PRIVACY POLICY

Download PDF

Last updated: 05/10/2026

1. Introduction

ENORASI AI LTD ("Enorasi", "we", "us" or "our") is committed to protecting the privacy and security of personal data and to processing such data in a transparent, fair and lawful manner.

This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data in connection with our website, the Enorasi AI platform (the "Platform") and the services we provide.

This Privacy Policy applies when you:

a) visit or use our website;

b) subscribe to or use our services;

c) create or use an account on the Platform;

d) connect third-party accounts or services to the Platform;

e) contact or communicate with us;

f) subscribe to our marketing communications;

g) participate in demonstrations, webinars, surveys or other promotional activities;

h) apply to work with us; or

i) otherwise interact with us in the course of our business activities.

This Privacy Policy is intended to comply with Regulation (EU) 2016/679, the Cyprus Law Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data, Law 125(I)/2018 (as amended), and any other applicable data protection legislation.

Please read this Privacy Policy carefully. By accessing or using our website, Platform or services, you acknowledge that your personal data will be processed as described in this Privacy Policy.

2. Who We Are

ENORASI AI LTD is a company incorporated in the Republic of Cyprus under registration number HE 489912, with its registered office at 92 Arch. Makarios III Avenue, Aphrodite Building, 2nd Floor, 1077 Nicosia, Cyprus.

For the purposes of applicable data protection legislation, ENORASI AI LTD acts:

A. as an independent data controller in relation to the personal data we collect and process for our own business purposes, including the operation of our website and Platform, user account administration, customer relationship management, billing, security, analytics, service improvement, legal compliance and marketing; and

B. as a data processor where we process personal data on behalf of our business customers in connection with the services we provide through the Platform. In those circumstances, our customer is the data controller responsible for determining the purposes and means of the processing, and we process personal data only on its documented instructions and in accordance with applicable data protection legislation.

If you have any questions about this Privacy Policy or the way in which we process personal data, please contact us at:

ENORASI AI LTD
92 Arch. Makarios III Avenue
Aphrodite Building, 2nd Floor
1077 Nicosia
Cyprus

Email: [email protected]

3. Scope of this Privacy Policy

This Privacy Policy applies to the processing of personal data relating to:

a) visitors to our website;

b) individuals who subscribe to, access or use our Platform or services;

c) Authorised Users of customer accounts;

d) prospective customers and their representatives;

e) existing customers and their directors, employees, contractors and authorised representatives;

f) individuals who contact us, request information or otherwise communicate with us;

g) individuals who subscribe to receive marketing communications from us; and

h) any other individuals whose personal data we process in connection with the operation of our business.

This Privacy Policy does not apply to the processing of personal data by our customers through the Platform where we act solely as a data processor on their behalf. In those circumstances, the relevant customer is the data controller responsible for the processing of such personal data and for providing the applicable privacy information to the relevant data subjects.

Our website and Platform may contain links to third-party websites, applications or services. We are not responsible for the privacy practices or content of such third-party websites or services. We encourage you to review their privacy policies before providing them with your personal data.

4. Definitions

For the purposes of this Privacy Policy, the following definitions shall apply:

Authorised User means an individual authorised by the Customer to access and use the Platform on the Customer's behalf in accordance with the applicable subscription.

Connected Account means any third-party account connected by you or your authorised users to the Platform, including any account held with a supported social media platform, analytics provider or other third-party service, for the purpose of publishing content, monitoring activity, retrieving analytics or otherwise using the Services.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

Customer means any person or legal entity that has entered into a subscription or other agreement with ENORASI AI LTD for the provision of the Services.

Customer Content means any data, information, text, prompts, images, videos, logos, brand assets, URLs, social media account information or other materials uploaded, submitted, connected or otherwise made available by or on behalf of you through the Platform.

Data Subject means an identified or identifiable natural person to whom Personal Data relates.

