Terms of use and privacy notice

Enidia AI pilot programme — terms of use and privacy notice

Version 2026-10 · Effective October 2026

These terms apply to the pilot of the Enidia AI document search and extraction service (the "Service") provided by Enidia AI, S.à r.l.-S, a company registered in Luxembourg ("Enidia", "we", "us"). By ticking the acceptance box in the application you confirm that you have read them and accept them for yourself and, if you use the Service for a company, firm or other organisation, on behalf of that organisation ("your organisation"). If you use the Service on your own behalf, for example as an independent professional, "your organisation" in these terms means you. Where your organisation has signed a separate pilot or data processing agreement with us, that agreement prevails over these terms.

Part 1 — Terms of use

1. Purpose of the pilot

The pilot lets you or your organisation evaluate the Service on your own documents for a limited period. The Service is pre-release software: features may change or be withdrawn, and it is not offered as a production service or with a guaranteed level of availability.

2. Documents you upload

You may upload documents, including documents that contain personal data, provided that:

you are entitled to upload them, which, if you act for an organisation, means that it has authorised you to;
you or your organisation have a lawful basis under the General Data Protection Regulation (GDPR) for having them processed by us for the pilot;
you upload only what the evaluation needs and, where practical, remove or pseudonymise personal data that is not relevant to it;
you do not upload special categories of personal data (Art. 9 GDPR, such as health, biometric or genetic data, or data revealing political opinions, religious beliefs or trade union membership), personal data relating to criminal convictions and offences (Art. 10 GDPR), national identification numbers, or payment card and bank credentials, unless we have agreed to this with your organisation in writing beforehand;
uploading does not breach professional secrecy, a duty of confidentiality, or anyone else's rights.

3. Confidentiality

We treat the documents you upload, and the results the Service produces from them, as confidential information of you or your organisation. Within Enidia, only personnel who need access to operate and support the pilot can reach them, and they are bound by confidentiality obligations. We do not disclose them to anyone other than the sub-processor named in Part 2, section 4, unless the law requires us to.

4. No training of AI models

We do not use your documents, their contents, the results produced from them, or their metadata to train, fine-tune or otherwise improve any artificial intelligence or machine learning model. Under the terms of the model service we use (Amazon Bedrock), its provider does not use them for that purpose either.

5. Results are not legal advice

Searches, extractions, summaries and drafts produced by the Service are generated by AI. They can be incomplete or wrong, are provided for information only, and do not constitute legal advice, legal opinions or professional recommendations. Verify them against the source documents, and have a qualified professional review them before relying on them.

6. Intellectual property

The Service, including its software, algorithms, design, text and logos, belongs to Enidia. You may not copy, reverse-engineer or reuse it without our written permission. Your documents remain the property of you, your organisation or their other owners; we receive only the rights needed to provide the pilot.

7. Acceptable use

Your account is personal; do not share your credentials. Do not attempt to circumvent the Service's security or usage limits, to access other users' data, or to use the Service for unlawful purposes.

8. Liability

The pilot is provided free of charge, "as is" and "as available". To the extent permitted by law, Enidia is not liable for indirect or consequential damage, such as loss of profit, business or data, arising from the use of the pilot. Nothing in these terms limits liability for wilful misconduct or gross negligence, any liability that cannot be limited under applicable law, or the rights of data subjects under the GDPR.

9. Uploads in breach of these terms

You, and your organisation if you act for one, are responsible for documents uploaded in breach of section 2 and, to the extent permitted by law, will indemnify Enidia against third-party claims, fines and reasonable costs, including legal fees, that result from such a breach.

10. Suspension and deletion of accounts

We may suspend an account that breaches these terms. An account whose user has not accepted the current version of these terms within one month of being asked will be deleted, together with its documents. At the end of the pilot, accounts and data are deleted as set out in Part 2, section 6.

11. Changes to these terms

We may update these terms. A new version is shown to you in the application, and you will be asked to accept it before you continue using the Service.

12. Governing law and jurisdiction

These terms are governed by Luxembourg law. The courts of Luxembourg City have exclusive jurisdiction over any dispute arising from them or from the use of the pilot. If you use the Service as a consumer, this does not deprive you of the protection of the mandatory rules of the country where you live, or of your right to bring proceedings in its courts.

Part 2 — Privacy notice

This notice is given in accordance with Articles 13 and 14 of the GDPR.

1. Who is responsible for your data

Account and usage data (section 2): Enidia is the data controller.
Personal data contained in uploaded documents and in what the Service derives from them (extractions, summaries, search indexes, chats and drafts): your organisation, or you if you use the Service on your own behalf, is the data controller, and Enidia processes that data on its behalf as a processor under Part 3. If your personal data appears in a document someone else uploaded, please address your request to the person or organisation that uploaded it; we will help them respond.

2. What we collect as controller

Account data: your email address, your role in the application and, if you sign in with Google, your Google account identifier.
The record of your acceptance of these terms: which version and when.
Usage and technical data: IP address, browser information, sign-in times, actions taken in the application, the processing cost of your requests, and error and security logs.
Messages you send us, for example support requests.

