tenetdocs

Privacy and your choices

Version 2.8 · In force since 2026-10-15
Who we are

TenetLoop, Inc., a Delaware corporation, owns and operates TenetDocs™. TenetLoop, Inc. is the company behind this product and the one answerable for it. When you use TenetDocs for your own account, TenetLoop, Inc. decides how your data is handled. When your business uses TenetDocs to hold records about its customers, your business decides that and we act on its instructions — so questions about those records go to that business rather than to us.

Our address for anything on this page is legal[at]tenetloop.com — written that way to keep it away from address harvesters, so replace `[at]` with the @ sign when you write to us.

What we collect

What the product needs to work, plus anything you choose to give us or consent to us to collect from other sources:

  • Your account — your email address, your name if you give one, and how you sign in.
  • What you put in — the business records, documents and messages you or your team create.
  • How you use it — which pages you opened and when, so the product can show you your own history and we can tell whether something is broken.
  • Technical details every website receives — your address on the internet, your browser type, and the page that sent you here.
  • Preview feedback and session recordings — if you choose to provide preview feedback, or consent to have your sessions recorded, any information collected is used to improve the product and the knowledge embedded in the platform. Both are off until you turn them on, and both are yours to turn back off.
  • Your mobile number, if you opt in to text messages — used only to send the account and security messages you chose.

We do not buy data about you, we do not build advertising profiles, and we don't sell or share your data.

What we use the data for

Each of these matches a purpose in the table further down, so you can see the switch behind the sentence:

  • Running the product — showing you your own records, keeping one business separate from every other, and remembering which one you are working in.
  • Signing you in and keeping the account secure — telling a real sign-in from a forged one, rate-limiting abuse, and letting you see and end your own sessions.
  • Answering you with the assistant — your messages, and the records needed to answer them, go to the company that runs the model so it can reply.
  • Keeping the service running — hosting, backups, and diagnosing faults when something breaks.
  • Sending you service email — invitations, sign-in and password mail, and notifications you have switched on.
  • Sending you text messages, if you opt in — sign-in codes, billing alerts, support replies and service-status alerts, to the number you gave us. Reply STOP to any message to stop them, or HELP for help.
  • Understanding whether the product works — counts of what happened, aggregated, with no profile of you behind them.
  • Improving the product — from what you volunteer: feedback you write, and recordings you choose to make and share.
  • Meeting obligations we cannot lawfully drop — answering a lawful request, settling a bill, or defending a claim.

That list is exhaustive as of the version of this statement you are reading. We do not use your data for advertising, we do not profile you to sell to you, and we do not hand it to data brokers.

Who we send it to

To run the service, a short list — and every one of them acts only on our instructions:

  • Anthropic PBC — runs the AI model that answers you. Your messages and the records needed to answer them are sent there to produce a reply.
  • Fly.io — hosts the service. Everything you store lives on their machines.
  • Resend — delivers our email.
  • Telnyx — delivers our text messages.

That is the whole list right now. Some of these run computers outside the country you are in; we use them because we need them to provide the service you asked for, and they are bound to protect what we send them.

Three other situations can put your data in someone else's hands:

  • Our professional advisers. Lawyers, accountants, auditors, bankers and insurers see what they need to advise us on a specific matter, under a duty of confidence.
  • A change of ownership. If TenetLoop, Inc. is merged, reorganized, or its business or assets are bought, your data is part of what moves. Whoever receives it is bound by this statement until they publish their own.
  • Public authorities. Where a court or a public authority lawfully compels us, we disclose what we are compelled to disclose, and no more than that.
Text messages

If you opt in to TenetDocs text messages, we use your mobile number only to send the messages you chose. We do not sell, rent or share your mobile number or your text-messaging consent with third parties or affiliates for marketing or promotional purposes. Telnyx, listed above, delivers the messages on our instructions and for no other purpose. Message frequency varies and message and data rates may apply. Reply STOP to any message to opt out, or HELP for help.

How long we keep it

Your records stay for as long as your account does — that is the point of them. Delete something and we delete it.