GDPR means Regulation (EU) 2016/679 (the General Data Protection Regulation), as amended, supplemented, updated, replaced or re-enacted from time to time, together with any implementing or supplementary legislation and any legally binding regulatory guidance applicable to the Processing of Personal Data.

Personal Data means any information relating to an identified or identifiable natural person ("Data Subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

Platform means the Enorasi AI cloud-based software-as-a-service platform made available by ENORASI AI LTD.

Processing or Process means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processor means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.

Recipient means a natural or legal person, public authority, agency or another body to which Personal Data is disclosed, whether a third party or not, but does not include public authorities which may receive Personal Data in the framework of a particular inquiry in accordance with applicable law.

Services means the services made available by ENORASI AI LTD through the Platform pursuant to a subscription or other agreement entered into between ENORASI AI LTD and the relevant customer.

Special Categories of Personal Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Supervisory Authority means an independent public authority established by a Member State pursuant to Article 51 of the GDPR.

Third-Party Services means any third-party software, applications, platforms, artificial intelligence models, application programming interfaces (APIs), cloud hosting services, payment services, search providers or other services that interoperate with, support or are made available through the Services.

Website means the website operated by ENORASI AI LTD through which information regarding the Services is made available, including www.enorasi.ai and any successor domain.

5. Personal Data We Collect

Depending on how you interact with us, our website, the Platform and our services, we may collect and process the following categories of personal data:

(a) Identity and Contact Information

This may include your name, job title, employer, business address, telephone number, email address and other contact details.

(b) Account Information

This may include your username, login credentials, account preferences, subscription details, Authorised User information and records relating to your use of the Platform.

(c) Customer Content

Where you use the Platform, we may process personal data contained within content that you or other Authorised Users upload, submit, connect or otherwise make available through the Platform, including prompts, documents, images, videos, brand assets, social media account information and other materials.

(d) Connected Account Information

Where you choose to connect third-party accounts or services to the Platform, we may collect and process information made available through those connected services, such as profile information, social media account details, analytics, engagement metrics and other information necessary to provide the requested functionality.

(e) Technical and Usage Information

We may process limited technical information relating to your use of the Platform, including temporary IP address information used solely for request-rate limiting, session information, authentication logs, internal audit records and usage statistics relating to your use of the Services. We do not currently store users' IP addresses, browser user-agent information, device information or geolocation information for Platform users.

(f) Usage and Platform Information

We may process information relating to your use of the Platform, including internal usage records, feature usage, usage counters, AI processing records, telemetry and other operational information generated through your use of the Services. We use this information to operate, maintain, secure and improve the Platform and the Services.

We do not currently use third-party web analytics tools, such as Google Analytics, in relation to the Platform.

(g) Communications

We may process personal data contained in correspondence with us, including enquiries, support requests, feedback, survey responses and other communications.

(h) Marketing Information

Where permitted by applicable law, we may process your marketing preferences, subscription choices and records of your interactions with our marketing communications.

(i) Payment and Transaction Information

Where applicable, we may process information relating to your subscription, invoices and payments. Payment card information is generally processed directly by our third-party payment service providers and is not stored by us, except to the extent necessary to maintain transaction records or comply with our legal obligations.

(j) Brand Monitoring Information

Where customers use our brand-monitoring functionality, we may process publicly available information from supported sources relating to identified individuals, including names, social media handles, publicly available posts, follower counts, source links and AI-generated sentiment, impact and risk assessments, where such Processing is carried out on behalf of our customers.

6. How We Collect Personal Data

We collect personal data from a variety of sources, depending on how you interact with our website, Platform and services. These sources include:

(a) Information you provide directly

We collect personal data that you voluntarily provide when you:

i. create an account or subscribe to our services;

ii. complete online forms;

iii. contact us by email, telephone or other means;

iv. request information, demonstrations or support;

v. subscribe to our marketing communications;

vi. participate in surveys, webinars or promotional activities; or

vii. otherwise communicate with us.

