Privacy Notice

Welcoming word

To all our users of Setapp!
Thank you for your participation, and welcome to the Eney AI Assistant (Beta 2.0).

We are committed to being clear, transparent, and respectful of your privacy and personal data protection rights. This Privacy Notice has been specifically developed for our new MAC application, Eney AI Assistant (“Eney”), available on our platform, Setapp. This Notice will give you a clear understanding of Eney’s functionalities, the models we use, and how we process and protect your personal data. If you want to learn more about how we handle your personal data when you use Setapp, please visit the Setapp Privacy Notice.

Eney Team has developed a special Handbook, where you can find a lot of valuable information about Eney, including Privacy & Security commitments and FAQs.

This Privacy Notice should be read in conjunction with Eney’s Terms of Service. Make sure you are familiar with the Terms and understand how to use Eney, including the specific conditions that apply.

I. About Us and Applicability

The data controller of Your Personal Data is MacPaw Way Ltd. (hereinafter “We/we”, “Us/us”, “Our/our” or “MacPaw”), registration number 428214, registered address: 25 Serifou, Allure Center 11, Office No. 11-12, 2nd Floor, 3046 Zakaki, Limassol, Cyprus.
[email protected]
macpaw.com

By You we mean a user of Setapp and Developer (Vendor) if you are a party to the License Agreement with you.

This Privacy Notice does not apply to:

• Third-party services. Where third-party services are used, and the third party is not a Data Processor, no Personal Data (as defined below) is shared with them; and
• Personal Data that we process about you when you interact as a user with other products/services or our branded social media pages under the brand name “MacPaw”. In such cases, the relevant privacy notice for each product/service you interact with will apply accordingly.
• Your use of and interactions with our website, MacPaw (Website or Site). The Site’s policy can be found by following this link. When you use the Website, we collect and use cookies and other tracking technologies; the relevant Cookie Notice can be found here.
• Your use of and interactions with our Setapp website. The Site’s policy can be found by following this link. When you use the Setapp website, we collect and use cookies and other tracking technologies; the relevant Cookie Policy can be found by following this link
• Anonymized data.

If you do not agree with this notice, please do not use Eney AI Assistant (Beta). If you change your mind later, you must stop using Eney and can request that we delete your data.

II. Beta Status & Human Loop

Short summary: Eney may sometimes make mistakes or produce unexpected results. If this happens, please let us know: App Settings > Submit Complaint. Add your message and attach files if needed. We’ll promptly review it and address the issue.

Eney is an experimental (beta) service designed to help you with suggestions and tasks. Because it is still learning, it can sometimes be:

• Inaccurate, unreliable, or limited in its answers.
• Unstable or produce unexpected results as we update it.
• We may change the underlying Large Language Models (LLMs) as we develop and test.

Eney does not make any decisions with legal or significant effects on you – any answers or recommendations it gives are for guidance only, not final or binding decisions. Under data protection laws, you have the right to ask for a human review of any fully automated decision that significantly affects you. While Eney doesn’t make decisions of this nature, we want to uphold the spirit of this right. If you ever have concerns about an AI-generated output or need clarification, you can request a human loop (a manual review by our team) via App Settings. Our team will review and get back to you within 30 days upon your request. This way, you can always have peace of mind knowing that you can get human help and oversight whenever you feel it’s needed.

We also welcome your feedback to help improve Eney.

III. Your Data and Vocabulary

To help you understand and navigate this Privacy Notice, here are short explanations of key terms we use:

Account information – your email (when you want to contact us or provide feedback), Unique Account ID, username, or sign in with a token. In many cases, the beta is part of the Setapp platform, so your existing account details for Setapp are also held by us. Those are covered by the Setapp Privacy Notice, but relevant parts are summarized here for convenience.

User Input – the queries, commands, or text you type in chat.

User Interaction – information about how you use Eney (e.g., clicks, task requests, usage patterns).

DeviceData – basic technical info about your computer, like its operating system version, installed apps, IP, and system logs. This data is used to make Eney work better for you and helps us diagnose compatibility issues. We do not store your raw IP.

Usage Logs and Metadata is a basic usage information that helps us monitor system performance and usage trends. These data may include timestamps of requests, the features you use, and performance metrics (e.g. response time, success/failure flags).

