Privacy Policy

1. Who we are

This Privacy Policy describes how TODO: [LEGAL ENTITY] ("we", "us") collects and uses information when you use Tenon.

2. What we collect

• Account info: name, email, shop name, password hash, login timestamps.
• Customer Content: estimates, invoices, rates, client records, drawings, photos, notes.
• AI usage data: prompts sent, model used, token counts, estimated cost.
• Technical data: IP address, browser, device, error logs, page-view analytics.
• Billing data: handled by our payment processor; we store only a customer reference and plan tier.

3. How we use it

• To operate the Service (storing your estimates, generating PDFs, sending invoices).
• To bill you and prevent fraud.
• To send service emails (receipts, reset links, important changes). Marketing emails only with consent.
• To debug, monitor performance, and prevent abuse.
• To train and improve AI models — see Section 5 of the Terms. Drawings used for training are stripped of direct personal identifiers (client names, addresses, phone numbers, prices) before training.

4. Who we share it with

• Cloud hosting & database: our infrastructure provider stores Customer Content on our behalf.
• AI providers: prompts and (for drawing features) image data are sent to AI model providers to generate output. They process the data under their own terms; we do not authorize them to train their own foundation models on your data when an opt-out is available.
• Email delivery, analytics, error monitoring, payment processing: standard sub-processors limited to what's needed for the feature.
• Legal: when required by law, court order, or to protect rights and safety.

We do not sell your personal information.

5. Retention

We retain Customer Content while your account is active and for a reasonable period after termination to allow recovery and meet legal obligations. AI training datasets derived from your drawings may be retained indefinitely in de-identified form.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal information. Email TODO: [CONTACT EMAIL] to make a request. We will respond within the timelines required by applicable law.

7. Security

We use industry-standard safeguards (TLS in transit, encryption at rest, row-level access controls, audit logs). No system is perfectly secure; you use the Service at your own risk.

8. Children

The Service is not intended for anyone under 18. Do not use it if you are under 18.

9. International transfers

Your data may be processed in countries other than your own. By using the Service you consent to such transfers, subject to appropriate safeguards required by law.

10. Changes

We may update this Policy. Material changes will be announced in-app or by email. The "Last updated" date above always reflects the current version.

11. Contact

Privacy questions: TODO: [CONTACT EMAIL] .