Privacy

Your account. Your email address, and, if you sign in with Google, the name and profile picture Google provides. We never see or store your Google password. If you sign in with an email address and password instead, we store only a one-way cryptographic hash of that password, from which the password cannot be recovered.

Waitlist requests. If you asked for early access while we ran a waitlist, we keep the email address you give us and any name, role or note you add, together with the network address the request came from. The address is kept only so we can tell a person from a script filling the form repeatedly. If you would like that record removed before you sign up, ask us and we will delete it.

Product updates. When you joined the waitlist we sent one email asking you to confirm the address. You are added to the updates list only if you tap the link in it; if you ignore that email, we do not email you again. This is so nobody can put someone else’s address on our list. Every update carries a one-click unsubscribe link, and unsubscribing does not remove your request for early access. We record when we asked, when you confirmed, and when you opted out if you do. People who joined the waitlist before the form said this were told we would only email them when access opened, and we have kept them off the updates list; they are added only if they join again and confirm. Once you unsubscribe, neither submitting the form again nor an old confirmation link puts you back on the list. Update emails come from a different sending address than the ones your account depends on, such as password resets. We do not sell or share these addresses, and we do not use them for advertising anywhere else.

Your content. The notes and files you upload (Markdown, plain text, PDF, Word, Pages, RTF, CSV, JSON or HTML), text you paste, files from public GitHub repositories you choose to import, the answers you give in the onboarding interview, messages you send from any messaging channel you connect, and the messages and programs Fen writes from them. This is the substance of the product and it is stored until you delete it.

Your subscription. Whether it is active, and identifiers that let us match your account to your record at our payment provider. Card numbers are handled entirely by Stripe and never reach our servers.

Operational logs. Errors and request failures, kept so faults can be diagnosed. These can include your account identifier, and a summary of a failure may be emailed to us so we find out about a fault without waiting for someone to report it. They do not include the content of your notes.

Dictating in a browser with built-in speech recognition sends us text, not audio. When you use the microphone in the interview or the quick-capture box in a browser that offers speech recognition (such as Chrome or Edge), your browser and the speech service it uses turn your voice into text, and only that text reaches us. It is saved exactly as if you had typed it.

Recordings are sent to be transcribed. When your browser has no speech recognition, when you record a meeting in Fenlio, or when you drop a recording into a folder, the audio is sent to our server and passed to a speech-to-text provider (see below) to turn it into text. When you record a call with the call recorder, the audio is sent in short pieces while you talk, so the words can appear as you go. We keep the text, as a note once it is saved. We do not keep the audio. When a coach turns on screen reading during a call, Fen reads the words on the shared screen about every twenty seconds, whenever it has changed, and keeps only that text. We do not keep the pictures. If you record a meeting or a call, tell the people in it, and ask for their consent wherever the law requires it.

Sending a voice message from Telegram or WhatsApp is different, and we would rather say so plainly. If you connect one of those channels and send a voice memo, that audio necessarily leaves your device: the messaging platform holds it, our server downloads it, and we pass it to a speech-to-text provider (see below) to turn it into text. We keep the text as a note. We do not store the audio, and it is not written to our database or any file we keep, but it does pass through our servers and through that provider. If you would rather no audio reached us, dictate in a browser with built-in speech recognition, or dictate on your phone and send the text.

In an organization, each client has its own workspace. An administrator may let a client workspace draw on the organization’s library workspaces (house standards, rate cards); a client workspace never draws on another client’s. An administrator may also invite the client as a guest: a guest sees only the finished work the team has approved and marked as shared with them, and who approved it and when. A guest never sees the notes, sources, facts or work in progress behind it.

The weekly summary of a client workspace goes to the team members of that workspace who have chosen to receive it (by default its administrators and assistants), each with their own one-click unsubscribe; a notice that a connected tool needs reconnecting goes only to its administrators. A client guest never receives either.