Vendor Extension Data – the data we collect when you, as a vendor, integrate your application through extensions (plug-ins). This data includes Vendor app metadata (such as app name and bundle identifier), commands, command parameters, command execution status, command output, and command execution logs. Please follow the Vendor Extension attached below.

Feedback and Bug Reports: if you choose to send us feedback via the website, we will collect whatever information you provide. This might include screenshots, error messages, or your comments about Eney’s performance. We use this solely to fix performance, human review, and improve Eney. We encourage you not to share information that you want to keep private.

Task Execution – tracks whether your request is processed directly on your device (On-Device Processing) or sent to LLMs (Remote Processing).

Output Data means the information Eney receives back after processing your request with remote LLMs (like OpenAI). This data helps Eney to give you useful responses and perform the actions you asked for. This data may, for example, contain output text (message), converted User Input, extracted files, autocompleted phrases, etc.

Skills Orchestration is the process of converting natural language into the command Eney is able to execute. We operate Skills Orchestration to execute actions provided by external vendors’ applications. You will find more about external vendors’ integrations in section Third-Party Apps’ Integrations and Service Providers.

Usage and Analytics Data

Short summary: Our goal is not to collect unnecessary data, but to responsibly improve Eney’s ability to serve you better as it moves toward public release. We may use User Input, User Interaction, Output Data, and Task Execution Data (all anonymized and not linked to you) to train and fine-tune our local ML Models. Before doing so, we (1) detect and remove any direct identifiers before sending for internal analytics and for model training; (2) anonymize your personal data to be linked back to you.

The in-app Usage and Analytics data is used exclusively for internal analytics. This data allows us to understand how Eney is used, fix issues, and improve its core functions. To do so, we collect and process the following types of data:

• Service and Performance data. In most cases, it is non-personal, technical data used to monitor the stability and performance of the app. It includes unique app and session identifiers (random IDs that cannot be alone directly linked to you), and app status data (version of app and features used).
• AI Processing Data. We use it to help Eney understand your User input, User Interaction Data, and generate accurate Output Data. In particular, this data includes text input and query embedding (i.e. numerical format of User Input used by Eney to understand the context).
• Contextual File Data. When you explicitly ask Eney to perform a task with your files, images, documents, or folders. Please note: this data is relative and does not expose your Mac user name or your full file path to our servers.
• Vendor Extension Data. This data is only collected if you integrate a third-party app with Eney (as a Vendor Extension) and includes string identifiers to track commands, status, and logs for that specific app integration.

IV. How Eney Works. On-Device Processing (Local)

Short Summary: Most Eney features run locally on your device, so your data doesn’t leave it. We collect some Usage and Analytics Data to monitor stability, fix bugs, and ensure local features work as intended. Eney will always ask your permission before accessing anything on your Mac. We never share your data with external parties or services for purposes that don’t align with this Notice.

ML Models (Machine Learning Models) – these are the specialized programs created by us that allow Eney to understand your requests, search your data (files, contacts, calendar events), and generate responses.

For contextual search and task execution, Eney utilizes local ML Models on your Device to understand the context of your User Input and Device, without sending your data to any external providers.

For the tasks and actions that require your permission (i.e. access to files, access to the application), Eney will explicitly ask for your permission. You can always withdraw your permissions in settings.

V. How Eney Works. Remote Processing by using fine-tuning LLMs

Short summary: While most tasks are completed locally, some require advanced language understanding, so Eney may use external LLMs. These models are only used to process your request, generate a response, and send it back to Eney. The data we share is anonymized and not used to train external LLMs. So if you ask to summarize a document, we share the text of the document but not who you are.

LLM (Large Language Model) - is a type of smart AI that can understand and generate human-like text. It has been trained on large amounts of publicly available information to help answer your questions, give suggestions, or assist with tasks. In Eney, we utilize trusted third-party LLMs to process your requests and provide helpful responses. Your data stays locally.

To provide Eney’s Remote Processing functionality, we integrate with third-party AI language model services.

Services we use: We currently use OpenAI’s GPT and Google Gemini. These providers act as our data processors, meaning they are bound to handle the data on our behalf and not for their own purposes. We have agreements in place with each provider to ensure your data is kept confidential and secure. To learn more about it, refer to the Data we disclose to service partners, purposes, and data transfer mechanisms below. Please make sure you are familiar with LLM’s terms and privacy commitments.

