Last updated: October 2026
Privacy Policy
Key takeaways
- We collect what we need to run your office and our engagements, and to keep the Emanay Products secure.
- We do not sell your personal information or share it for targeted advertising.
- Each client’s data is kept separate; people see only what their role allows.
- When we process data for a client’s businesses, the client decides why, and we act on its instructions.
- AI helps us work; it is never the sole basis for a decision with legal or similarly significant effects on you.
- You can ask to access, correct or delete your information, and appeal if we say no.
1. What is the Privacy Policy and what does it cover?
This policy explains how the Emanay Group collects, uses, shares and protects personal information when you use the Emanay Products. It works alongside the confidentiality terms of each Engagement. Emanay Inc., 1221 Brickell Avenue, Suite 900, Miami, Florida 33131, is responsible for it, for itself and the Emanay Group. It does not cover Emanay Company Products that have their own privacy policies.
2. What information do we collect?
- Account information: name, email, phone, role, organisation, sign-in and authentication data.
- Client and engagement information: information about clients, their entities, family members, transactions, finances, bank and tax records, identity and know-your-client documents, immigration-related information supplied for an engagement, and documents uploaded to the OS.
- Activity information: what is done in the Emanay Products, by whom and when, including document views, edits, approvals, messages and whether an action was performed by a person or an AI Feature.
- Communications: messages, emails, direct messages, meeting notes and, only with all participants’ consent, call recordings and transcripts.
- Content you give our AI features: prompts, uploads and results (see Part 9).
- Device and technical information: IP address, browser, device type, operating system, log data and cookie data (see Part 3).
- Payment information: handled by our payment processors; we receive limited details such as payment status and the last digits of a card or account.
- Information from others: from clients about their representatives and family members, from referral partners and creators about people they introduce, and from integrations you connect.
- Sensitive personal information: government identification (passports, driver’s licences, Social Security or tax numbers), financial account and card numbers, account credentials, and immigration status information, collected only where needed for an Engagement, identity verification or legal compliance.
2.2 Information we process on behalf of clients. When we keep books, run systems or manage records for a client’s companies or family office, we process that information on the client’s behalf and under its instructions (see the Data Processing Addendum in Part 12). The client is responsible for having a lawful basis and giving any notices required for that information.
2.3 Sources of information. You; the client you work with or for; our team members and associates; referral partners, creators and partner pages; integrations and service providers (for example payment processors, banks connected by the client, e-signature and scheduling tools); public sources and registries (for example corporate registries); and identity-verification providers.
3. How do we use your information?
To provide and secure the Emanay Products; to perform Engagements; to prepare statements and invoices; to credit work and calculate compensation; to meet legal, regulatory, accounting, tax and know-your-client obligations; to detect and prevent fraud, misuse and scraping; to improve the Emanay Products, using de-identified or aggregated data where possible; and to communicate with you, including newsletters you can unsubscribe from at any time.
3b. How we use AI
How we use AI. We use AI Features to draft, summarise, classify and organise information, including Client Data, under the controls in Part 9. Model providers process data for us under contract and are not permitted to train their own models on it.
How you use AI. When you use AI Features, your Inputs and Outputs are handled under this policy and Part 9.
No automated decisions. AI is never the sole basis for a decision that has legal or similarly significant effects on you, such as accepting or declining an engagement, a know-your-client outcome or a compensation decision. A person reviews those decisions.
4. How is your information shared on Emanay Products or with integrated partners?
- Inside the OS, information is visible only to people whose role and Engagement allow it; each client’s data is kept separate.
- Clients can authorise their advisers, lenders, counterparties or other professionals to see specific information.
- Integrated partners (see Part 7) receive only the information needed for the approved purpose, under the Platform and Integration Terms.
- Content you post in shared channels (such as Emanay Insiders, Slack channels or comments) is visible to the other members of that channel.
5. How do we share information with third parties?
- Service providers acting for us (hosting, storage, email, payments, e-signature, accounting software, AI providers), under contracts that limit their use;
- authorities, courts or others when the law requires it, or to protect rights, safety and security;
- a buyer or successor of all or part of our business, under confidentiality.
We do not sell personal information and do not share it for cross-context behavioural advertising.
