Privacy Policy
Effective 21 September 2026. Last updated 29 September 2026.
This policy explains what Tenet collects, why, who else sees it, and what you can do about it. It describes the software as it actually behaves — if you find a place where it doesn't, that's a bug and we want to hear about it at max@strivehaus.com.
Tenet is operated from 10 Rue Des Caves, 34480 Puimisson, France ("we", "us"). For the purposes of the UK GDPR and EU GDPR we are the data controller for the information described here.
1. What we collect
Information you give us
Your account. An email address and a password. The password is hashed by our authentication provider and is never visible to us in readable form.
Your content. Projects, timelines, media you import, media you generate, canvas boards, prompts you write, conversations with the built-in agent, and transcripts produced from your own audio. This is the material the product exists to work on.
Payment details. If you buy credits, your card details go directly to Stripe and are never sent to, processed by, or stored on our servers. We receive and store only the fact of a payment, its amount, its currency and Stripe's identifier for it.
Information collected automatically
Spend records. Every paid operation writes a row recording the model used, what the provider charged, and the resulting movement of your credit balance. These are financial records and we keep them (see section 6).
Usage and crash reports. On by default, and you can switch them off at any time in Settings › Privacy — genuinely off when off: not anonymised, not sampled, nothing sent. Each report is one event from a fixed list, viewable in full at Settings › Privacy, carrying only the values that list names. There is no free-form field in the table, so a prompt, a filename or a transcript has nowhere to land in it. Reports include an app version, a platform, and a per-page-load session identifier.
The same reports, plus a few more of the same kind — which page of the app you opened, each minute you spent actively using it, which editing commands, effects, transitions and assistant tools you used, by name, why a generation or export failed, and the error messages the app showed you (with anything quoted, file paths and links removed) — also go to PostHog, which we use to see which parts of Tenet get used, for how long, and where they go wrong. There they are linked to your account (its id, email address and plan, and your two answers to the first-visit questions) so we can tell how different people use the app. The same switch in Settings › Privacy turns this off too. We do not record your screen, and nothing you type is captured.
Server logs. Ordinary request logs, including IP address, kept for security and debugging.
What we do not collect
We do not use advertising trackers, and PostHog (above) is the only analytics service we use. We do not sell personal information. We do not use your content to train our own models, and we do not sell or licence it to anyone else to train theirs.
2. Where your media actually lives
Worth stating plainly, because it is unusual:
- In the desktop app, media is written first to a cache on your own machine and synced to our object storage in the background. A file you import may exist only on your computer for a period before it reaches us.
- In the browser, media is uploaded to our object storage directly.
Our object storage is Cloudflare R2. Files are served through our own server, which checks that the requester owns the project a file belongs to.
Deleting a project deletes its media — from our storage straight away, with a second pass an hour or so later for anything that was still on its way in, and from the cache on the computer you deleted it from. Deleting a single file from a project removes everything made from it too (posters, previews, cut-outs, trimmed copies). A copy the desktop app cached on another of your computers stays there until you clear it in Settings › Storage.
Database access is enforced at the database itself through row-level security, so a query that forgets to filter by owner returns nothing rather than someone else's work.
3. Why we process it, and on what legal basis
| What | Why | Basis (UK/EU GDPR) |
|---|---|---|
| Account details | To give you an account and let you back into it | Contract |
| Your content | To store, process, render and export your projects | Contract |
| Prompts and reference media | To carry out the generation you asked for | Contract |
| Payment and spend records | To charge correctly and keep accounts | Contract; legal obligation |
| Usage and crash reports | To find and fix what breaks, and to see which parts of Tenet are used and how much | Legitimate interests — you can switch it off |
| Server logs | To keep the service up and secure | Legitimate interests |
| Abuse and safety checks | To enforce our AI Content Policy | Legitimate interests; legal obligation |
4. Who else sees it
To do what you ask, we pass specific data to specific processors. We do not give any of them your whole account.
Infrastructure
- Supabase — authentication and the database holding your projects, timelines, chats and spend records.
- Cloudflare (R2) — object storage for media and exports.
- Vercel — runs our server.
- RunPod — renders exports made on our servers rather than on your Mac. It receives the media and timeline of the project being exported, for as long as the render takes.
- Stripe — payments. They receive your card details directly; we do not.
- Resend — sends account email, such as password resets and sign-in links, and delivers feedback you send us to our team.
- Cloudflare (Turnstile) — checks that a sign-in or sign-up comes from a person, not a bot. It sees your browser, not your account.
- PostHog — product analytics: the usage reports described in section 1, linked to your account's id, email address and plan. Off when usage reports are off.
AI providers. When you run a generation, we send that provider the prompt and any reference media the operation needs — and nothing else. Your identity is not passed on; the request is made under our account.
- Anthropic — the built-in agent. Receives your conversation with it and the project context that conversation needs.
- Sume — image and video generation. It routes to the underlying model owners, which include ByteDance, Google, Kuaishou, MiniMax, Alibaba, Tencent, xAI, Black Forest Labs and others depending on the model you pick.
- fal.ai — music generation and background removal.
- ElevenLabs — voice, sound effects, dubbing, audio clean-up and transcription.
Each provider's own terms and privacy policy apply to the data we send them, and those terms differ. Some may retain inputs for a period, for abuse monitoring or otherwise. If that matters to your work, check the policy of the specific model you are using before you use it.
We will also disclose information where we are legally required to, or where it is necessary to investigate abuse or protect someone's safety.
International transfers
Our processors operate outside the UK and EEA, including in the United States. Where we transfer personal data there, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or on an adequacy decision where one applies.
5. Your rights
Wherever you live, you can ask us to access, correct, delete or export your personal data, and ask us to restrict or object to processing. You can object to usage and crash reports at any time by switching them off in Settings › Privacy, with no effect on what was already sent.
In the UK and EEA you may complain to your supervisory authority (in the UK, the Information Commissioner's Office). In California, you have rights of access, deletion, correction and portability, and a right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined by the CCPA.
To exercise any of this, email max@strivehaus.com. We will respond within one month.
Deleting your account — which you can do yourself in Settings › Account, after entering your password again — cancels any plan, and removes your account, your projects, the media belonging to them, and any feedback you sent us (a copy already emailed to our team stays in that inbox). Two things survive, and you should know which: financial records we are required to keep (section 6), which are kept detached from your login, and usage reports, which are detached from your identity rather than deleted. The copy of your usage reports in PostHog, which is linked to your account, is deleted.
6. How long we keep things
- Account and content — until you delete them, or your account. Copies in our database provider's backups age out on its ordinary cycle.
- Spend and payment records — ten years after the transaction, as required by French tax and accounting law. These are kept even after account deletion.
- Usage and crash reports — 90 days. Anonymised on account deletion rather than removed. Their copy in PostHog is kept for as long as our PostHog plan retains events, and deleted with your account.
- Server logs — 30 days.
7. Security
Access is enforced in the database itself through row-level security rather than only in application code. Credentials are held in our hosting platform's secret store. Traffic is encrypted in transit.
No service is perfectly secure, and we won't pretend otherwise. If you find a vulnerability, please tell us at max@strivehaus.com before telling anyone else, and we will not pursue you for having looked.
8. Children
Tenet is not intended for anyone under 18, and we do not knowingly collect their personal information. If you believe a child has given us data, contact us and we will delete it.
9. Changes
If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top always reflects the current version.
10. Contact
Tenet 10 Rue Des Caves, 34480 Puimisson, France max@strivehaus.com
We have not appointed a Data Protection Officer; our processing does not meet the threshold that requires one. Write to the address above with any question about this policy.