controller of the content its users process with Ajenzo (such as conversations, documents and connected sources), and we act as its processor under our data processing agreement. If you use Ajenzo as an individual, we are the controller of that content as well.
2. What we process, why and on which basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, email address, password (stored only as a secure hash), Google account ID if you sign in with Google, role, description and language preferences | Create and run your account, sign you in, tailor suggestions | Contract |
| Team: team name, members, invited email addresses | Let you work in a team and invite colleagues | Contract; legitimate interest for invitees |
| Conversations: transcript text with speaker labels and timestamps, meeting app and title, participants from your calendar if connected, the cards shown and your feedback | Provide live answers, let you review conversations, improve suggestions for you | Contract (as processor: instructions of your organisation) |
| Memory: facts about you, people and organisations derived from your conversations | Give context in later conversations. You can view, edit, delete or switch this off | Contract |
| Documents you upload and the searchable passages we create from them | Find answers in your own knowledge | Contract |
| Connected sources: encrypted access tokens and the results retrieved when you search (for example Gmail, Google Drive, Google Calendar, HubSpot, Notion, Jira, Linear) | Search the sources you chose to connect | Contract |
| Billing: Stripe customer and subscription IDs, plan, status, invoices. Card and bank details are handled by Stripe and never reach us | Take payment, invoice and meet tax obligations | Contract; legal obligation |
| Usage and security: signed-in devices, AI usage counts, request logs, IP address for rate limiting | Secure the service, prevent abuse, enforce fair use, fix problems | Legitimate interest |
| Communication: emails you send us and account emails we send you | Support, confirm your email, reset passwords, send invitations and service notices | Contract; legitimate interest |
| Pre-registration before launch: email address, optionally company name, the plan you chose | Tell you when Ajenzo opens and confirm your pre-registration | Consent |
| Website visits: technical logs of our hosting provider | Deliver and secure the website | Legitimate interest |
| Website analytics with PostHog: see section 8 | Improve the website and understand which channels bring visitors | Consent |
Audio is not uploaded: speech recognition runs on your computer and only text is sent to our cloud. We do not sell personal data, do not use it for advertising and do not use your content to train general AI models. We do not take decisions with legal or similarly significant effects based solely on automated processing.
3. People in your conversations
Ajenzo processes what other participants say in conversations you choose to transcribe. The user, or the organisation that uses Ajenzo, is responsible for informing those participants and for having a lawful basis, as set out in our terms. Participants can exercise their rights through the organisation that used Ajenzo, or contact us and we will forward the request.
4. How long we keep data
- Account, team, conversation, memory, document and connection data: as long as your account exists, unless you delete it earlier. You can delete documents, memory items and connections yourself and ask us to delete individual conversations.
- When you delete your account, we delete this data from our active systems immediately. Any backups are overwritten in their normal cycle.
- Unconfirmed sign-up, password reset and invitation links expire after 48 hours, 1 hour and 7 days respectively.
- Pre-registrations: until six months after launch, or earlier if you ask us to remove you.
- Billing records and invoices: 7 years, as required by Dutch tax law.
- Technical logs: as briefly as possible, in line with the retention of our hosting providers.
5. Who helps us
We use carefully selected providers (sub-processors) who process data only on our instructions under data processing agreements. The current list, including what they do and where, is on our sub-processors page. Sources you connect yourself, such as HubSpot or Notion, are your own providers; we access them on your behalf.
6. Transfers outside the EU
Our application and database run in the EU (Netherlands). Some providers are based in, or may access data from, the United States or other countries outside the European Economic Area. We only allow this with appropriate safeguards, such as certification under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.
7. Security
We protect data with measures appropriate to the risk, including encrypted connections (TLS), password hashing with Argon2id, encryption of stored access tokens (AES-256-GCM), hashed session tokens, strict access control, rate limiting and EU hosting. No system is perfectly secure; if a breach affects you, we will inform you and, where required, the Dutch Data Protection Authority.
8. Cookies and website analytics
With your consent, we use PostHog to measure how our website is used. PostHog is provided by PostHog Inc. and we use its EU region: the data is stored in Frankfurt, Germany. Requests from your browser pass through our own domain (ajenzo.com/ingest) before they reach PostHog.
If you accept, we measure page views, clicks, scroll depth, your device and browser, your approximate location derived from your IP address (PostHog does not store the full IP address), the referrer and campaign parameters (UTM), and we record sessions (session recordings) with all form inputs masked. We use this to improve the website and to understand which channels bring visitors. The legal basis is your consent.
If you decline, nothing that identifies your device is stored in your browser and no session recordings are made. We then only count visits anonymously, without cookies or other storage on your device. Until you make a choice, we count visits in the same anonymous way.
Your choice is saved in a cookie named ajenzo_consent for 12 months. You can change it at any time with the Cookie settings link in the footer of every page. PostHog keeps analytics data according to its default retention settings. The email address you enter when you pre-register is not sent to PostHog.
The Ajenzo account at app.ajenzo.com uses only functional cookies that are necessary for it to work: to keep you signed in, protect forms against cross-site attacks, remember your language and complete sign-in with Google. These do not require consent.
9. Your rights
You have the right to access, correct and delete your personal data, to restrict or object to processing, to data portability and, where processing is based on consent, to withdraw consent. Email info@ajenzo.com; we respond within one month. We may ask you to confirm your identity. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your country.
10. Children
Ajenzo is not intended for people under 18 and we do not knowingly process their data.
11. Changes
We may update this policy. We will notify you by email of material changes before they take effect. The date at the top shows the latest version.