Privacy Policy
Last updated: 27 September 2026
1. Who We Are
Entwine Limited, a company registered in England and Wales (company number 16880590), is the controller of the personal data described in this policy — except for the business data your organization uploads into its workspace, for which your organization is the controller and Entwine acts as processor. This policy explains how we collect, use, store, and protect information when you use our platform. Contact: privacy@entwineapp.io.
2. Information We Collect
Account Information
When you register, we collect your name, email address, company name, and password (stored only as a salted cryptographic hash). When you accept our Terms & Conditions at signup we record the acceptance — the terms version, timestamp, IP address, and browser — as evidence of the agreement. We also record your login history (timestamps, browser, and approximate location) for security purposes, and while you are signed in a trail of the pages and actions you request (path, method, outcome and timing — never the content you submit). Login history and IP addresses are kept for 13 months; the request trail for 90 days. You can see and end your active sessions from your profile.
Business Data
You may upload or create business data including party records (partners, customers, contacts), opportunities, engagements, documents, tasks, and messaging content. This data is stored within your organization's isolated tenant and processed on your organization's instructions.
Usage Data
We collect anonymized usage metrics to improve the Service, including page views, feature usage patterns, and performance data. We do not sell or share individual usage data with third parties.
Payment Information
Subscription payments are processed by Stripe. Your card details are entered on Stripe's systems and never touch our servers; we hold only your subscription status and invoicing records.
3. How and Why We Use Your Information
We use your information to: (a) provide and maintain the Service (performance of our contract with you); (b) authenticate your identity and secure the platform (legitimate interests); (c) communicate about your account (contract); (d) calculate ecosystem intelligence metrics (CDE, CSI, ECS) on your organization's instructions (contract); (e) improve the Service using anonymized usage data (legitimate interests); (f) comply with legal obligations. Where we rely on consent for optional processing, you may withdraw it at any time.
4. Data Storage & Security
Your data is stored in PostgreSQL databases on infrastructure we control. Uploaded documents live in private object storage that our storage provider encrypts at rest, and are served only through short-lived signed links. All data transmission uses TLS. Access is controlled through token-based authentication carried in HttpOnly, Secure cookies, with row-level security and client-scoped query filters ensuring isolation between organizations. Our security practices are described in detail on our security page.
5. Multi-Tenancy
Entwine is a multi-tenant platform. Your organization's data is logically isolated using Client ID scoping with global query filters that fail closed. No other organization can access your data. Administrative operations that cross tenant boundaries require explicit authorization.
6. Where Your Data Lives & International Transfers
The Service is hosted on DigitalOcean infrastructure in the United States. Because Entwine Limited is a UK company, transfers of UK/EEA personal data to our US-based hosting are made under our data processing agreement with DigitalOcean, which incorporates standard contractual clauses (with the UK Addendum). The same mechanism applies to the subprocessors listed below where they process data outside the UK/EEA.
7. Subprocessors & Data Sharing
We do not sell your data. We share data only with the service providers needed to operate the platform:
- DigitalOcean — hosting and object storage (US)
- Stripe — payment processing
- Resend — transactional email delivery
- OpenAI — AI-assisted features (classification, extraction, help assistant)
- Microsoft Azure Document Intelligence — document text extraction (OCR), where enabled
- Google Cloud Vision — alternative document text extraction (OCR), where enabled
The current list, including the enrichment lookups that receive company names only and the providers you can bring your own key for, is maintained at entwineapp.io/Legal/Subprocessors.
Our own marketing
Separately from the platform, we use Apollo.io to hold and contact the business details of people we approach about Entwine — name, work email address, job title, employer and publicly available company information. For that data we are the controller and Apollo is our processor, under its data processing addendum. Our lawful basis is our legitimate interest in business-to-business marketing, and every message we send carries an unsubscribe link.
Apollo receives no customer data from the platform. It is not a subprocessor of the Service, does not appear in the list above, and is not covered by our Data Processing Agreement, which concerns only the data customers put into Entwine. If you would rather we did not hold your details, email privacy@entwineapp.io and we will remove them.
We may also disclose data to law enforcement when required by law, or in connection with a merger or acquisition, with prior notice.
8. AI & Document Processing
If you use Document Intelligence or AI-assisted features, your content may be processed by the AI subprocessors above for text extraction, classification, and entity extraction. Content is transmitted securely, is not retained by these providers beyond the processing request, and is not used to train their models. Extracted data is stored within your tenant, and nothing enters your workspace without your review and approval.
9. Cookies
We use essential cookies for authentication (access tokens stored in HttpOnly cookies) and session management. We do not use tracking cookies or third-party advertising cookies.
10. Your Rights
You have the right to: (a) access your personal data; (b) correct inaccurate data; (c) request deletion of your data; (d) export your data in a machine-readable format; (e) object to or restrict certain processing; (f) withdraw consent for optional processing. Contact us at privacy@entwineapp.io to exercise these rights. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
11. Data Retention
We retain your data for as long as your account is active. Upon account termination, you have 30 days to export your data. After that period, data is deleted within 90 days, except where retention is required by law.
12. Children's Privacy
The Service is not intended for users under 16 years of age. We do not knowingly collect data from children.
13. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 14 days before they take effect.
14. Contact
For privacy-related questions or requests, contact us at privacy@entwineapp.io, or write to Entwine Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (company number 16880590).