Legal

Privacy Notice

What we collect, who processes it for us, how long a decision and its receipt are kept, what erasure does not reach, and how to exercise a right. Including the paperwork that does not exist yet: no executed DPA, no standard contractual clauses, no zero-data-retention addendum.

Tenhaw LTD, registered in England and Wales, company 12735685Last updated 16 October 2026privacy@entitybind.com

Self-serviceCreate your workspace online and verify your email to start matching company records. Free starts with 300 credits and no card. Paid monthly plans are available in workspace Billing; VAT is added where applicable. Usage is tracked without automatic overage charges. Trust and security

Clauses

AI voice conversations 1. Who we are, and what this notice covers 2. The two relationships, and which one you are in 3. What a caller submits, and which of it can be personal data 4. Personal data that comes from the registers we read 5. What this website collects 6. Our lawful basis for the data we control 7. What we do not assert about the data you control 8. Who processes data for us 9. What reaches the model provider, exactly 10. Where the processing happens 11. How long we keep it 12. How your data is kept apart from another customer's 13. Your rights, and the call that performs each one 14. What erasure does not reach 15. Cookies and what this site loads 16. What this notice is not 17. Complaints 18. Changes, and how to reach us

Clauses

19 clauses. Each has its own link, so you can send a colleague the one clause they asked about.

AI voice conversations
1Who we are, and what this notice covers
2The two relationships, and which one you are in
3What a caller submits, and which of it can be personal data
4Personal data that comes from the registers we read
5What this website collects
6Our lawful basis for the data we control
7What we do not assert about the data you control
8Who processes data for us
9What reaches the model provider, exactly
10Where the processing happens
11How long we keep it
12How your data is kept apart from another customer's
13Your rights, and the call that performs each one
14What erasure does not reach
15Cookies and what this site loads
16What this notice is not
17Complaints
18Changes, and how to reach us

AI voice conversations

Kawl Now provides the optional AI voice widget on this website. The widget loads from app.kawlnow.com, which receives the browser request information needed to serve it. If you start a conversation, your question and the AI answer are processed to provide the service and saved in a transcript that our team can review. Microphone access requires your browser permission; you can end the conversation at any time. Please keep passwords, payment details, customer records and sensitive personal information out of the conversation. Contact us through this website for questions about a transcript or a privacy request.

1. Who we are, and what this notice covers

Entity Bind is a product of Tenhaw LTD ("we", "us"), a company registered in England and Wales, company number 12735685, VAT GB388977014, based in London, England. Entity Bind has no legal personality of its own, so the entity bound by this notice, and by any agreement you sign, is Tenhaw LTD. This notice covers three things: personal data collected through entitybind.com, personal data collected when you correspond with us or evaluate the product, and the personal data that can be present in what a caller submits to the Entity Bind API or MCP server on a deployment we operate. It does not cover a deployment you run yourself, where we hold nothing and are not in the data path at all.

2. The two relationships, and which one you are in

We are the controller for the data we decide the purposes of: what the website collects, what you send us in correspondence, the account and credential records behind an API key, and the usage ledger that records what a call cost. We are a processor, acting on your instructions, for the contents of a file or a payload you submit for resolution — that data is yours, you decide why it is being processed, and we process it to answer the question you asked and for nothing else. Both relationships can apply to the same organisation at the same time. Where they conflict, the processor position is the narrower one and it governs your submitted records.

3. What a caller submits, and which of it can be personal data

Entity Bind resolves companies and organisations, and the record it takes is a company record: a name, a company number, an LEI, a domain, an address, a country, a free-text context field, and an extra map of up to 50 further key-value pairs. Most of that is not personal data. Some of it can be. A registered address is a person's home address for a great many small companies; a sole trader's company name is their name; a CRM export mapped column-for-column into extra frequently carries a contact name, an email address or a phone number that nothing in the API asked for. We do not require those fields and we do not use them to resolve anything, but we receive whatever you send, so treat the payload as personal data unless you have checked that it is not.

4. Personal data that comes from the registers we read

Two deliberate exceptions to a company-only rule, both open-licensed registry data, both listed rather than discovered. UK officer and person-with-significant-control names, roles, appointment and notification dates come from Companies House under the Open Government Licence; French officer names and roles, including a corporate officer's own registration number, come from SIRENE under Licence Ouverte 2.0. Everything else about a person is discarded at ingestion rather than filtered on the way out: dates of birth, birth years and nationalities never become a stored fact, and the API type for an individual owner has no field that could carry one. A French sole trader is handled a step earlier still, where the adapter stores nothing at all and returns only the citation, because for that legal form the person is the company.