Data training: by default, LLMs do not train their models on your data. Some Log and Metadata may be logged temporarily to improve service quality and combat abuse; however, it does not contain any personal identifiable information. Please make sure you are familiar with LLMs terms and privacy commitments regarding training data.

In the table below, we provide you with information about LLMs, what data is processed, and for what purposes.

The list of Services is not exhausted and may be updated. We will amend this Privacy Notice accordingly.

VI. Third-Party Apps’ Integrations and Service Providers

Short Summary: Eney integrates with both third-party applications and external service providers to perform specific tasks and enhance functionality. Third-party applications and service providers are listed, along with links to their respective privacy policies. The use of these third-party tools is governed by their own terms and conditions. The provided lists are not exhaustive and may change as Eney evolves.

Eney is a part of Setapp, which includes a variety of integrated applications. During the beta release, Eney may interact with third-party apps to perform specific tasks, enhance functionality, or connect with external apps. Please be aware that the use of the Third-Party Apps is subject to their own terms and conditions of use and privacy policies.

This list is not exhaustive. We may add, update, or remove third-party integrations as Eney evolves.

We engage trusted third-party service providers to help deliver specific features based on your requests. Please be aware that the use of the Third Party Service is subject to their own terms and conditions of use and privacy policies.

This list is not exhaustive. We may add, update, or remove third-party services as Eney evolves.

VII. Purposes and legal grounds

Short summary: This section outlines the specific purposes for which your data is processed, alongside the legal grounds that permit this processing. The full list of all purposes and their corresponding legal grounds is prepared in the table below.

This list is not exhaustive. We may add, update, or remove third-party integrations as Eney evolves.

VIII. Data we disclose to Service Partners

Short Summary: We do not sell or use your data for marketing purposes. We only share it with AI model providers for remote processing, internally within MacPaw, and with secure providers for cloud services and analytics. We might also need to share it during a merger or acquisition, or when legally required to do so.

Disclosure to others: Aside from LLM’s services, we do not routinely share your personal data with others. The only other instances of sharing would be:

• Within MacPaw: Eney team and other departments within MacPaw may access data as needed to operate the service, preserving its stability and functionality, and for internal analytics purposes. For example, when you share Account information for sign-in with a Setapp token, or when you integrate with third-party apps available within the Setapp, like CleanMyMac or ClearVPN, belonging to MacPaw.
• Service Providers: We use trusted service providers for cloud infrastructure (servers), analytics, error tracking, and for processing your Feedback and Bug Reports. All such providers are bound by confidentiality and data protection obligations via contracts.
• Legal Requirements: We may disclose or allow government and law enforcement officials access to your data, in response to a subpoena, search warrant, or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and services.
• Merger/Acquisition: If our company is ever involved in a merger, financing, reorganization, or sale, your data may be transferred as part of that deal (under appropriate confidentiality and legal safeguards). You would be notified of any change in data handling due to such an event.
• Communicating with You: We may send you essential service communications related to Eney. For instance, if we update this Privacy Notice or if there’s a significant change (like an important bugfix or the beta ending), we might email or notify you through the Eney app. We won’t send marketing emails unless you separately opted in to those via the main marketplace platform – and you can opt out anytime. We have external communication partners that provide us with infrastructure and services for the delivery of communications to you. To learn more, refer to Setapp Privacy Notice.

We do not sell your data to any third party. We also do not share it for marketing or advertising purposes (except when you solely use Setapp; to learn more, refer to Setapp Privacy Notice.

In the table below, we provide information about third-party LLMs and Service Partners we share your data with, the purposes of such sharing, and the transfer mechanisms we rely on to ensure secure data transmission.

IX. AI Limitations

Short Summary: Eney is not a professional advisor and might produce inaccurate results. Always use your judgment and avoid sharing confidential or sensitive information related to health, finances, etc. If you encounter any inappropriate or harmful content, please report it to us. You may also use App Settings to submit your request or complaint.