Disclosures in the last 12 months:
| Category of information | Recipients |
|---|---|
| Identifiers and contact details | Service providers; clients’ authorised advisers; integrated partners for the approved purpose |
| Financial and account information | Payment processors; banks and accounting tools connected by the client; auditors and tax preparers engaged by the client |
| Government IDs and immigration information | Identity-verification providers; authorities when required; professionals the client authorises |
| Activity and device data | Hosting, security and analytics providers |
| Communications and recordings | Hosting, storage and transcription providers |
| Inferences | Not disclosed |
6. How the Emanay companies work together
The companies of the Emanay Group share infrastructure, systems and personnel to provide the Emanay Products and to perform Engagements. Information is shared between them only as a person’s role and the relevant Engagement require, for example when an accounting team works on a client’s books for an advisory engagement.
7. How can you manage or delete your information and exercise your rights?
Depending on where you live, you may have the right to know, access, correct, delete or receive a copy of your personal information, to object to or limit certain uses, to withdraw consent, and not to be discriminated against for exercising these rights. You can unsubscribe from newsletters at any time using the link in each email. Some information must be kept even after a request, for example to meet legal or professional obligations. Make requests to legal@emanay.io; we will verify your identity before acting.
Authorised agents. You may use an authorised agent to make a request; we may ask for proof of authorisation and verify your identity directly.
Appeals. If we decline a request, you may appeal by replying to our decision; we will respond within the time the law requires.
Complaints. You may complain to a data protection authority: in the EEA, your local supervisory authority; in the UK, the Information Commissioner’s Office; in Canada, the Office of the Privacy Commissioner of Canada or your provincial commissioner.
8. How long do we keep your information?
As long as an account or Engagement is active, and afterwards for as long as needed for legal, tax, regulatory, professional record-keeping or dispute purposes. Activity logs are kept for at least 7 years.
9. How do we transfer information?
The Emanay Products are operated from the United States. If you use them from Canada or elsewhere, your information will be transferred to and processed in the United States, where laws may differ from those in your country. We use the transfer safeguards the law requires (see Part 7, section 10).
10. How do we respond to legal requests, comply with law and prevent harm?
We may access, keep and share information when we believe in good faith that the law requires it, or to detect, prevent and address fraud, misuse, scraping, security incidents and other harm, to protect clients, users and the Emanay Group, and to respond to legal process. Protection measures. We use role-based access, separation of each client’s data, encryption in transit, multi-factor authentication, logging and vendor controls. No system is perfectly secure; we will notify affected people and authorities of a data breach as the law requires (including Florida Statutes section 501.171).
11. How will you know the policy has changed?
We will post updates in the Emanay Products and, for material changes, notify you in advance.
12. Privacy notice for United States residents
Florida. We handle personal information in line with applicable Florida law, including the breach-notification rules in Florida Statutes section 501.171.
California. If the California Consumer Privacy Act as amended by the CPRA applies, California residents may request to know, access, correct and delete their personal information, opt out of sale or sharing (we do neither), limit use of sensitive personal information, and not be discriminated against for exercising these rights. Categories collected are those in section 2; purposes are in section 3; disclosures are in sections 4 to 6.
Other states. Residents of other states with comprehensive privacy laws may have similar rights and can exercise them as described in section 7.
Children. The Emanay Products are not for anyone under 18. We do not knowingly collect children’s personal information except where a client provides information about family members for an Engagement (for example estate or immigration planning), which we handle as Client Data.
12b. Privacy notice for Canadian residents
We handle personal information of Canadian residents consistently with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law, including Quebec’s Law 25 where it applies. You may access and correct your personal information and withdraw consent, subject to legal and contractual limits, by contacting us under section 13.
13. How to contact us
legal@emanay.io · Emanay Inc., 1221 Brickell Avenue, Suite 900, Miami, Florida 33131.
14. Why and how we process your information
Where the law requires a legal basis (for example under the GDPR or UK GDPR):
| Purpose | Legal basis |
|---|---|
| Provide the Emanay Products and perform Engagements | Performance of a contract |
| Statements, billing, tax and record-keeping; know-your-client checks | Legal obligation |
| Security, logging, fraud and scraping prevention | Legitimate interests |
| Improving the Emanay Products with de-identified or aggregated data | Legitimate interests |
| Crediting work and calculating compensation | Performance of a contract; legitimate interests |
| Call recording and transcription | Consent of all participants |
| Non-essential cookies and newsletters | Consent |