5. What this website collects

Page views, referring source, approximate country and device type are measured through Plausible, which sets no cookies, stores nothing on your device and builds no cross-site profile. It also records which calls-to-action you press, which sections you reach, how far you read, which plan you choose, the outcome of a homepage company check, outbound clicks and file downloads. Automatic page and scroll signals do not count as an intentional interaction when calculating bounce rate. These measurements are tied to a page and a day rather than an account, and still run when you decline Google Analytics; an explicit Do Not Track or Global Privacy Control signal disables this cookieless measurement. Google Analytics loads only with your analytics consent and a configured property; none is configured for this site today.

When you reach the homepage booking section, the calendar loads from Cal.com, which receives the browser request data needed to serve it. If you book a call, Cal.com processes the name, email address, selected time and any answers you enter in its booking form; see cal.com/privacy for its notice. We receive those booking details to arrange the call.

If you use the on-page assistant, your question goes to our server and Anthropic to generate an answer. A live homepage company check sends the name and context to our server and the resolution API, where clause 3 describes their processing. When you request the result by email, we collect the company name, the optional context and your reply address. We save those three fields in a private store and send a copy to the inbox a person reads. The form confirms receipt only after storage succeeds; an unavailable email notification does not erase the saved request. Analytics records that the request form opened, a submission was attempted, and whether it was stored or failed, using a fixed failure category. Your company name, context and address never enter analytics. The server holds an IP-based rate-limit counter in memory for a few minutes; no IP is written into the request record. If you email us directly, we hold your address, organisation and correspondence, including any attached file.

Start free and /signup open the workspace on app.entitybind.com. Account signup collects a company name, work email and password for authentication through Supabase; confirming your email establishes your account and opens a Free workspace. Account and workspace membership records are separate from homepage requests. Necessary secure cookies maintain your login and protect requests against forgery. Cookieless signup measurement records the signup screen, submission or rejection, confirmation-email request, email confirmation, workspace creation, and a successful CSV preview and rendered result, including the fictional sample, at most once per page. Only a fixed plan choice and failure category accompany those events. The analytics URL is a fixed /app path: no query, email-link fragment, password, token, account id, company, email or file content is sent. The browser user agent and server-validated IP are forwarded transiently for anonymous same-day counting and are not written into our database by this measurement relay. Preview and result-view events describe that page session, not your lifetime use of the service.

Earlier applications submitted through the former /signup form remain private correspondence. They contain the name, work email, company, chosen use case and optional row band and referral answer supplied at the time; the optional text behind Other stays in that private record. Their historical Application Submitted analytics event contained only the chosen use-case and referral-option slugs. /signup now redirects to workspace signup and no longer collects those application fields.

6. Our lawful basis for the data we control

Correspondence, a company-check request, an earlier application for access, evaluation and the issuing of an API key are processed to take steps at your request before entering a contract, or to perform one. The account, credential and usage records behind a key are processed on the basis of our legitimate interests in operating and securing the service and in being able to evidence what it did, balanced against the interests of the people named in them; the same basis covers the decision audit trail, which exists so a merge can be reopened and challenged. Site analytics beyond the cookieless measurement above are processed on consent, which you can withdraw at any time. We do not sell personal data, we do not use it for advertising, and we do not use anything you send us to train a model.

7. What we do not assert about the data you control

This clause is here because a privacy notice that quietly filled the gap would contradict our own assurance page. For the personal data inside a file you send us, the controller determination, the lawful basis, the purpose limitation and any data protection impact assessment are yours, not ours, and the documents that would ordinarily record our side of that relationship do not exist yet: there is no executed data processing agreement, no standard contractual clauses package ready to sign, no record of processing activities and no zero-data-retention addendum with the model provider. What is published instead is what the code actually does, on our security page and in the clauses below. If your review requires an executed DPA before live data moves, you cannot complete that review today, and we would rather you learned it here than in week three.