Eney can answer questions and help with tasks, but it has certain limitations:

• It may occasionally give incorrect or irrelevant answers. Always double-check important information in User Input Data and Files, based on your own understanding of what you consider important for you.
• It is not a professional advisor. Do not rely on it for medical, legal, financial, mental health, or other critical decisions. We do not intentionally process sensitive data. We kindly ask you to avoid sharing any sensitive (such as health details, political opinions, or similar) and personal information (to the extent you prefer not to share with us). When using Eney. We also encourage you not to share your confidential information, based on your own understanding of what you consider confidential. If you believe we have inadvertently processed your sensitive data or confidential data, please contact our Customer Support or submit a request using this form, and we will promptly review and delete this data.
• We do our best to filter out offensive or inappropriate content, but Eney might inadvertently generate unsuitable responses. If you see any, please let us know by using this form or go to App Settings -> Submit Complaint -> write a message and attach files if needed. Use your own judgment when acting on the AI’s suggestions.

X. Security

Short summary: We’re ISO 27001 certified and protect your data through strict access controls (MFA), real-time threat detection, secure data handling, and on-device model protection. We continuously improve our data security and privacy practices. If a data breach occurs, we’ll follow our response plan and notify you and the relevant regulatory authorities.

We are committed to protecting the privacy and security of your data. MacPaw has achieved ISO 27001 certification, demonstrating our dedication to maintaining a high standard of information security management. This internationally recognized standard sets requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

Here’s how we ensure the security and confidentiality of your data:

• Protection of Processing Environment: Our ML models are secured from unauthorized access or data leakage.
• Access Control: We carefully manage who has access to our systems and regularly review permissions.
• Application & Development Security: All code is reviewed and tested for vulnerabilities before release. We follow secure software development practices and use advanced tools to detect and fix security issues early.
• Threat Detection: We monitor our systems in real time for suspicious activity and respond quickly to potential threats.
• Network & Endpoint Protection: Our infrastructure is protected by firewalls, intrusion prevention systems, and secure device policies. All company devices are encrypted and centrally managed.
• Data Handling: We securely back up data, manage software components responsibly, and follow strict procedures for data deletion and leakage prevention.
• Authentication: We use a centralized identity system and enforce multi-factor authentication (MFA) to protect employees’ accounts who work with your data.

If, despite our safeguards, a data breach were to occur that poses a risk to your rights (for example, unintended exposure of personal data), we will notify you and regulators as required by law. We have an incident response plan in place for such situations.

As we continue to improve Eney ahead of its full public release, we’re continuing to work on the implementation of strong privacy-enhancing technologies. While we take strong measures to protect your data, we still recommend avoiding the inclusion of sensitive or confidential information unless you consider it necessary.

XI. Data Retention and Deletion

Short Summary: We retain your data only for as long as needed for the Purposes listed above, or as required by law. You have the right to request deletion or anonymization of your personal data, and we will do so, unless we are required to keep it. Below, we outline the types of data we retain, why we retain it, and for how long.

We retain your personal data only as long as necessary for the purposes described in this notice (or as required by law). Since this is a beta service, we are likely to iterate quickly, and we don’t plan to keep large historical archives of beta user data. In general:

• User Input and text input: The content of your AI conversations is securely stored on our servers. We will retain some prompts for improvement and training purposes, and will anonymize or delete them upon your request or when we run out of the purposes of collection.
• Remote Processing by LLMs: (1) The content of your requests (inputs and outputs) is retained on OpenAI’s servers by default up to 30 days; (2) Google might store User Input Data and the Output Data for up to 30 days for debugging and quality purposes.
• Usage Logs and Metadata: Basic metadata and logs are kept for a short period during the beta (e.g., to analyze usage patterns or troubleshoot issues). We aim to retain these logs for the minimum duration necessary – often just a few weeks or months of data. For crash reports, we retain data no longer than 90 days in Functional Software, Inc. d/b/a Sentry.
• Account Information: If the AI assistant is tied to your account on the Setapp platform, we retain your account data as long as your account is active. You can delete your account at any time, which will remove personal info like your name, email, etc. from our live systems (except information we are required to keep for legal reasons, which we’ll isolate and protect).
• Feedback and Bug Reports: Feedback you send us (e.g., problem reports) may be retained until the end of the beta, as we may refer back to it while making improvements. We may also keep aggregated notes from feedback to carry lessons into the public release. Any personal identifiers in feedback (like your email or name if you included them) will be removed upon your request or when we run out of the purposes of collection.
• Usage and Analytics Data: to improve the accuracy, safety, and overall quality of Eney, we may retain your data for internal analytics and development purposes for up to 5 years. These efforts are essential and strictly necessary to enhance the AI’s capabilities before and after its official release following the beta phase. You may request that we delete your data.