(b) Information collected automatically

When you access or use our website or the Platform, we may automatically collect certain technical and usage information through cookies, log files and similar technologies. The information collected depends on the relevant service and may include usage patterns and interactions with our website or Platform.Further information about our use of cookies and similar technologies is available in our Cookie Policy.

(c) Information from connected third-party services

Where you choose to connect third-party services or accounts to the Platform (such as social media platforms, analytics providers or other supported integrations), we may receive information from those services that is necessary to provide the functionality you have requested and authorised.

The information we receive will depend on the permissions you grant and the settings of your connected accounts.

(d) Information from third parties

We may also receive personal data from third parties, including our business partners, service providers, publicly available sources and other lawful sources, where permitted by applicable law and where necessary for the operation and improvement of our services.

7. How We Use Your Personal Data

We will only process your personal data where we have a lawful basis to do so under applicable data protection legislation. Depending on the circumstances, we may rely on one or more of the following legal bases:

A. the processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract;

B. the processing is necessary to comply with a legal obligation;

C. the processing is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your rights and freedoms; or

D. you have given your consent to the processing.

The table below summarises the principal purposes for which we process personal data.

8. Artificial Intelligence Processing

The Services incorporate artificial intelligence ("AI") technologies to provide content generation, marketing strategy, research, brand monitoring, analytics and other functionality made available through the Platform.

Where you use AI-enabled features of the Services, we may process personal data contained in prompts, customer content or connected account information to generate the outputs you request and to provide the Services.

Certain AI functionality is provided using Third-Party Services. Where personal data is processed using such Third-Party Services, such processing is carried out in accordance with applicable contractual arrangements and appropriate technical and organisational measures.

AI-generated outputs may be stored within the relevant Customer Account to enable Customers to access, edit, publish and manage such outputs through the Platform.

Neither we nor the third-party artificial intelligence service providers we use will use Customer Content, prompts or personal data processed through the Platform for the purpose of training or fine-tuning artificial intelligence models.

You are responsible for ensuring that you have an appropriate legal basis for uploading or otherwise making available any personal data through the Services, including where such personal data is contained in prompts, customer content or connected accounts.

We recommend that you do not submit special categories of personal data or other sensitive personal data through the Services unless this is strictly necessary and you have a lawful basis for doing so.

9. Sharing Personal Data

We share personal data with the following categories of recipients where necessary for the purposes described in this Privacy Policy and in accordance with applicable data protection laws:

(a) Cloud Hosting and Infrastructure Providers

We use Google Cloud Platform to host and operate the Platform. Accordingly, personal data is processed and stored using Google Cloud services in connection with the provision of the Services.

We also use Cloudflare to provide network security, content delivery and website performance services.

(b) Artificial Intelligence Service Providers

We use third-party artificial intelligence service providers to deliver AI-powered functionality, including text generation, reasoning, image generation, video generation, embeddings, brand analysis, sentiment analysis and related services. These providers include Google (including Google Vertex AI, Gemini and Veo), , Anthropic (including Claude) and other AI technologies integrated into the Platform. Where you use AI-enabled features, personal data contained in prompts, customer content or connected account information may be processed by these providers to generate the requested outputs.

(c) Connected Third-Party Platforms (Connected Accounts)

Where you choose to connect your third-party accounts to the Platform, we will access and exchange information with the relevant platform in accordance with the permissions granted by you in order to provide the requested Services, including publishing content, retrieving analytics and engagement information and maintaining the connected account integration.

(d) Payment Service Providers

Where payments are made through the Platform, payment processing is carried out by Stripe or other payment service providers engaged by us from time to time. We do not store your payment card details.

(e) Search, Monitoring and Technical Service Providers

We use third-party providers to support research, monitoring, search, communications, security and the operation of the Platform. These providers may include SerpAPI, Brave Search, Bing, Sentry, Google Cloud DLP and email service providers.