Anthropic, the text of your notes is sent to Anthropic’s API so agents can file them, spot duplicates and contradictions, pull out the facts they state (prices, dates, scope, policies) so disagreements between your notes can be found, draft your interview answers when you ask for that, draft in Studio (a Studio draft also carries the rules you wrote for your workspace, the approved examples you chose to keep, and, in an organization, the house rules, profile, notes and verified facts of the library workspaces an administrator chose for that client workspace), and work out what to do when you give an agent an instruction. In that last case Fen decides for itself which of your notes and connected tools to read before it writes anything, so more of your material may be sent than for a single reply. Only what it actually read is sent, and never your account details.

GitHub, Notion and Google Drive, only if you import from one of them, and only what you point us at. We fetch the files or pages you choose from that provider’s servers; the provider sees that request and none of your other content. For Google Drive we ask only for access to the files you hand over through Google’s own file picker, never your whole Drive. Notion only ever gives us the pages you shared with Fenlio when you connected it. Within those, the same connection lets us search page titles when you or an agent you instructed asks for them, create a new page when you press Approve & Send on a draft, and add text to the end of an existing page when you approve that change.

Resend, email delivery. Resend handles the messages we send you: password resets, team invitations, notices about your subscription, and the check-in summary of what Fen has been doing. Those messages carry your email address and, in the case of the check-in, counts and headings: how many notes were filed or changed, the name of something waiting for your approval, and, when your precedence rules settled a disagreement between your notes, a one-line summary of it (the values that disagreed and which one now stands). They do not carry the text of your notes. Every automated email carries a one-click unsubscribe, and you can turn the check-in off at any time from your account page (or, in an organization’s client workspace, from that workspace’s Cadences page).

Resend also carries written work when you choose to send it. If you press send on something Fen wrote and give an address, we email it to the address you typed. That is the only circumstance in which any of your content is emailed to somebody other than you, it happens only when you ask for it, and the address is the one you entered rather than anything we look up. Nothing is ever sent to your contacts on your behalf, and nothing is sent automatically.

A speech-to-text provider (Groq or OpenAI, running Whisper), only when there is a recording to transcribe: a voice message from a connected messaging channel, a recording made in Fenlio, or a recording you drop in. The audio is sent to them to be turned into text, and the text comes back to us. They receive the recording and nothing else, no notes, no account details. Dictation handled by your browser’s own speech recognition never reaches them.

Telegram, WhatsApp, Instagram and Messenger (Meta) and Twilio, only if you connect one of those channels. Messages you send to Fenlio through them pass through that platform first, which is inherent to using it, and the platform sees them exactly as it sees any other message you send. We receive the message, save it as a note, and reply in the same chat. On Instagram and Messenger, Meta only lets us reply inside 24 hours of your client’s last message, so anything older waits for them to write again.

Your calendar — Google Calendar, Microsoft Outlook, or any calendar you add by its private iCal link (Apple iCloud, Fastmail and others) — only if you connect it. We ask Google and Microsoft for read-only access, and an iCal link is read-only by nature. We read one thing: the events on that calendar for the day (or the week, for a weekly preview), so a briefing can tell you what is coming. We never write to your calendar, never create or change an event, and never invite anyone. A pasted iCal link works like a password to that calendar, so we store it encrypted and never show it back. You can disconnect any of them from your account page at any time, and revoke access from Google or Microsoft, or reset the link in your calendar app.

Gmail, Google Docs, Slack and Linear, only if you connect one and only when you press Approve & Send — on something Fen wrote, or on a plan an agent proposed to you. Nothing is ever sent without that press. Gmail receives a request to create a draft in your own Drafts folder. It stays unsent until you press Send in Gmail, or press Approve and send in Fenlio, which first rewrites the Gmail draft to the text you approved and then asks Gmail to send it from your account to the address you entered. Google Docs receives a request to create a new document holding that draft’s text, in a scope that can only see documents it creates, never your existing Drive. Slack receives the draft’s text, formatted as a message, and posts it to a channel our bot has been invited to in your Slack workspace. Linear receives a title and description and creates an issue from them. None of the four reads anything back out of Fenlio; each one only ever receives the draft you chose to send, at the moment you sent it.

