ENYAL

Privacy Policy

Version 1.7 — Effective 10 October 2026 (supersedes Version 1.6, 10 October 2026)

Data Controller: Greenland AI Limited (Company No. 808784, Ireland)

1. Who We Are

ENYAL is a provable trust infrastructure service for autonomous AI agents, operated by Greenland AI Limited. We provide encrypted archival, zero-knowledge proofs, selective disclosure, and retrieval services through the ENYAL platform at enyal.ai.

Data Controller: Greenland AI Limited, Company No. 808784, Ireland.

Contact: info@enyal.ai

2. What Data We Collect

For the purposes of this policy, personal data includes account information (email address, company name), archival metadata, API usage logs, OAuth tokens, and session data. Encrypted archived content is treated as personal data where it can be linked to an identified individual. Whether ENYAL can decrypt your archived content depends on the archive trust model you chose (see Section 4.2). Your knowledge graph is separately encrypted; its decryption key exists only during your active sessions and is not held by ENYAL at rest (see Section 4.2).

2.1 Account Data

When you create an ENYAL account, we collect:

2.2 Key Management Data

When your account is created, we generate and store:

We do NOT store:

Agents you create. If you create an agent under your account, it receives its own ENYAL identity with its own encryption keys and wallet custody. For ENYAL-recoverable accounts, an agent's custody keys are derived from material ENYAL can re-derive, in the same way as your own recoverable archive. An authenticated session alone can create an agent with full custody: to limit what a hijacked or unattended session could do, creating an agent requires you to re-enter your password at the moment of creation. Deleting an agent revokes its tokens, sweeps its wallet balance to your wallet, and cryptographically erases its keys.

2.3 API Key Data

When you create API keys, we store:

API key hashes are kept for the duration of the account, including revoked keys (kept so we can detect a cancelled key being used); they are deleted when you close your account.

2.4 Archival Metadata

When data is archived through ENYAL, we collect and store metadata about each archived chunk:

For each archived record ENYAL also keeps a SHA-256 hash of its content, which it uses to prove the record has not changed. A hash can confirm a guess of what a record says.

We do NOT store the content of your archived data in readable form. Archived content is encrypted by ENYAL when you archive it, before it is stored or written to the ledger. Whether ENYAL can decrypt it depends on the archive trust model you choose at sign-up. There is no default: the sign-up forms on enyal.ai, joulepai.ai and greenlandai.ai, and the account-creation APIs, require you to choose. ENYAL-recoverable means your archive is encrypted to a key ENYAL holds, so ENYAL can decrypt it and can restore your access if you lose your recovery phrase. Zero-knowledge means your archive is encrypted to a key only you can reconstruct, and ENYAL cannot decrypt it; Section 4.2 explains what was archived before that encryption applied. Your knowledge graph is separately encrypted; its decryption key exists only during your active sessions and is not held by ENYAL at rest. See Section 4.2 for what this means under each model.

2.5 API Usage Data

When you use ENYAL services, we collect:

2.6 OAuth and Session Data

When you authenticate, we collect:

ENYAL serves as the identity provider for the Greenland AI ecosystem. Your ENYAL account may be used to authenticate with JoulePAI, GREENLANDAI, and RAREEAI. OAuth tokens issued for these products are stored in ENYAL's database.

ENYAL services may be accessed through the JoulePAI mobile application, which supports optional biometric authentication (Face ID, fingerprint). Biometric data is processed on-device by the operating system and is not received, transmitted, or stored by ENYAL. See the JoulePAI Privacy Policy for details.

2.7 Technical Data

We automatically collect:

To protect the starter allocation from abuse, when you verify your email we check the address against public lists of disposable email services and the domain's mail server, and we keep a scrambled (hashed) record of the network range and device used, for up to 90 days, to stop the same person claiming it many times. Signing up is not affected. An allocation held for review is released after a manual check.

2.8 Communications

If you contact us, we retain:

2.9 Proofs You Request

When you request a proof, ENYAL keeps it: the proof itself, which records it covers, and when it was made. You can fetch it again, see it on the verify page, and it is included in your account export. ENYAL does not charge twice for the same proof: if a proof of the same type over exactly the same records has already been made, ENYAL returns it without charge.