Permanently deleting a business is not the same as closing it. The moment it is confirmed, the business is locked for everyone who used it, and its database and documents are destroyed after a 168-hour (seven-day) removal window. The window is there so a deletion made by mistake can still be undone.

Where we have to keep a specific record — to settle a bill, defend a claim, or meet an obligation we cannot lawfully drop — that record stays and the rest goes. Which record, and why, is part of the answer you get when you ask us to delete. Things kept for a fixed short period are listed in the table below.

Three things are deliberately kept even when other data goes: a record of a consent or preference you gave or refused, the record of each change to your consents and preferences, and the record of each legal notice we sent you — which document and version, when, and the address it went to. All three exist to protect you and to prove what was said and when — erasing the evidence that you said no, or that we told you, would leave nothing to show it.

Your choices and your rights as an individual

You can ask us to:

  • show you what we hold about you, or send you a copy you can take elsewhere;
  • correct anything wrong;
  • delete what we hold;
  • pause what we do with it while a question is open; or
  • stop a particular use altogether.

Start any of these from this page — no account needed, because the request belongs to you and not to a login. We ask you to confirm the request from your email address first: "send me everything you have on this person" is the single most valuable thing a stranger could ask us, so we check who is asking before we answer.

The switches below are separate and take effect immediately. Anything not marked Always on is off until you turn it on, and you can turn it back off whenever you like.

If you think we have got this wrong, tell us at legal[at]tenetloop.com — and if we do not put it right, you can complain to the data-protection authority where you live.

Children

TenetDocs is a tool for running a business, it is not meant for children, and we do not offer it to them. We do not knowingly collect anything about a child; if we learn that we have, we delete it. If you think a child has given us information, tell us at legal[at]tenetloop.com.

Additional information about California residents

This section applies to people who live in California and is additional to everything above. Where it says something different from the rest of this statement, this section governs for California residents. It is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA").

Who this is about. TenetLoop, Inc. is the business for personal information about you as a TenetDocs account holder or visitor to our sites. Where a business uses TenetDocs to hold records about its own customers, that business is the one that decides how those records are handled and we act as its service provider — we process them only to provide the service, under contract, and we do not retain, use or disclose them for any other purpose. A request about those records goes to that business.

What we collect about California residents

In the last 12 months we have collected these categories of personal information. Every one is collected from you, from your business, or from your device as you use the product, or, where you have asked us to, from publicly available sources — we do not buy personal information from data brokers or acquire it from third-party lists.

CategoryWhat it is hereWhy we collect itWho we disclose it to for a business purpose
IdentifiersYour name and email address, your account and business identifiers, and your IP addressTo create and run your account, sign you in, secure it, and contact you about the serviceOur hosting provider (Fly.io) and our email provider (Resend)
Commercial informationThe records, documents and messages you create in the productTo provide the product itself and to answer you in the assistantOur hosting provider (Fly.io); the AI model provider (Anthropic PBC) when the assistant answers you
Internet or other electronic network activityWhich pages you opened and when, timings, your browser type, and the page that sent you hereTo show you your own history, to tell whether something is broken, and to count in aggregate whether the product worksOur hosting provider (Fly.io)
Audio, electronic or visual informationSession recordings, and the feedback you write, where you have switched those onTo improve the product and the knowledge embedded in the platformThe people who build this product
Professional or employment-related informationYour role in the business you work in, if you give oneTo decide what you are allowed to see and do in that businessOur hosting provider (Fly.io)
InferencesA coarse guess at visitor type on our entry page, where you have allowed itTo choose which version of the entry page to show youNobody
Sensitive personal informationYour account log-in credentialsTo sign you in and keep your account secureNobody

Sensitive personal information. The only category we collect is account log-in credentials, and we use and disclose it solely for the purposes the CCPA permits without a right to limit — providing the service you asked for and keeping it secure. We do not use or disclose it to infer characteristics about you, so there is no "limit the use of my sensitive personal information" right for us to offer.

Categories we do not collect. For completeness, because a list of categories is only credible if it is bounded: we do not collect education information, geolocation beyond what an IP address implies, biometric information, or information about characteristics protected under California or United States law. We take no payment details — the product does not process payments.

