Want more from Enji? Explore the full version at Enji.ai

Enji Lite

Privacy Policy

Effective date: 21 September 2026

Enji Lite is an AI assistant for project management: connect the tools your team already uses, and it answers questions about progress, surfaces risks, and generates reports and dashboards. This policy explains what we process to do that, and why.

1. Who we are and what this policy covers

This Privacy Policy explains how Enji Lite handles information when you visit our website, sign up, connect a tool, use the product, or manage your subscription.

It applies to website visitors, account holders, team members you invite, and people whose information may appear in the data you connect — for example, names and comments in a Jira issue or a Slack message. In this policy, “the Service” means Enji Lite: the web application, its chat assistant, integrations, scheduled reports, and dashboards.

Enji AI LLC develops and operates the Service and provides support. We are a limited liability company registered in the Kyrgyz Republic, taxpayer identification number 01907202310418, registered address 11 microdistrict, 14/4, Bishkek City, Kyrgyz Republic, 720049. We are the controller for account, product, technical, and communication data. For the content of the tools you connect — your team’s issues, messages, commits, and documents — we act as a processor on your behalf, and your instructions govern that processing, together with our Data Processing Agreement — which applies automatically and needs no signature.

Dodo Payments sells subscriptions to you as merchant of record. We use Dodo Payments Inc. and its affiliates (“Dodo Payments”) as our reseller and merchant of record. Dodo Payments collects your card and payment details directly, issues your invoice, and calculates and remits any applicable tax. For the personal data it collects from you as a buyer — for transaction processing, fraud prevention, sanctions screening, tax and dispute handling — Dodo Payments is an independent controller under its own privacy policy (dodopayments.com/legal/privacy-policy), not acting on our instructions. For a limited set of activities we direct (such as customer records for our accounts), it acts as our processor. See section 8.

You can contact us at contact@enji.ai.

2. Information we collect

We collect the following categories of data:

  • Account data — user id, email, name, role, organization/workspace, account status, language and notification preferences.
  • Connected-tool data, once you authorize a connection:

Task trackers (Jira, Linear) — boards, teams, issues, statuses, comments, and the names of the members who appear on them. In Jira only, when you explicitly ask, the assistant can also take an action on your behalf — creating, commenting on, transitioning, assigning, or linking an issue; logging work; or managing a sprint — with your confirmation before each action runs. Linear is read-only: we never create or modify anything there, regardless of what a connected Linear API key is itself capable of.

Source control (GitHub, GitLab) — repositories and groups you select, commits, branches, merge and pull requests, and review comments. We process this as metadata to answer questions and build reports; connecting a repository is not the same as uploading its full contents. During each sync we make a temporary clone without file contents to read commit history from the default branch, and delete it as soon as the sync finishes; no source code is stored. We only read — for GitHub specifically, the access we request is broader than this (GitHub does not offer a narrower scope for what we need), but we do not use the write part of it.

Knowledge base (Confluence) — the spaces and pages you select as knowledge sources for the AI assistant. Read-only.

Meeting transcripts (Fireflies) — the transcripts you connect: meeting title, the organiser’s email address, participants’ names and email addresses, what each speaker said, the summary and the meeting link. Read-only.

Messengers (Slack, Telegram) — the channels and chats you connect, and the messages and participants within them — including, for Slack, participants’ email addresses — within the history window your plan allows (section 10). These are also how we deliver output to you: scheduled reports, reminders, and chat answers are sent into your connected Slack channels/DMs or Telegram chat by our own bot or account, not by a team member’s personal one.

  • Chat and AI content — the questions you ask Enji Lite, its answers, and any charts, summaries, or reports it generates from them. Voice input in chat uses your browser’s built-in speech recognition. In some browsers, such as Chrome, your speech is sent to the browser vendor for recognition under its own terms; we receive only the resulting text.
  • Project and workspace data — project names, connected-source configuration, scheduled report settings, dashboard settings.
  • Subscription and usage data — your plan, seat count, connected-source and chat counts against your plan’s limits, AI usage spend against your included allowance and spending limit, and billing status. See section 3 for AI usage specifically, and section 8 for payment data.
  • Communication data — support and feedback messages, and email notification records.
  • Technical data — IP address, request and device metadata, cookies and local/session storage values, logs, and security events (section 7).