Deletion: After the beta or upon your request, we will delete or anonymize personal data associated with the beta. If you leave the beta program, you can request that we erase data you provided, and we will do so (to the extent we control it and it’s not required to keep by law). Our policy is to anonymize or delete data that we no longer need for the purposes for which it was collected.

XII. Your Rights

Short Summary: You have the right to access your personal data, request a correction, ask for deletion, or object to processing. If you have concerns about AI-generated outputs or believe Eney has produced harmful, inaccurate, or unexpected results, you may request a Human Loop. To exercise any of these rights, contact us as outlined below; we typically respond within 30 days.

You have rights over your personal data, and we’re committed to helping you exercise them. Here's what you can do:

• Access & Portability: You can ask for a copy of the personal data we hold about you. We'll send it in a commonly used, readable format.
• Correction: If something we hold about you is wrong—like your account details—you can request a correction. Some information can be updated directly in your Setapp profile settings.
• Deletion: You can ask us to delete your personal data, including Account Information, User Input Data, files, and Feedback. In some cases, we may keep limited data (e.g., to comply with legal obligations), but we’ll let you know if that’s the case. Once deleted, your data can’t be recovered.
• Restriction: You can request that we temporarily stop using your data, for example, if you’re verifying its accuracy. We’ll restrict access and only use it if absolutely necessary until the issue is resolved.
• Objection: If we use your data to improve the service or for other purposes you disagree with, you can ask us to stop. We'll honor your objection unless we have a valid reason not to, which we’ll explain.
• Request Human Review: If you have concerns about an AI-generated output that significantly affects your rights and freedoms, you can request a human loop. To learn more, refer to section Beta Status & Human Review above.

To make a request, please contact us using the details in the section Contact us below. We may ask for confirmation to protect your data from unauthorized access. We usually respond within 30 days.

If someone else contacts us on your behalf (like an authorized agent), we’ll need proof of their permission and identity before proceeding.

XIII. Changes to this Notice

Because this is a beta and things may evolve, we might update this Privacy Notice to reflect improvements in our practices or changes in the beta program. If we make significant changes, we will notify you (for example, via an in-app alert or email). The “Last Updated” date at the top will always indicate when the latest changes were made. We encourage you to check this notice periodically during the beta. Your continued use of the AI assistant after an update signifies your acceptance of the new terms.

XIV. Contact Us

Short Summary: for all inquiries, contact us at [email protected] or [email protected]. We always welcome your feedback. You can also use the in-app feature: App Settings -> Submit Complaint. For data requests, please include your associated email or Setapp account.

We value your privacy and are here to address any questions or concerns you have. Сontact us at:
Email: [email protected],
[email protected] (dedicated Data Protection Specialist e-mail).

We always welcome your feedback to help improve Eney.

You can easily submit a request, file a complaint, or provide feedback directly within the Eney app by going to App Settings -> Submit Complaint, then writing your message and attaching any necessary files.

When contacting us about your data, please include the email or Setapp account you used with Eney so we can locate your records. We will verify your identity to protect your privacy.

SKILLS ORCHESTRATION

APPLICABLE ONLY TO SETAPP VENDOR INTEGRATIONS

Vendor Extension

A. Processing operations:
a. All commands, command parameters, and vendor metadata manifests are transmitted over TLS to and stored on MacPaw’s servers (where they’re also processed by LLM).
b. Execution status codes and error messages from all vendor plugins are sent to MacPaw’s servers for Skills Orchestration purposes and troubleshooting.

B. Vendor app data transmitted to Eney:
a. String identifiers
b. Vendor app metadata

C. Data storage:
a. Any data we send to Vendor apps is processed and stored by those Vendors under their own control and subject to their privacy commitments.
b. Applications and files used in parameters and command outputs are stored locally in the macOS file system on the user device.
c. Logs data created when Eney performs a task are retained only for as long as needed to execute command outputs and stored only on the user’s device

Important:
Eney only transmits commands and parameters to the Vendor’s Extension, meaning that:

• All data processing and task execution happen entirely within the Vendor’s application.
• Command outputs are stored only on the user’s device.
• Vendors are responsible for how their applications process data and must comply with their own privacy practices and policies.