No sale, no sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA. We have not done so in the preceding 12 months. We run no advertising, and we disclose nothing to third-party advertisers. This is also true of personal information about anyone we know to be under 16 years of age; TenetDocs is a business tool and is not offered to children.

Global Privacy Control. A browser or extension can send a Global Privacy Control signal, which is an opt-out of sale and sharing. Because we do neither, there is no sale or share for that signal to stop. Your choices over what we do with your data are the switches on the privacy page, and those bind us whatever your browser sends. The California Privacy Protection Agency publishes guidance on valid Global Privacy Controls at https://oag.ca.gov/privacy/ccpa.

How long we keep it. As set out in How long we keep it above.

Your rights as a California resident

You have the right to:

  • know what personal information we collect about you, where it comes from, why we collect it, and who we disclose it to, including the specific pieces we hold;
  • learn how we process it — which the statement above and the purpose table on the privacy page set out, switch by switch;
  • delete the personal information we hold about you, subject to the exceptions the CCPA allows;
  • correct inaccurate personal information we hold about you;
  • obtain a copy of your personal information in a portable form; and
  • not be discriminated against for exercising any of these rights. We do not deny you the service, charge you a different price, or give you a lesser experience because you exercised a right, and we operate no financial incentive program tied to personal information.

Because we do not sell or share personal information, and do not use sensitive personal information beyond the permitted purposes, there is no opt-out for us to offer you on either count.

Use the request form at the bottom of this page — it opens a tracked request against your email address. You can also write to us at legal[at]tenetloop.com (replace `[at]` with the @ sign).

Verification. We ask you to confirm the request from the email address it concerns before we answer it. "Send me everything you have on this person" is the single most valuable thing a stranger could ask us, so we establish who is asking first. For a request to know specific pieces of information, we may ask for additional confirmation matched to the sensitivity of what is being asked for. Because the rights in this section belong to California residents, we may also need to establish where you live before we can answer under it — the rights in the statement above are open to you either way.

Authorized agents. You may use an authorized agent to make a request on your behalf. We ask the agent for written permission signed by you, and we ask you to verify your own identity with us directly, unless the agent provides a power of attorney.

Timing. We confirm receipt of a request within 10 business days and respond within 45 calendar days, which we may extend once by a further 45 days where the request is complex, telling you why.

How to reach us

Questions, requests and complaints about anything on this page go to legal[at]tenetloop.com — replace `[at]` with the @ sign. Written to us, that reaches TenetLoop, Inc., a Delaware corporation.

The fastest route for a data request is the form at the bottom of this page: it opens a tracked request against your email address rather than an inbox thread.

When this changes

This statement is a published document with a version and a date, both shown at the top of this page. Changing it means publishing a new version, and the one it replaces is kept — so the wording in force when you made a choice stays on the record. Where a change is significant, we email the address on your account when the new version is published.

Your choices

Anything not marked Always on is off until you say otherwise, and you can change your mind here at any time.

Signing in and keeping your account secure

Always on

Keeps you signed in, remembers which business you are working in, and protects every form you submit against being forged by another site.

What is collected A session token, a CSRF token, and which business you last opened.
Who receives it Nobody — these do not leave our own servers.
How long it is kept Deleted when the session ends or expires.
Stored on your deviceKindKept forWhat it is
hd_a_statecookie10 minutesThe same protection for signing in with Apple.
hd_gidcookieSessionWhich business you last entered, so the picker can return you there.
hd_gpickcookie10 minutesHeld by the separate picker page while you choose spreadsheets, so the choice is recorded for the right business. Used once, then it expires.
hd_gpick_bootcookie10 minutesProves that the Google file picker you opened was started by you, in this browser. Only set when you choose a spreadsheet to connect.
hd_integ_statecookie10 minutesThe same protection when you connect an outside account, such as your accounting system. Only set if you start a connection.
hd_keycookie30 daysRemembers that you hold an access key for the private preview, so you are not asked for it again on every visit.
hd_nativecookie10 minutesNotes that a sign-in was started from the mobile app, so you are returned to the app rather than the website. Deleted when you land.
hd_oauth_nextcookie10 minutesSet only when you start connecting an assistant such as ChatGPT or Claude before you are signed in, so that after you sign in you return to the page that asks what the assistant may do. Deleted as soon as you are back.
hd_oauth_statecookie10 minutesHeld only while you are being handed to Google and back, so nobody can swap the sign-in half-way through. Deleted the moment you land.
hd_previewcookieSessionMarks a preview link, so a preview does not count in our page statistics.
hd_relcookieSessionWhich copy of the service answered you while an update is rolling out, so you keep talking to the same one.
hd_reloadsessionStorageSecondsRemembers across one page reload that the connection dropped, so we can tell you it came back.
hd_scookieSessionSigned-in session token, scoped to one business host.
hd_subjcookie12 monthsA random id naming YOUR privacy choices on this site. It records nothing about you and is not used to track or profile — without it we would have no way to remember that you said no.
hd_tab_idsessionStorageUntil you close the tabTells three open tabs apart from three separate sign-ins, so your account shows your sessions honestly. Gone when the tab closes.
Why this cannot be switched off Without these the product cannot function at all: there is no way to stay signed in between clicks, and no way to tell a real form submission from a forged one. Nothing here is used to measure, profile or advertise.

