Privacy Policy

This Privacy Policy explains how [LEGAL ENTITY NAME](“Tenon,” “we”) handles information in connection with the Tenon platform (the “Service”). It covers brokers, their teammates, and buyers who use a room.

For most content that brokers upload, the broker’s organization is the party that decides how that content is used, and we process it on their behalf — the terms of that processing are in our Data Processing Addendum. This policy describes our overall practices.

We collect:

• Account and identity data — your email address (your sign-in identity), your name and organization where provided, and your role.
• Deal content — the documents, deal details, pricing, and other materials a broker uploads to a room.
• Questions and messages — smart-ask questions and the human Q&A thread between buyer and broker.
• Engagement and usage data — activity within a room, such as which documents were opened or downloaded, time in the room, and similar signals, plus standard log and device data.
• Cookies and session data — a session cookie to keep you signed in, and, on public entry points, a bot-protection check.

We use information to:

• operate the rooms — authenticate you, store and organize documents, and control visibility across tiers;
• generate deal summaries, a searchable index, and grounded answers from a room’s documents;
• show a broker engagement signals about their own deal (these are private to the broker);
• send notifications you can control in your preferences;
• maintain security, prevent abuse, debug, and meet legal obligations;
• improve the Service, using aggregated or operational data — not your deal documents (see Section 4).

Deal summaries, document classification, and answers to questions are produced using a third-party AI provider, [CONFIRM: Anthropic (Claude)], which processes the relevant text to return a result. Summaries and the document index are generated once at intake and stored; the live AI surface is the smart-ask bar.

Your deal documents are not used to train shared or third-party AI models. We select our AI provider and configure our use of it so that content sent for processing is not used to train their general models. [VERIFY this matches the AI provider’s current terms (zero-retention / no-training), and keep this statement in sync with those terms]. We disclose our AI subprocessor in the DPA rather than in the product itself.

The Service separates information across visibility tiers — public teaser, shared room, and broker-private — and is designed so that broker-private information (such as engagement signals and private notes) is not reachable from a buyer or anonymous session. A buyer sees the room and materials shared with them; a broker sees engagement on their own deals. We treat this separation as an architectural property of the Service.

We share information only:

• with the people you direct — a broker with the buyers they invite; a buyer’s question with the broker on that deal;
• with service providers (subprocessors) that run the platform — for hosting, database and storage, AI processing, and email delivery — under confidentiality and data-protection terms. They’re listed in the DPA;
• if required by law, or to protect the rights, safety, and security of users and the Service;
• in connection with a merger, acquisition, or asset sale, subject to this policy’s commitments.

We do not sell personal information.

We keep information for as long as needed to provide the Service and for legitimate business or legal purposes. Deal content is retained for the life of the room and the broker organization’s account; on termination it is handled as described in the DPA (return or deletion). [SET specific retention periods (e.g. logs, backups, deleted-account grace window)].

We use technical and organizational measures appropriate to the Service, including row-level access controls enforced at the database, email-based authentication, encryption of data in transit and at rest through our infrastructure providers, and least-privilege access to production systems. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

You can manage notification emails from the preferences link in any non-essential email or in your settings. Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing.

Where a broker organization controls the deal content, we may refer a request to that organization and assist them in responding. To make a request, contact us at privacy@tenoncre.com. [REVIEW rights mechanics and add jurisdiction-specific disclosures (e.g. GDPR/UK GDPR, CCPA/CPRA), including legal bases and any “do not sell/share” and appeal processes].

We use a strictly-necessary session cookie to keep you signed in, and a bot-protection challenge on public entry points. [CONFIRM the full cookie inventory and whether any analytics/ non-essential cookies are used; add a cookie notice/banner if required].

We and our providers may process information in countries other than yours. Where required, we rely on appropriate safeguards for such transfers. [REVIEW transfer mechanism (e.g. Standard Contractual Clauses) and provider processing locations].

The Service is for business use by adults and is not directed to anyone under 18.

We may update this policy; we’ll change the effective date above and, for material changes, take reasonable steps to notify you. Questions or requests: privacy@tenoncre.com [CONFIRM privacy contact and mailing address; name a data-protection contact if required].