3. AI processing

Enji Lite uses a third-party AI provider to understand your question, read the connected data relevant to it, and generate an answer. We use OpenAI, including for embeddings. Which model handles a given request depends on the task — more demanding reasoning tends to route to a larger model, and simpler sub-tasks to a smaller one.

We do not train or operate an Enji-owned foundation model on your content. Selected task context — the parts of your connected data relevant to your question — is sent to OpenAI, under its own data-use and retention terms. Not training a model on your inputs is not the same as not retaining them: OpenAI may still hold task context briefly for abuse monitoring under its own terms. We have a data processing agreement in place with OpenAI covering this processing, and it is our sub-processor, not an independent controller of your content — it processes it on our instructions, under an agreement we remain answerable for.

Before content reaches a model, we run it through a masking step that redacts patterns such as email addresses and some other personal data. This reduces what reaches the model; it is not a guarantee that no personal data ever does, and it is not a substitute for OpenAI’s own policy. Treat data you connect to Enji Lite the way you would treat data you send to OpenAI directly.

Request traces. To help you when you raise a question about an answer, we keep traces of AI requests — the prompt, the answer and the context used — in a tracing tool we host ourselves on Hetzner in Germany. Traces are deleted automatically after 30 days.

We do not sell your data or use it for unrelated advertising.

Article 50 of the EU AI Act. Since 2 August 2026, providers of generative AI systems must ensure people can tell when content is AI-generated. Enji Lite generates chat answers, reports, dashboards, and — where you ask for it — comments and updates inside Jira. Our position: this output is delivered to the customer who asked for it, inside their own workspace or their own connected tools, under their own review, and it is not published to the public by us or presented as anything other than machine output — so it falls outside what Article 50(2) is aimed at, which concerns content produced for the general public. Where we can, we mark it anyway: content the assistant posts into a connected tool does so under an identifiable Enji identity (the connecting bot or account), not as a person. If you take Enji Lite’s output and publish it onward yourself, you are the one making it public, and Article 50 looks at you as the deployer, not at us. This is our assessment, not a regulator’s, and we will revisit it as guidance develops.

4. How we use information

To operate the Service: authenticate you, sync the tools you connect, answer questions in chat, take the specific action you request in Jira, generate scheduled reports and dashboards, and enforce your plan’s limits.

To bill your subscription: create your order with Dodo Payments (which takes payment, calculates tax and issues invoices and receipts), credit AI usage top-ups, track AI usage against your included allowance and spending limit, and send usage alerts.

To provide support, and communicate about your account.

To keep the Service secure and reliable, prevent abuse, investigate security events, and comply with legal obligations.

5. Legal bases

Where the law requires a legal basis for processing personal data, we rely on:

  • Performance of a contract — to give you an account, sync your connected tools, answer your questions, run scheduled reports, take payment, and provide support.
  • Legal obligation — to keep accounting, invoicing, and tax records, and to respond to lawful requests from authorities.
  • Legitimate interests — to keep the Service secure, prevent fraud and abuse, understand aggregate usage — from execution and subscription metadata, not from the content of your connected tools or chat history — and enforce our terms. We weigh these against your rights and do not rely on them where your interests override ours.
  • Consent — for non-essential cookies. You can withdraw consent at any time.

For the content of the tools you connect, you (or your organization) are the controller, and you determine the legal basis for that processing — including making sure you are entitled to connect data belonging to your team and its members.

6. Sharing and subprocessors

We share information with categories of service providers that help us run the Service:

  • Hosting and infrastructure — Google Cloud (compute, europe-west3/Frankfurt) and Amazon Web Services (S3 object storage, eu-west-1, for profile photos, project logos, feedback attachments, and AI-generated chart images).
  • AI provider — see section 3.
  • The integration providers you connect — Atlassian (Jira, Confluence), Linear, GitHub, GitLab, Slack, Telegram. Account sign-in — Google(Google Sign-In is the only way to sign in). Google acts under its own terms as an independent identity provider for that login, the same basis on which Dodo Payments handles payment data, rather than as our sub-processor for your connected-tool content.
  • Payment processing and billing — Dodo Payments, our reseller and merchant of record, which sells the subscription to you, takes payment, and determines, charges and remits any applicable tax and issues invoices, as an independent controller of your buyer data. We send it only an order reference, an identifier of your workspace, the type of purchase (a plan or an AI usage top-up) and the plan; you enter your name, email address and billing details directly at checkout. We receive back payment and subscription status. We do not send it AI usage data or anything from your connected tools or chats.
  • Email — Amazon SES (eu-west-1, Ireland), for service emails and notifications, including results of scheduled tasks.
  • Request tracing — Hetzner (Nuremberg, Germany), hosting the tracing tool we operate ourselves (section 3).
  • CDN and security edge — Cloudflare, for TLS, delivery, and protection, using IP address and request metadata, and carrying customer content in transit as described in section 11.

Those that handle your connected-tool content — Google Cloud, AWS (S3 and SES), OpenAI, Hetzner and Cloudflare — are named in the Data Processing Agreement, Annex 3, changes to which trigger 30 days’ notice by email to your account contact (updating Annex 3 is how the list stays current; it is not how you are told). We do not sell personal information. We may also share information when required by law, to protect rights and security, or in connection with a business transaction.

7. Cookies and browser storage

We use cookies and browser storage for authentication, sessions, and product operation. That storage is essential and does not depend on your consent.

We use Google Analytics 4 (GA4) on the public website only. There is no analytics inside the product.

Current inventory.

enji_lite_cookie_consent. Provider: Enji Lite. Purpose: stores whether the visitor accepted or rejected optional analytics storage. Type: Essential. Lifetime: 90 days. Data flow: stored in the visitor’s browser and not sent to Google Analytics.

NEXT_LOCALE. Provider: Enji Lite. Purpose: stores the visitor’s selected interface language. Type: Functional. Lifetime: Session. Data flow: stored in the visitor’s browser.

_ga. Provider: Google Analytics. Purpose: helps Google Analytics distinguish visits after optional analytics is accepted. Type: Analytics. Lifetime: up to 2 years under Google Analytics default settings. Data flow: sent to Google Analytics when the analytics tag is active.

ga. Provider: Google Analytics. Purpose: keeps session state for the configured Google Analytics 4 property after consent. Type: Analytics. Lifetime: up to 2 years under Google Analytics default settings. Data flow: sent to Google Analytics when the analytics tag is active.

The public website does not set an attribution or campaign-tracking cookie, and does not set a cookie from Cloudflare or any other CDN/security edge — the international transfer described in section 11 involving Cloudflare does not involve a cookie on the website.

You can change your analytics choice at any time using the Cookie settings link in the site footer.

How consent works. Before a choice is saved, Enji Lite does not load Google Analytics. If you accept optional storage, analytics starts for that browser. If you reject it, Enji Lite stores only the rejection choice and removes optional analytics storage where the browser allows it. Essential and functional cookies — including your language selection — are unaffected by this choice either way. Change your mind at any time with the Cookie settings link in the site footer.

8. Payment and billing data

Dodo Payments handles your subscription payment. Everything you enter at checkout — card details, billing address and, if you buy as a business, your tax ID — goes to Dodo Payments directly, into its PCI DSS-certified system. We never receive or store your full card number or expiry date. We may receive masked card details, such as the last four digits, card network, card type and issuing country. Dodo Payments separately collects and processes some of your data — including for fraud prevention, sanctions screening and tax compliance — as an independent controller under its own privacy policy (dodopayments.com/legal/privacy-policy), not on our instructions. It may process data in the United States, the United Kingdom and India, using its own service providers (including cloud hosting and payment partners), under its own transfer safeguards.

Dodo Payments issues your invoice and receipt, and holds the record of your payments and tax. We hold the record of your subscription on our side — plan, seat count, subscription status, and AI usage and spend figures — together with the order, payment and subscription references Dodo Payments gives us for reconciliation.