(f) Professional Advisers

We may disclose personal data to our lawyers, accountants, auditors, insurers and other professional advisers where necessary for the establishment, exercise or defence of legal claims or for the provision of professional advice.

(g) Regulatory Authorities

We may disclose personal data where required to do so by applicable law, regulation, court order or the lawful request of a governmental, regulatory or law enforcement authority.

(h) Corporate Transactions

If we are involved in a merger, acquisition, investment, restructuring or the sale of all or part of our business or assets, personal data may be disclosed to prospective or actual purchasers, investors and their professional advisers, subject to appropriate confidentiality obligations.

Further information regarding the processing activities of these third-party providers may be available in their respective privacy notices.

We do not disclose personal data to third parties for their own direct marketing purposes.

10. International Transfers of Personal Data

Certain third-party service providers used in connection with the Services process personal data outside the European Economic Area ("EEA"). Accordingly, personal data may be transferred to, stored in or accessed from countries outside the EEA, including the United States.

In particular:

A. Google Cloud Platform, including Google Vertex AI text processing, embeddings, Google Cloud Storage and Google Cloud Data Loss Prevention (DLP), is configured to operate primarily within Google's European Union region.

B. Google Gemini Image Generation (Nano Banana) currently processes image-generation requests outside the EEA.

C. Google Veo currently processes video-generation requests in the United States.

D. Anthropic (including Claude) may process personal data outside the EEA in connection with the provision of AI-powered functionality through the Platform.

E. Connected third-party platforms, including Meta (Facebook and Instagram), LinkedIn and X, may process personal data outside the EEA in connection with the connected account functionality.

F. Certain search, monitoring and technical service providers, including SerpAPI, Brave Search, Bing, Sentry and, where enabled, fal.ai, may process personal data outside the EEA.

Where personal data is transferred outside the EEA, we implement appropriate safeguards in accordance with applicable data protection legislation. Depending on the recipient and the destination country, these safeguards may include:

1) an adequacy decision adopted by the European Commission (including, where applicable, the EU-U.S. Data Privacy Framework);

2) the European Commission's Standard Contractual Clauses; or

3) another lawful transfer mechanism recognised under applicable data protection legislation.

Where required by applicable law, we also implement appropriate supplementary technical and organisational measures to ensure that personal data transferred outside the EEA remains subject to an essentially equivalent level of protection.

You may contact us using the contact details set out in this Privacy Policy if you require further information regarding the safeguards applicable to a particular international transfer of your personal data.

11. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to provide the Services, comply with our legal and regulatory obligations, resolve disputes, enforce our agreements and protect our legitimate business interests.

The applicable retention period will depend on the nature of the personal data and the purpose for which it is processed. In determining the appropriate retention period, we take into account:

a) the nature, sensitivity and volume of the personal data;

b) the purposes for which the personal data is processed;

c) whether we can achieve those purposes by other means;

d) applicable legal, regulatory, tax, accounting and reporting obligations; and

e) the need to establish, exercise or defend legal claims.

Where an organisation owner requests closure of an account and confirms the request using their password, access to the account will be locked immediately and any scheduled posts and monitoring activities will cease. A seven-day account closure period will then apply. Following expiry of that period, the organisation's data held on the Platform, including database records, uploaded and generated files and logs, will be permanently and automatically deleted.

This is subject to any information that we are required to retain for a longer period to comply with applicable law or to establish, exercise or defend legal claims.

Where personal data is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our internal data retention and deletion procedures.

Where we process personal data solely on behalf of our customers as a Processor, we retain and delete such personal data in accordance with the applicable agreement with the relevant customer and our documented instructions from that customer.

12. Security of Personal Data

We take the security of personal data seriously and implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Such measures include, where appropriate:

a) the use of secure cloud infrastructure;

b) access controls and authentication mechanisms;

c) encryption of personal data where appropriate, including the encryption of certain credentials and authentication tokens;

d) network and application security measures;

e) monitoring and logging of security-related events;

f) measures designed to maintain the confidentiality, integrity and availability of our systems and Services; and

g) procedures for responding to security incidents and personal data breaches.