Google user data. Fenlio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features you turn on and can see in Fenlio, never for advertising, never sold, and never used to train AI models. No person at Fenlio reads it unless you ask us to for support, it is needed for security or abuse investigation, or the law requires it.

Changing something that already exists. If you connect Linear or Notion, an agent can also propose changing a record already there: moving a Linear issue to a different state, or adding text to the end of a Notion page. To show you the change, we first read that record’s current value from the tool, and we keep that value so the change can be undone. Nothing is changed until you press to approve it, and the old value is deleted with the rest of your data if you delete your account.

Reading from Slack, Linear and Notion. Separately from sending, if you connect Slack, Linear or Notion you can ask Fenlio to read from them: the recent messages in one Slack channel you name, or your recently-updated Linear issues, or the titles of Notion pages you shared with Fenlio. This happens when you ask for it on the page, or when an agent you gave an instruction to decides it needs that material to carry the instruction out. What comes back is stored in your workspace as a fixed snapshot of that moment, so that what you approve is what was actually read. We never post to Slack, change a Linear issue or edit a Notion page except through an approval you press, and a connection made before we asked for read access cannot read until you reconnect it.

Keeping sources in sync: Notion, Slack, HubSpot, Salesforce and Google Drive folders, only if you (or your organization’s admin, for a client workspace) add a sync source. On its own schedule Fenlio then re-reads exactly what that source names: the Notion pages shared with Fenlio, one Slack channel’s recent messages and threads, one kind of CRM record, or one Drive folder. From HubSpot that is contacts, companies, deals or notes; from Salesforce, accounts, contacts, opportunities or notes. Of those records we keep only a fixed list of fields: a contact’s name, email address, job title, department, company and lifecycle stage; a company’s name, website, industry, type, employee count, annual revenue and lifecycle stage; a deal’s name, stage, pipeline, type, probability, amount, currency and close date; and a note’s title, date and text. We never keep phone numbers, addresses or custom fields. From Slack we read the messages in the channels you add as sources (and ask Slack whether each channel is private, so a private channel’s messages are held back until an administrator confirms they may be shared with the whole workspace); Slack may also notify us that a channel changed, which we use only to schedule the next read and do not store. These connections are read-only: sync never changes anything in those tools. When something is removed there, the matching notes stop being used by Fen but are kept, and you can delete them. Reading whole Drive folders needs a Google permission that is switched off until Google has reviewed Fenlio; until then Drive works only through the file picker above.

A location lookup and a weather service, and only if you turn the Morning Brief on. To put a weather line in that email we need to know roughly where you are, so at the moment you switch it on, your network address is sent once to ip-api.com, which returns an approximate city and coordinates. Those coordinates then go to Open‑Meteo to fetch the forecast. Neither service receives your notes, your email address, or anything else about you, and the lookup happens once rather than on every brief. Be aware that ip-api’s free service is not encrypted in transit, so treat it as a disclosure of your approximate location.

If you never turn the Morning Brief on, neither of those is ever contacted. Your timezone, which the product uses to know when “morning” is for you, is read from your own browser and not from your address, so nothing leaves the page to obtain it.

Stripe, payment processing. Stripe receives your billing details directly; we receive back only your subscription status and an identifier.

Our hosting, database and cache providers, store the data described above so the product can run. The cache holds short-lived operational values such as request counters, not your notes.

Meta, advertising measurement, and only on our public marketing pages (the home page, pricing, features and the like). If you arrive from one of our ads, a Meta pixel on those pages tells Meta the page was viewed, so we can tell which ads work. It is not loaded on the sign-in page or anywhere inside the product, so it never sees your notes, your workspace, your email address, or any page you visit once you are signed in.

Plausible, page-view counts, also only on our public marketing pages, so we can tell which pages people find us through. It sets no cookies, records the page path without any query string, and is never loaded inside the product or on the sign-in page.

That is the complete list of processors we choose, and we do not sell or share your content with anyone else. Inside the product, every page you see once you are signed in, there are no analytics, advertising or tracking services of any kind.