What Dodo Payments tells us, and what we keep. Dodo Payments notifies our systems of payment and subscription events (for example payment succeeded, failed, renewed, cancelled or put on hold) using signed notifications that we verify before acting on them. These can include your name, email address, phone number and billing address if you provided them, masked card details (last four digits, card network, card type, issuing country), the payment method, an invoice reference and, if a payment fails, an error code. We keep the notifications we receive for up to 90 days, so that each one is processed once and problems can be investigated; they can contain the fields above. After that we keep only what we need to run your subscription and reconcile payments: your customer, order, payment and subscription references, the amount, currency, status and dates, and the billing country. We never receive your full card number. We may also retrieve your subscription details from Dodo Payments (such as the masked card on file, your billing contact and your invoices) to show them in your billing settings and let you download invoices.

Tax records. Dodo Payments, as seller of record, calculates, collects and remits sales tax, VAT and GST on your purchase and keeps the resulting invoices and tax records. We keep our own accounting records of payouts from Dodo Payments.

9. Security

Access to your content by our team is limited to support, security, incident response, and abuse prevention, on a least-privilege, need-to-know basis.

We hold no security certifications. We are not SOC 2 audited and not ISO 27001 certified. We would rather tell you that here than let you assume otherwise.

Credentials. Connected-tool access uses the credentials described in section 2 — an OAuth grant or access token you (or the connecting user) create for Jira, Linear, GitHub, GitLab, and Confluence, an API key you create for Fireflies, and our own bot credentials for Slack and Telegram. These are stored encrypted, and used only to run the Service for the connections you’ve configured.

To report a security concern or suspected vulnerability, contact contact@enji.ai.

10. Retention

We keep information for as long as needed to provide the Service, support you, comply with legal obligations, and enforce agreements.

Messenger history — Slack and Telegram messages — is retained for the window your plan allows: 14 days on Trial, 30 days on Basic, 90 days on Growth, and 180 days on Pro. This is a real deletion, not just hiding data from the UI: messages older than the cutoff are never stored in the first place, and a daily process removes anything that ages past the window from our database. The channels themselves, and the fact that they’re connected, are not deleted by this process. If you move to a plan with a shorter window, the shorter window applies from then on, and the daily process deletes messages older than it. If your subscription is suspended, cancelled or expires, the window of your last plan stays in place. This deletion cannot be undone.

The AI assistant’s own chat history — the questions you’ve asked and its answers — is a separate thing and is not bounded by the window above. It is kept until you delete the conversation yourself or your workspace is closed.

Other connected-tool data — synced Jira and Linear issues, GitHub and GitLab commits and metadata, Confluence pages and Fireflies meeting transcripts — is kept to answer questions and generate reports for as long as the connection stays configured, and is refreshed on each sync. Disconnecting a tool stops future syncing immediately but does not delete what was already synced exceptions — with one exception: disconnecting Confluence deletes its indexed knowledge-base content immediately, because that content is stored as search vectors rather than as raw synced records and disconnecting Fireflies deletes its synced transcripts immediately. Data from every other integration is removed only when your workspace is closed.

Technical data — IP address, request and device metadata in our infrastructure logs — is kept for 30 days. Security and access logs, are kept for up to 24 months. Support and other communications are kept for up to 24 months after the exchange closes. Traces of AI requests are deleted after 30 days (section 3). Usage metadata is deleted with your workspace; aggregated statistics that identify nobody may be kept indefinitely.

Financial records: invoices, receipts and tax records are held by Dodo Payments as seller of record, for as long as its legal and tax obligations require and under its own retention terms. Deleting your workspace does not delete them, and Dodo Payments may keep customer, order and invoice records for compliance. Our own order references and subscription history are deleted along with the rest of your workspace data when it closes, except records we must keep for our own accounting. Payment notifications from Dodo Payments are deleted after 90 days at the latest. You can also ask Dodo Payments to delete your personal data through its data deletion process (dodopayments.com/legal/data-deletion), subject to what it must keep by law.

Closing your workspace deletes your projects, the AI assistant’s chat history, connected-tool sync data, and messenger channel and message records, subject to the exceptions above. Backups are retained for 7 days on the same infrastructure the Service runs on, then age out on their ordinary cycle. Task context already sent to OpenAI survives closure under its own retention terms — we cannot recall it — and a record that a deletion happened, identifying nobody, is kept as evidence that it occurred.

You can request deletion at contact@enji.ai.