8. Who processes data for us

Sub-processors reached today: Anthropic, Companies House, GLEIF, SEC EDGAR, INSEE SIRENE, filings.xbrl.org (ESEF), Brønnøysund Register Centre, PRH / YTJ, ARES and KRS. Wired but silent unless an operator sets a credential, and named because configuring one makes them a sub-processor that day: MoltSets, QuickEnrich, EUIPO and USPTO. The database and, where deployed, the shared rate-limit cache sit inside the deployment rather than being an onward transfer. There is no reseller and no data broker on a deployment holding no vendor credential. The adapter inventory describes resolution providers. Nothing records or replays a workspace session. Website requests, workspace authentication and cookieless measurement use the processors below, outside the resolution-adapter inventory. Plausible Insights OÜ, in Estonia, receives the cookieless measurement described in clause 5 unless an explicit browser privacy signal disables it. Vercel Inc., in the United States, serves the site and terminates its requests, so it sees the IP address of anyone who loads a page; it also holds homepage company-check requests and earlier /signup applications, written to a private Vercel Blob store as dated JSON records. Those objects are private rather than merely unlisted: reading one takes authentication, and a URL on its own does not open it. Resend Inc., in the United States, delivers request notifications to the inbox a person reads, receiving the company name, context and reply address for a company check. For earlier applications it received the name, work email, company, use case and row band in that notification. The workspace uses Supabase for account authentication and confirmation emails; Supabase receives the email, password and company-name metadata needed for signup, while workspace membership is stored in the application database. Cookieless workspace measurement is sent to Plausible through the app server as described in clause 5. Cal.com serves the homepage booking calendar and processes the booking details described in clause 5. These authentication and measurement processors are separate from the resolution-provider adapter inventory. This list is kept honest by a build-failing test that reads the request URL off every wired adapter and fails the product's continuous integration if a host is missing from it, which exists because the list had already gone stale once. The full table behind that derived list, with the hosts each one is reached at and what each receives, is on our security page; website, authentication and measurement processors are named separately above because they are outside that resolution-provider table.

9. What reaches the model provider, exactly

Only records that escalate past probabilistic scoring reach a model at all, and a call capped at that depth reaches no model provider and no registry, enforced in code rather than promised. On the records that do escalate, the adjudication prompt renders every populated scalar field on the submitted record, including the submitted address, plus the free-text context and every entry of the extra map: a CRM column mapped into extra reaches Anthropic verbatim. On a research call, the search queries and the fetched URLs reach them as well, so if which companies you are looking at is itself sensitive, that signal travels. Two things do not exist and should not be assumed: a zero-data-retention addendum, and any code-level enforcement of the provider's not-used-for-training term, which is a contractual commitment of theirs rather than a control of ours.

10. Where the processing happens

There is no managed multi-region offering and no region to select. The product is one container plus a database, configured entirely by environment variables, and it runs where it is deployed — including a deployment we operate for a customer, whose location we will tell you before you send anything. Data residency is therefore a conversation about where that deployment sits rather than a checkbox, and it does not change the sub-processor calls in clause 8, which reach United States services (Anthropic, SEC EDGAR), United Kingdom and global ones (Companies House, GLEIF), and services operated by the French state (SIRENE). Where personal data is transferred outside the United Kingdom or the EEA by one of those calls, the transfer rests on the receiving service's own terms; we have not executed our own transfer mechanism, and clause 7 says so.

11. How long we keep it

The caveat comes first, because it is the sentence most likely to be quietly wrong in a real deployment: nothing purges itself. There are four retention windows, each its own maintenance command an operator has to schedule, and an unscheduled deployment retains everything indefinitely. The defaults are 2,555 days for decisions, submitted records and the usage ledger, and 365 days for open review items nobody ever worked. Seven years is not a template number: it clears the money laundering regulations' five-year duty to retain the evidence behind a customer due-diligence decision, because for a know-your-business customer the decision trail is that evidence. Every window is a setting you can shorten, at whatever cost to your own audit position. Correspondence and evaluation records are kept for up to 24 months from your last contact with us, or for the life of the relationship plus six years if you become a customer. A homepage company-check request or an earlier /signup application is correspondence for the purposes of that window, and the window covers both copies of it: the JSON record in the private store and the mail sitting in the inbox. So does the caveat this clause opened with — neither copy expires on its own, and deleting one is a person doing it rather than a job that runs. If you would rather yours went sooner than that, ask at privacy@entitybind.com and we will delete both.

12. How your data is kept apart from another customer's

Tenant scoping is enforced in the application. Every table carries a tenant id, every persistence method takes the tenant as a required argument with no default, so a call site that forgets whose data it is touching raises rather than silently reading a shared tenant, reads are scoped in SQL before retrieval rather than filtered after it, and the replay cache is keyed so that byte-identical content submitted by two customers resolves to two separate entities. A read against another tenant's id returns 404 rather than 403, because a 403 confirms the id exists. What this is not is database-enforced: one database, one schema, one runtime role, no row-level security, so a SQL-injection defect would cross every tenant at once. Encryption at rest is a property of the volume and the database underneath the application rather than of the application itself.