Showing you a consistent page

Always on

Remembers which version of our home page you were shown, so it does not change under you when you reload or come back.

What is collected A single letter naming which page version you saw.
Who receives it Nobody.
How long it is kept 30 days.
Stored on your deviceKindKept forWhat it is
hd_abcookie30 daysWhich version of the home page you were shown.
Why this cannot be switched off DECISION OWED TO THE FOUNDER, recorded here rather than assumed (ADR 0097 D5). This key pins which variant of the marketing page you were served. The page-stability half is genuinely necessary — without it the site visibly rearranges itself between loads. The measurement half is NOT, which is why it was split: counting how a variant performs now lives under product_measurement and is gated. Some regulators treat any A/B key as non-essential regardless of that split; flipping this to required=0 is a one-row config change, not a code change, precisely so that call stays reversible.

Remembering how you set up your own screen

Always on

Remembers display choices you made yourself — whether to show token-spend detail, whether to group the trace view.

What is collected Which view you chose. Nothing else.
Who receives it Nobody — these do not leave your device.
How long it is kept Until you clear your browser storage.
Stored on your deviceKindKept forWhat it is
hd_tok_livelocalStorageUntil clearedWhether you asked to see token-spend detail.
hd_trace_groupedlocalStorageUntil clearedWhether you asked for the trace view grouped.
hd_vpcookie180 daysWhether you told us you are running a business or advising other people's businesses, so the wording matches. Not a guess about you.
Why this cannot be switched off These hold nothing about you: only the display choice you yourself made, on your own device, read only by the page you set it on. They are not sent to us and not used to measure, profile or advertise. Listed for completeness rather than because they carry data — asking permission to remember which view you just picked would be noise, not a choice.

Tailoring which version of the home page you see

Works out, roughly, what kind of visitor you are — a small business, a larger one, or an expert such as a bookkeeper or advisor — and uses that to pick which version of our home page to show you. The guess comes from the link you arrived on, the site that referred you, and your browser type. When those are not enough, we ask a small AI model to make the guess. Say no and we show you a version chosen at random instead; nothing else changes.

What is collected A random id for your browser, and one word describing the guessed visitor type. Not your name, not your account, and nothing you typed.
Who receives it Anthropic PBC processes the arrival signals when the AI model is asked to refine the guess. Nothing is sold or shared for advertising.
How long it is kept 30 days.
Stored on your deviceKindKept forWhat it is
hd_segcookie30 daysThe guessed visitor type — one word from a fixed list.
hd_sidcookie30 daysA random id for this browser, so a guess made after your visit can be matched back on your next one. It names nothing about you.

Understanding which pages actually help

Counts, in aggregate, whether visitors found the demo useful — so we can tell which explanations work and drop the ones that do not.