Although we take reasonable steps to safeguard personal data, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure. Accordingly, while we strive to protect personal data, we cannot guarantee its absolute security.

Where required by applicable law, we will notify the relevant supervisory authority and affected individuals of any personal data breach in accordance with our obligations under applicable data protection legislation.

13. Your Rights

Subject to applicable data protection legislation, you may have the following rights in relation to your personal data.

A. Right of access

You have the right to request confirmation as to whether we process your personal data and, where that is the case, to obtain access to that personal data together with certain information regarding the processing.

B. Right to rectification

You have the right to request that inaccurate or incomplete personal data be corrected or updated without undue delay.

C. Right to erasure

You have the right to request the deletion of your personal data in certain circumstances, including where the personal data is no longer necessary for the purposes for which it was collected or where the processing is otherwise unlawful.

D. Right to restrict processing

You have the right to request that we restrict the processing of your personal data in the circumstances provided for under applicable data protection legislation.

E. Right to data portability

Where the processing is based on your consent or is necessary for the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and, where technically feasible, to have that personal data transmitted to another controller.

F. Right to object

You have the right to object to the processing of your personal data where such processing is based on our legitimate interests. Where we process personal data for direct marketing purposes, you have the right to object at any time to such processing.

G. Rights relating to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such processing is authorised under applicable data protection legislation.

H. Right to withdraw consent

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent shall not affect the lawfulness of any processing carried out before such withdrawal.

Exercising Your Rights

To exercise any of the above rights, please contact us using the contact details set out in this Privacy Policy. We may request additional information where necessary to verify your identity before responding to your request.

Where we process personal data solely on behalf of one of our customers as a Processor, requests relating to such personal data should ordinarily be directed to the relevant customer, who acts as the Controller. We will assist our customers in responding to such requests where required by applicable data protection legislation and our contractual obligations.

If you believe that we have processed your personal data unlawfully or otherwise infringed applicable data protection legislation, you have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus or with the competent supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

The exercise of certain rights may be subject to conditions, limitations or exemptions under applicable data protection legislation.

14. Marketing Communications

Where permitted by applicable data protection legislation, we may use your contact details to send you information about our Services, updates, newsletters, events and other marketing communications that we believe may be of interest to you.

Where your consent is required under applicable data protection legislation, we will send you marketing communications only where you have provided such consent. Where we rely on our legitimate interests to send marketing communications, you have the right to object to such processing at any time.

You may opt out of receiving marketing communications at any time by using the unsubscribe mechanism included in our communications or by contacting us using the contact details set out in this Privacy Policy.

Please note that, even if you opt out of receiving marketing communications, we may continue to send you service-related and administrative communications where necessary for the administration of your account, the provision of the Services or compliance with our legal obligations

15. Cookies and Similar Technologies

Our website and Platform use cookies and similar technologies to support their operation, improve functionality and enhance your user experience.

Further information regarding the cookies and similar technologies we use, including their purpose, duration and how you can manage your preferences, is available in our Cookie Policy.

16. Changes to this Privacy Policy

We may amend or update this Privacy Policy from time to time to reflect changes to our business, the Services, applicable data protection legislation or our data processing practices.

Any updated version of this Privacy Policy will be published on our website and will become effective from the date specified in the revised version. Where required by applicable data protection legislation, we will take appropriate steps to notify you of any material changes.

17. Contact Us

If you have any questions regarding this Privacy Policy, the processing of your personal data or if you wish to exercise any of your rights under applicable data protection legislation, please contact us at:

ENORASI AI LTD
Registration No.: HE 489912
92 Arch. Makarios III Avenue
Aphrodite Building, 2nd Floor
1077 Nicosia
Cyprus

Email: [email protected]

If you are not satisfied with our response, you also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus or with the competent supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.