11. International transfers

Profile photos, project logos, feedback attachments, and AI-generated chart images are stored on AWS infrastructure in Ireland (eu-west-1) — within the EU. The rest of Lite’s production compute and databases run on Google Cloud in Frankfurt (europe-west3) — also within the EU. Service emails are sent through Amazon SES in Ireland (eu-west-1), and AI request traces are stored on Hetzner in Nuremberg, Germany — both within the EU.

Our team. Our engineering team is distributed, including members in the Kyrgyz Republic. When a team member accesses your content — which happens only for support, security, incident response, and abuse prevention — that access can come from outside the United Kingdom and the European Economic Area. Under data protection law this counts as an international transfer even where your data itself is stored within the EU/EEA or UK. These transfers are made under appropriate safeguards: the UK International Data Transfer Agreement for UK data, and the EU Standard Contractual Clauses for EEA data, supported by an assessment of the risk of transferring to the Kyrgyz Republic.

AI provider. As described in section 3, selected task context is sent to OpenAI, which processes it in its own regions under its own terms — this is not limited to the EU. These transfers are made under the Standard Contractual Clauses and the UK Addendum.

Our CDN and security edge. Cloudflare sits in front of the Service and the website, operates a global network, and is a United States company. Your IP address and request metadata pass through whichever of its locations serves you, which is not always inside Europe, and TLS is terminated at that location — including for the connected-tool content and reports you view in the product. Cloudflare stores none of it and has no access to it as stored data, but decryption outside Europe makes this a restricted transfer, made under Cloudflare’s data processing addendum, which incorporates the EU Standard Contractual Clauses and the UK Addendum.

Dodo Payments. Dodo Payments, as an independent controller of your buyer data, is established in the United States and uses group companies and providers in the United Kingdom and India. Transfers of your data to and between them are its responsibility under its own privacy policy and data processing terms. What we send it is described in section 8.

You can request a copy of the transfer safeguards we rely on at contact@enji.ai.

12. Automated decisions

Enji Lite scores nothing about you as a person — it reads project data and generates answers, reports, and (in Jira, on request) actions. None of that is a decision about a person, and we do not use it to evaluate anyone’s performance, reliability, or conduct. If you use Enji Lite’s output to assess your own people, that is your processing and your own obligation under Article 22, not ours.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. If we suspend an account, a person makes that decision, and you can contest it at contact@enji.ai.

13. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export personal information, or object to certain processing. You can also disconnect any connected tool and delete projects; this stops future syncing, while retained records are handled as described in section 10.

Contact us at contact@enji.ai to make a request; we may need to verify your identity first.

You can also complain to a data protection authority. In the United Kingdom, that is the Information Commissioner’s Office (ico.org.uk). In the European Economic Area, it is the supervisory authority of the country where you live or work.

Our Data Processing Agreement applies to every customer automatically — it forms part of the Terms and needs no signature. It carries the transfer safeguards, the sub-processor list, and 30 days’ notice of changes to it.

Our representative in the United Kingdom. Enji AI LLC is established outside the UK, so under Article 27 of the UK GDPR we have appointed a representative:

Mad Devs Group Ltd 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom Company number 11793394 privacy@maddevs.io

This mandate covers Enji Lite.

Our representative in the European Union. Enji AI LLC is established outside the Union, so under Article 27 of the GDPR we have appointed a representative in the European Union as well:

Prighter EU Rep GmbH Schellinggasse 3/10, 1010 Vienna, Austria Registered in the Austrian Firmenbuch, FN 639035 h support@prighter.com

You can also reach them through the Trust Center at app.prighter.com/portal/16660917026. This mandate covers Enji Lite.

You can address either representative instead of, or as well as, us. Appointing a representative does not change who is responsible: we remain the controller and processor, and the representative does not take that on.

14. Children

The Service is not directed at children. You must be at least 18 to use it — see the Terms of Use — and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, write to contact@enji.ai and we will delete it.

15. Accessibility

Our commitment to accessibility, and where we currently stand against WCAG 2.1 AA, is on the Accessibility page.

16. Changes to this policy

We may update this Privacy Policy as Enji Lite, its integrations, or legal requirements change. The updated version will be posted on this page with a new effective date.

If a change materially affects you, we will tell you at least 30 days beforehand, by email to your account contact or a notice in the product.