Privacy notice
Your details, handled with care.
Last updated 4 November 2026
Who we are
Tenellus is a product of Hashtag AI Labs (hashtagai.io). This notice covers the website at www.tenellus.com and the Tenellus app at app.tenellus.com.
Two roles
- Website, accounts and billing. For people who visit this site, contact us or open an organisation, Hashtag AI Labs is the responsible party (controller) for that information.
- Your team’s data in the app. When an organisation uses Tenellus, the organisation decides what is recorded about its people: names, work emails, roles, review answers, ratings, actions, KPIs and attached files. The organisation is the responsible party for that data, and Hashtag AI Labs processes it on its behalf, only to provide the service. If you are an employee with questions about your reviews, please speak to your employer first.
What we collect
- Account details: your name, work email and the organisation you belong to.
- Sign-in details: one-time codes (stored only as a secure hash, valid for 15 minutes), passkey public keys, and the account identifier Google or Microsoft returns when you sign in with them. We never ask for or store a password.
- Organisation content: the review, action, KPI and file content your organisation adds.
- Billing: plan, seat count and subscription status. Card and bank details are handled by PayFast and never reach our servers.
- Contact form: your name, work email, company, team size and message.
- Analytics, only with your consent: pages viewed and approximate location, through Google Analytics. See the cookie policy.
Why we use it
To provide and secure the service, send the emails the service relies on (sign-in codes, invitations, review summaries and reminders), bill subscriptions, answer enquiries and, with consent, understand how the website is used. We do not sell personal information, and we do not use your team’s data to train AI models or for advertising.
Who we share it with
Only with the service providers we need to run Tenellus:
- Amazon Web Services: hosting, storage and email delivery.
- PayFast (South Africa): recurring payments.
- Google and Microsoft: only if you choose to sign in with them.
- Google Analytics: only if you accept analytics cookies on this website.
Where it is stored
On Amazon Web Services in the European Union (Ireland), encrypted at rest and in transit. Each organisation’s data is kept separate, and access inside an organisation follows the reporting line. Some providers above may process data in other countries under appropriate safeguards.
How long we keep it
Organisation content is kept while the organisation has an account. An owner can ask us to export or delete the organisation’s data at any time, and we delete it within 30 days of the account closing, apart from records we must keep for tax or legal reasons. Contact form enquiries are kept for up to two years.
Your rights
Under POPIA and the GDPR you can ask to see, correct or delete your personal information, or object to how it is used. For data held by your employer in the app, we will pass your request to them. Contact us through the contact form or through hashtagai.io. You may also complain to the Information Regulator (South Africa) or your local data protection authority.
Changes
We will update this notice when our practices change and show the date at the top.