Documents you upload, and what the Service derives from them, are not on this list: we process them on behalf of you or your organisation, as described in section 1 and Part 3, and not for our own purposes.

3. Why we process it and on what legal basis

To provide the pilot and manage your account: performance of our contract with you (Art. 6(1)(b) GDPR) or, where the pilot is agreed with an organisation you act for, our legitimate interest in performing that agreement (Art. 6(1)(f)).
To keep the Service secure, prevent abuse, enforce usage limits and fix faults: our legitimate interest (Art. 6(1)(f)).
To keep a record of your acceptance of these terms: compliance with our legal obligations and our legitimate interest in demonstrating it (Art. 6(1)(c) and (f)).
To improve the product using aggregated usage statistics, never the contents of your documents: our legitimate interest (Art. 6(1)(f)).

We do not sell personal data, share it for marketing, or make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR).

4. Where your data is stored and who receives it

All data, including uploaded documents, is stored and processed in the European Union, in the Frankfurt (Germany) region of Amazon Web Services (AWS), our hosting provider and sub-processor. The AI models run on Amazon Bedrock in the same region, so documents are not sent outside the EU to be analysed. AWS is part of a group headquartered in the United States; its data processing terms include the European Commission's Standard Contractual Clauses for any access from outside the European Economic Area.

If you choose to sign in with Google, Google receives your sign-in request and processes it as an independent controller under its own privacy policy.

5. Security

Data is encrypted between your browser and the Service (HTTPS), on its way to the database and the AI models, and at rest, including database storage and backups. A document you upload is visible only to you, to the owners of checklists it is used with, and to authorised Enidia administrators, unless you choose to make it public, which makes it visible to every user of the Service. The application and its database run on a private network that is not reachable from the internet.

6. How long we keep it

Uploaded documents and the data derived from them: until they are deleted in the application or at your or your organisation's request, and at the latest 30 days after the end of the pilot, unless you or your organisation agree to continue using the Service.
Account data and the record of your acceptance of these terms: for as long as your account exists. Accounts are deleted at the end of the pilot, on request, or as set out in Part 1, section 10.
Technical and security logs: 30 days.
Backups: deleted data disappears from our automated backups within 30 days.

7. Your rights

Under the GDPR you have the right to:

access your personal data and receive a copy of it;
have inaccurate or incomplete data rectified;
have your data erased, under certain conditions;
restrict the processing of your data, under certain conditions;
object to processing based on our legitimate interest, under certain conditions;
receive your data in a portable format, under certain conditions.

We respond within one month of receiving your request. That period may be extended by two further months for complex or numerous requests, in which case we will tell you why.

8. Contact

To exercise your rights or ask a question about this notice, write to info@enidia.ai.

9. Supervisory authority

You may lodge a complaint with the National Commission for Data Protection (CNPD) in Luxembourg, cnpd.public.lu, or with the supervisory authority of the EU country where you live or work.

Part 3 — Data processing terms

This part forms the processing agreement required by Article 28 of the GDPR between Enidia (processor) and your organisation (controller), or you if you use the Service on your own behalf, for personal data contained in uploaded documents, unless a separate data processing agreement has been signed with us. In this part, "your organisation" includes you in that case.

Subject matter and duration: providing the pilot, for the duration of the pilot and until the data is deleted under Part 2, section 6.
Nature and purpose: storing documents, extracting their text and structure, indexing them for search, and running the AI-assisted search, extraction, review and drafting that you, or the users acting for your organisation, request.
Data and data subjects: whatever personal data you or your organisation choose to upload, typically names, contact details, signatures, roles, and contractual or financial details of parties, their representatives, employees, clients and counterparties.
Instructions: we process the data only on your organisation's documented instructions, which are given by your actions in the Service, by those of the other users acting for your organisation, and by these terms, unless EU or Member State law requires otherwise. We will tell your organisation if we believe an instruction infringes data protection law.
Confidentiality: everyone authorised to process the data is bound by confidentiality.
Security: we apply the measures described in Part 2, section 5, as required by Article 32 GDPR.
Sub-processors: your organisation authorises Amazon Web Services EMEA SARL (hosting and Amazon Bedrock, Frankfurt region). We bind any sub-processor to equivalent data protection obligations and will inform your organisation in advance of any change, giving it the opportunity to object.
Assistance: we help your organisation respond to data subjects' requests and meet its obligations on security, breach notification and data protection impact assessments (Articles 32 to 36 GDPR), taking into account the information available to us.
Personal data breaches: we notify your organisation without undue delay after becoming aware of a breach affecting its data, with the information it needs to meet its own obligations.
End of processing: at the end of the pilot we delete the data as set out in Part 2, section 6. On request made before the end of the pilot, we will return it to your organisation first.
Information and audits: we make available the information needed to demonstrate compliance with Article 28 GDPR and allow reasonable audits, on reasonable notice.

You or your organisation, as controller, remain responsible for having a lawful basis for the processing and for informing the data subjects concerned.