What is collected That someone tried the demo at least once, and which version of our home page they were reading before they came to sign up. No content of what you typed, no name, no profile.
Who receives it Nobody — aggregate counts stay on our own servers and are not sold or shared.
How long it is kept 30 days for the demo count. If you go on to create an account, the single letter naming which home page you came from is kept with that account.
Stored on your deviceKindKept forWhat it is
hd_engcookie30 daysThat you tried the interactive demo, so a repeat visit is not counted twice.
hd_lpcookie30 minutesWhich version of our home page you came from, held just long enough to finish signing up, so we can tell which page brought people in. A single letter. Deleted half an hour later whether you sign up or not.

Measuring how the product is used, if you turn it on

If you switch this on, we record how people move through the product — which controls get used, where they get stuck, how long things take — and report it only as totals across everyone. It is how we find the parts that are confusing before you have to complain about them.

What is collected Which controls were used and for how long; where people hesitated, gave up, or clicked something that did nothing; how long the product took to respond; and the shape of typing — how many keystrokes and corrections, not the characters. Not your business records, not a password or payment field, and nothing at all from the sign-in screens.
Who receives it Nobody outside the people who build this product. It is not sold, not shared for advertising, and not handed to a data broker.
How long it is kept Raw activity for 90 days, then only counts and averages that name nobody. Withdrawing deletes the raw activity still held about you; totals already computed name no one and can't be taken back. Nothing here is shown to us as one person's activity — it is reported as totals, and a figure that would describe a single identifiable person is withheld instead of shown. Your rows are stored under a key rather than your name, but we can still find them when you ask us to, so this is pseudonymous rather than anonymous.

Recording a session, if we invite you and you start it

Separate from counting, and much more specific: with your permission we record a session of you using the product — what you did, in order — so we can watch it back and understand a problem properly. You start each recording yourself, you can stop it at any moment, and afterwards you choose which recordings we are allowed to see.

What is collected A session recording: the controls you used in order, with timings, plus any screenshot you choose to capture into it. Unlike counting, this is about YOU specifically, and a researcher watches it as your session.
Who receives it The people who build this product, and only for recordings you chose to share. Not sold, not shared for advertising.
How long it is kept A recording stays on your own device, encrypted, until you decide to share it — until then we cannot read it, and deleting it means it does not reach us. A shared recording is kept for 90 days unless you ask us to delete it sooner. Being invited is not being recorded: nothing starts until you press record.
Stored on your deviceKindKept forWhat it is
hd_rec_keysindexeddbuntil you share or delete each recordingThe key that unlocks your own recordings on this device. It is kept so that scripts cannot read the key itself out, and it does not leave your device.
hd_rec_sessionslocalStorageuntil you share or delete each recordingYour recordings, encrypted, while they are still yours alone. Sharing uploads one; deleting removes it and it does not reach us.

Answering you with an AI assistant

Always on

The assistant is the product. What you type to it, and the business records it needs to answer you, are sent to the company that runs the AI model so it can reply.

What is collected Your messages to the assistant, and the business records it reads to answer them.
Who receives it Anthropic PBC, which runs the model. They process it to return an answer. We do not sell it, and we do not share it with anyone else for their own purposes.
How long it is kept We keep your conversation in your own business database so you can read it back. Delete the conversation and it is gone from ours.
Why this cannot be switched off There is no version of this product without it: the assistant IS the interface, so switching this off would leave nothing to switch on. What IS in your control is what you put in front of it, and whether your business supplies its own model key. Money, ledger and authorization decisions are not made by the model — those run on deterministic code, and no reply can widen what you are allowed to see.

Running the service and sending you email

Always on

Keeping the product online, and delivering the emails it has to send you — sign-in links, password resets, invitations, confirmations.

What is collected Everything you store with us lives on our hosting provider's machines. Your email address and the text of the message pass through our email provider.
Who receives it Fly.io (hosting) and Resend (email delivery), each acting only on our instructions.
How long it is kept Hosted data lives as long as your account does. Email logs follow the provider's own short retention.
Why this cannot be switched off A hosted product must run on somebody's computers and email must leave through somebody's mail servers. Neither of these can be turned off while you have an account, so they are disclosed rather than offered as a choice. Both suppliers act only on our instructions and for no purpose of their own.

Your data rights

We send one confirmation link there first. "Send me everything you have on this person" is the most valuable thing a stranger could ask, so we check who is asking before we answer.