Privacy Policy
Last updated: August 2026
1. Who We Are
Entwine Limited, a company registered in England and Wales (company number 16880590), is the controller of the personal data described in this policy — except for the business data your organization uploads into its workspace, for which your organization is the controller and Entwine acts as processor. This policy explains how we collect, use, store, and protect information when you use our platform. Contact: privacy@entwineapp.io.
2. Information We Collect
Account Information
When you register, we collect your name, email address, company name, and password (stored only as a salted cryptographic hash). When you accept our Terms & Conditions at signup we record the acceptance — the terms version, timestamp, IP address, and browser — as evidence of the agreement. We also record your login history (timestamps, browser, and approximate location) for security purposes.
Business Data
You may upload or create business data including party records (partners, customers, contacts), opportunities, engagements, documents, tasks, and messaging content. This data is stored within your organization's isolated tenant and processed on your organization's instructions.
Usage Data
We collect anonymized usage metrics to improve the Service, including page views, feature usage patterns, and performance data. We do not sell or share individual usage data with third parties.
Payment Information
Subscription payments are processed by Stripe. Your card details are entered on Stripe's systems and never touch our servers; we hold only your subscription status and invoicing records.
3. How and Why We Use Your Information
We use your information to: (a) provide and maintain the Service (performance of our contract with you); (b) authenticate your identity and secure the platform (legitimate interests); (c) communicate about your account (contract); (d) calculate ecosystem intelligence metrics (CDE, CSI, ECS) on your organization's instructions (contract); (e) improve the Service using anonymized usage data (legitimate interests); (f) comply with legal obligations. Where we rely on consent for optional processing, you may withdraw it at any time.
4. Data Storage & Security
Your data is stored in PostgreSQL databases on infrastructure we control. Uploaded documents live in private object storage that our storage provider encrypts at rest, and are served only through short-lived signed links. All data transmission uses TLS. Access is controlled through token-based authentication carried in HttpOnly, Secure cookies, with row-level security and client-scoped query filters ensuring isolation between organizations. Our security practices are described in detail on our security page.
5. Multi-Tenancy
Entwine is a multi-tenant platform. Your organization's data is logically isolated using Client ID scoping with global query filters that fail closed. No other organization can access your data. Administrative operations that cross tenant boundaries require explicit authorization.
6. Where Your Data Lives & International Transfers
The Service is hosted on DigitalOcean infrastructure in the United States. Because Entwine Limited is a UK company, transfers of UK/EEA personal data to our US-based hosting are made under our data processing agreement with DigitalOcean, which incorporates standard contractual clauses (with the UK Addendum). The same mechanism applies to the subprocessors listed below where they process data outside the UK/EEA.
7. Subprocessors & Data Sharing
We do not sell your data. We share data only with the service providers needed to operate the platform:
- DigitalOcean — hosting and object storage (US)
- Stripe — payment processing
- Resend — transactional email delivery
- OpenAI — AI-assisted features (classification, extraction)
- Microsoft Azure Document Intelligence — document text extraction (OCR), where enabled
We may also disclose data to law enforcement when required by law, or in connection with a merger or acquisition, with prior notice.
8. AI & Document Processing
If you use Document Intelligence or AI-assisted features, your content may be processed by the AI subprocessors above for text extraction, classification, and entity extraction. Content is transmitted securely, is not retained by these providers beyond the processing request, and is not used to train their models. Extracted data is stored within your tenant, and nothing enters your workspace without your review and approval.
9. Cookies
We use essential cookies for authentication (access tokens stored in HttpOnly cookies) and session management. We do not use tracking cookies or third-party advertising cookies.
10. Your Rights
You have the right to: (a) access your personal data; (b) correct inaccurate data; (c) request deletion of your data; (d) export your data in a machine-readable format; (e) object to or restrict certain processing; (f) withdraw consent for optional processing. Contact us at privacy@entwineapp.io to exercise these rights. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
11. Data Retention
We retain your data for as long as your account is active. Upon account termination, you have 30 days to export your data. After that period, data is deleted within 90 days, except where retention is required by law.
12. Children's Privacy
The Service is not intended for users under 16 years of age. We do not knowingly collect data from children.
13. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 14 days before they take effect.
14. Contact
For privacy-related questions or requests, contact us at privacy@entwineapp.io, or write to Entwine Limited, 40a Salisbury Avenue, St Albans, AL1 4TU, England (company number 16880590).