13. Your rights, and the call that performs each one

Under UK GDPR you have the right of access, to rectification, to erasure, to restrict or object to processing, to portability, and to withdraw consent where processing rests on it. For personal data we control, exercise any of them by emailing privacy@entitybind.com; we will respond within one month and usually within a week. For data inside your own tenant, most of these are API calls you can make yourself rather than a request you have to send us: erase a company (DELETE /v1/entities/{id}, or the erase-entity maintenance command), erase a submission that never resolved (DELETE /v1/records/{record_id}, or the erase-record maintenance command), find the records erasure would otherwise miss (GET /v1/records/unbound, or the list-unbound-records maintenance command), take everything with you (GET /v1/entities/export), join our evidence back to your own rows (GET /v1/records/by-ref/{client_ref}) and reverse a merge (POST /v1/entities/{id}/detach). There is deliberately no bulk delete and no delete-my-tenant button, because one call that empties a tenant is a support incident waiting for a typo: enumerate with the listing endpoints, then delete each id. We will run any of them on your behalf if you would rather ask than call.

14. What erasure does not reach

Erasing a company removes its facts, its blocking keys, every submitted record it holds, open review items embedding one of those records, the replay fingerprints, cached responses quoting it and the entity row, in one transaction. Four things survive, and a buyer should know all four before relying on the endpoint. The decision audit trail survives, and a decision row can carry cited evidence and an adjudication rationale that names the company; it expires on the retention window rather than on request. A human reviewer's written justification survives, because it is the four-eyes evidence, so a reviewer who types a company name into that box has put it somewhere erasure does not reach. A redacted settled review item still records that an abstention happened and how it was settled. And the usage ledger keeps the record id and what the call cost, never the record, because it is the billing evidence. If your erasure duty extends to no trace that a record was ever submitted, we do not meet it.

15. Cookies and what this site loads

Google Analytics loads only with your consent, and rejecting is exactly as easy as accepting. The analytics category covers Google Analytics only, and until you grant it the script is not on the page rather than loaded and suppressed. We honour Global Privacy Control and Do Not Track as a rejection, without showing you a banner. Plausible sits outside that gate: it sets no cookies, stores nothing on your device and cannot build a cross-site profile; we run it for visitors without an explicit Do Not Track or Global Privacy Control signal, so that we can count page views for people who decline Google Analytics, and we would rather say that here than rely on the exemption quietly. The Cal.com booking calendar also sits outside the analytics gate and loads when you approach the homepage booking section. Nothing on this site records or replays your session, there are no advertising or cross-site tracking cookies, and the fonts are served from this domain rather than fetched from Google.

16. What this notice is not

It is not a data processing agreement, and signing nothing here creates one. It is not standard contractual clauses, a transfer impact assessment, a data protection impact assessment or a record of processing activities, none of which we have written. It is not evidence of certification: there is no SOC 2, no ISO 27001, no third-party penetration test and no bug bounty, and none of those has been started. What it is, is an accurate description of what the code does and what we hold, published so that a reviewer can check it against the security page and against the product's own documentation rather than against a template. If that is not enough for your review, the honest answer is that it is not enough, and the conversation is worth having before the file moves rather than afterwards.

17. Complaints

If you are unhappy with how we have handled your personal data, tell us first at privacy@entitybind.com and we will answer. You also have the right to complain to the Information Commissioner's Office, the United Kingdom's supervisory authority, at ico.org.uk, and you do not have to raise it with us first. If you are in the European Union, you may complain to the supervisory authority in your own member state instead.

18. Changes, and how to reach us

We update this notice when the processing changes rather than on a schedule, and the date at the top of this page is generated from the last time the words actually changed rather than typed. A change that affects an existing customer is notified directly. For anything in this notice, for a data subject request, or to ask what we hold, email privacy@entitybind.com. For a security or assurance review, security@entitybind.com is the faster route and the assurance material comes back the same week, usually the same day.

Reviewing this for a data protection team?

Send the questions rather than a questionnaire. You will get a straight answer on what is enforced in code, what is an operational commitment a deployment could miss, and where the honest answer is that the document you are asking for has not been written.

Talk to us Plans and prices

For a guided review of your file, explore the Merge Safety Sprint →