Every outside service that may receive data from Fenlio, what it receives, and when. Services marked “only if connected” receive nothing unless you (or your organization’s administrator) connect them.

• Railway (hosting): runs the application; everything described on this page passes through it. Always.
• Neon (database): stores your account, notes, facts, the messages and programs Fen writes, and settings. Always.
• A Redis cache, where configured: short-lived request counters and locks, never note content.
• Anthropic (AI models): the text of notes being filed, compared, checked for facts or written from, and your instructions to an agent. Whenever those features run. When a coach turns on screen reading during a call, also still pictures of the shared screen, only so the words on it can be read.
• Resend (email): your email address and the messages described above; the text of something Fen wrote only when you send it to an address you type.
• Stripe (payments): your billing details, directly. Only if you subscribe.
• Groq or OpenAI (speech-to-text): the audio of a voice message, a recording made in Fenlio, or a recording you drop in. Only when there is one to transcribe.
• Telegram, WhatsApp, Instagram and Messenger (Meta) and Twilio (messaging): messages you send to Fenlio through them, and our replies. Only if connected.
• Google (Calendar, Gmail, Docs, Drive): Calendar events you let us read; an unsent Gmail email or Google Doc you approve; Drive files you pick; and, once Google has reviewed Fenlio, the contents of a Drive folder you add as a sync source. Only if connected.
• Microsoft (Outlook Calendar): calendar events you let us read. Only if connected.
• Notion: pages you shared with Fenlio (read, and when you approve, created or appended to). Only if connected.
• Slack: messages in channels you add as sync sources or ask us to read, and a message you approve posting. Only if connected.
• Linear: your recently updated issues when you ask, and an issue created or moved when you approve it. Only if connected.
• HubSpot and Salesforce (CRM): the record types and fixed fields listed above, read-only. Only if connected.
• GitHub: the public repository you choose to import. Only when you import one.
• ip-api and Open-Meteo: your network address once, then approximate coordinates. Only if you turn the Morning Brief on.
• Meta (advertising measurement): page views on our public marketing pages only, never inside the product. Only while that measurement is switched on; it is off today.
• Plausible (page-view counts): the path of a public marketing page you view and the site that referred you, with no cookies. Only while that measurement is switched on.

We will update this list before adding a service that receives your content.

Three features send data where you point them, and only if you set them up. API keys let an external tool you authorize read (or, if you grant it, write to) your workspace; anyone holding a key can use its permissions, so treat keys like passwords, and you can revoke one at any time from your account page. Webhooks send the events you subscribe to, such as check-in summaries or approval notifications, to a URL you configure. Whatever service runs that URL receives that data; choose it as carefully as you would any recipient of your notes. Sending written work emails it to an address you type, at the moment you press the button. In all three cases the destination is one you chose, so the care is yours: a mistyped address or a URL you do not control receives whatever it contains.

Inside the product, we set one cookie: the sign-in session that keeps you logged in. No advertising cookies, and no third-party trackers on any page you see once you are signed in.

On our public marketing pages, the Meta pixel described above sets its own cookie to recognise a returning visitor. You can block it with any tracker-blocking extension, or with your browser’s own settings, and the site works exactly the same either way.

The first time you visit one of our public pages, we also set one first-party cookie of our own recording which page that was, the site that sent you (its name only, never the full address) and any campaign tag in the link. If you then create an account, we keep that with your account so we know which pages bring people to Fenlio. It is never shared with anyone, and it expires after 90 days.

Your account page has both, and neither requires contacting us or having an active subscription. Download my data gives you a single file containing your notes in full, the folders they were filed into, the connections found between them and everything Fen wrote.

Deleting your account removes your account, all your notes, connections, conflicts and written work immediately and permanently, and cancels any subscription first. We cannot restore it afterwards.

Depending on where you live you may also have rights to correct your data, object to processing, or complain to a regulator. Write to us and we will act on it.

Your content is kept until you delete it or your account. Operational logs are retained for a short period for diagnosis. Records we must keep for tax or accounting reasons are retained for as long as the law requires, even after an account is deleted.

Fenlio , support@fenlio.io