Privacy Notice

Sentra is a workspace assistant that lets teams search, ask questions about, and act on their own documents and connected tools. This notice explains what personal data we process, why, and what rights you have.

The controller of the personal data described here is Sentra LLC.

Where a customer organisation uses Sentra to process data about its own staff or customers, that organisation is the controller and Sentra acts as a processor on its instructions, under a data processing agreement.

Data you give us directly:

• Account details — name, work email address, and the workspace you belong to.
• Content you create — messages you send to the assistant, documents, sheets, agents and workflows you author, and files you upload.
• Support correspondence, when you contact us.

Data we receive from services you choose to connect:

• When you connect an integration, we receive an access token and the content that integration exposes — for example files, calendar entries or messages. We request the narrowest scope that makes the feature work.
• We never receive your password for a connected service. Authorisation happens on that provider's own site.

Data collected automatically:

• Technical data needed to serve the application — IP address, browser and device type, and timestamps.
• Usage data, in our own server request logs — which endpoints were called, when, and whether they succeeded. We use no third-party analytics service and set no analytics or advertising cookie.

• To provide the service you asked for — answering questions, running agents and workflows, and syncing connected content. Legal basis: performance of a contract.
• To keep the service secure and prevent abuse — rate limiting, audit logs, and investigating incidents. Legal basis: legitimate interests.
• To fix defects and improve the product. Legal basis: legitimate interests.
• To meet legal obligations, such as responding to a lawful request. Legal basis: legal obligation.

We do not use your content to train any model, and we do not permit our model provider to train on it. When you ask the assistant something, the question and the material it needs to answer are sent to our model provider to produce that answer, and are not retained for training by us or by them.

Sentra generates answers and can take actions in connected tools when you ask it to. It does not make decisions producing legal or similarly significant effects about you without human involvement.

We keep personal data only as long as needed for the purposes above, then delete or anonymise it.

• Account and workspace data: kept for as long as the workspace exists, and for 30 days after it is closed.
• Content you create: kept until you ask us to remove it. Deleting a document today marks it deleted rather than erasing it, and does not remove its text from the search index. Erasing either takes a request to the address below, which we action by hand.
• Content from a connected tool: kept while the connection lasts. Disconnecting it, or removing Sentra from that tool’s own settings, erases the transcripts, summaries and text we pulled from it, along with the credential that reached it. That erase is immediate and automatic, and it is not the soft delete described above.
• Logs: 30 days.

We do not sell personal data. We share it only with service providers who process it on our behalf under contract, and where the law requires it.

The service providers who process personal data on our behalf are:

• Supabase — authentication, the database, file storage, and the emails the product sends you, such as sign-in links and password resets.
• Vercel — application hosting and the request logs that come with it.
• Anthropic — the model that generates the assistant's answers.
• Resend — delivery of workspace invitation emails. It receives the invited address, the workspace name and the name of the person inviting.

We use no separate analytics, error-tracking or advertising provider. We take no payments, so no payment processor holds your data.

Sentra is hosted in the United States, in Amazon Web Services’ Northern Virginia region (us-east-1). Your workspace’s content, the accounts in it and the records of what agents did are stored and processed there.

For personal data moving out of the UK or the EEA, we rely on the standard contractual clauses approved by the European Commission and the UK addendum to them, entered into with each of the processors named above.

Subject to local law, you can ask us to:

• give you a copy of the personal data we hold about you
• correct data that is wrong or incomplete
• delete data we no longer have a reason to keep
• restrict or object to a particular use
• provide your data in a portable format
• withdraw consent, where we relied on it — this does not affect processing before you withdrew

To exercise any of these, contact us at privacy@sentraai.app. You also have the right to complain to a supervisory authority — in the UK that is the Information Commissioner's Office.

Data is encrypted in transit and at rest. Access to production data is limited to staff who need it, and every table enforces row-level access control so one workspace cannot read another's. Integration credentials are stored encrypted and are never returned to a browser.

Sentra is a workplace product and is not directed at children. We do not knowingly collect personal data from anyone under 16.

We use cookies that are strictly necessary to sign you in and keep your session secure. There are two: the Supabase session cookie, whose name begins sb- and ends -auth-token, which holds your signed-in session; and workspace-home, which remembers which workspace to open so you do not land on a chooser every time. We set no advertising, tracking or analytics cookie, so there is nothing here to refuse without also signing yourself out. Blocking either in your browser will stop you staying signed in.

If we change this notice we will update the date at the top, and for significant changes we will tell you in the product or by email before they take effect.

Questions about this notice or about your data: privacy@sentraai.app.