3. How We Use Your Data

3.1 Contract Performance (GDPR Article 6(1)(b))

3.2 Legitimate Interest (GDPR Article 6(1)(f))

3.3 Legal Obligation (GDPR Article 6(1)(c))

3.4 Consent (GDPR Article 6(1)(a))

Marketing communications are sent only with explicit opt-in consent. Users may unsubscribe at any time. ENYAL complies with the ePrivacy Directive (and UK PECR where applicable) for all electronic marketing communications.

4. Encrypted Data and the Permanent Cryptographic Ledger

4.1 What Is Archived

ENYAL commits encrypted data to a permanent immutable cryptographic ledger for the purpose of providing independently verifiable, timestamped records. This is a core function of the service.

4.2 Encryption

All archived content is encrypted before it is committed to the ledger. Your archive trust model, which you choose at sign-up (there is no default), determines whether ENYAL can decrypt your archived content:

Changing your model. You can change from ENYAL-recoverable to zero-knowledge in your account settings; you cannot change back. The change applies to what you archive from then on. When you change, ENYAL deletes its recovery share. Content you archived before 3 October 2026 stays encrypted to ENYAL's archive key and ENYAL can still decrypt it: the ledger is permanent, so it cannot be re-encrypted. Content archived on your own key since then can no longer be decrypted by ENYAL alone.

Content archived before 10 July 2026. Zero-knowledge encryption began on 10 July 2026. Content that a zero-knowledge account archived before that date was encrypted to ENYAL's archive key, and ENYAL can technically decrypt it. It cannot be re-encrypted.

Your current model is shown in your account settings.

Your knowledge graph. Your knowledge graph is separately encrypted. Your knowledge graph decryption key exists only during active sessions. At rest, knowledge data is encrypted. Encrypted at rest. We can't read your data at rest. During your active session, we decrypt only the minimum needed to serve your request and to build your knowledge graph from what you archive. When you log out, the key is gone: signing out deletes the key immediately, and suspending an account deletes it. If your session ends any other way, the key expires with your session — within 24 hours, or within 14 days if you chose "remember me". The key is created only when you sign in with your password; agent tokens never create one, so an agent acting under your account can use your knowledge graph only while your own session is active.

What this means under each model: for ENYAL-recoverable accounts, the key material is derived from the shares ENYAL holds by your choice, so ENYAL can derive your knowledge-graph key — only through our account recovery and password-reset paths — but does not hold it outside an active session. For zero-knowledge accounts, ENYAL holds insufficient shares and cannot derive it. We do not describe the knowledge graph itself as zero-knowledge: it is encrypted at rest and decrypted server-side during your session.

The ledger contains encrypted data only. Without the corresponding decryption keys, the archived content is computationally indistinguishable from random data.

4.3 What Is Visible on the Ledger

What is committed to the permanent ledger depends on the record. For content you archive, the encrypted content itself. For messages between agents and for ENYAL's own operational records, a cryptographic proof (a Merkle root covering many records), not the content. Every record also carries a version identifier for its encryption format and a transaction identifier and timestamp assigned by the ledger.

The ledger does NOT contain your email address, password, API keys, recovery phrase, company name, IP address, or any personally identifiable information in readable form.

4.4 Ledger Immutability

Records on the permanent cryptographic ledger are permanent and immutable. ENYAL cannot delete, modify, or recall data once it has been committed. This is a fundamental property of the service, not a limitation.

When you request erasure (GDPR Article 17), ENYAL destroys the key shares it holds for your account, deletes your account data, and removes your account identifier from your archived records and the proofs you requested, so the link between your identity and your archived records is destroyed. The encrypted content on the ledger cannot be deleted. What happens to its readability depends on how it was encrypted:

4.5 Archival Metadata

Archival metadata (chunk type, chunk key, agent identifier, timestamps, sanitised summary) is stored in ENYAL's database. It is not written to the ledger. This metadata is used for search, retrieval, billing, and service operation. The archival records (type, key, agent identifier, timestamps, hashes and ledger reference) are append-only and permanent by design and are NOT deleted. On erasure ENYAL removes your account identifier from them and deletes their search index (the sanitised summary, entity names and embedding vector), so they remain only as records no longer linked to you (see Section 8.3).

4.6 Terms Acceptance Records

When you accept our terms we record which version you accepted and when, and we write a tamper-evident record to the permanent cryptographic ledger. That record contains a salted hash of your acceptance together with a cryptographic hash of the full Terms of Service and Privacy Policy text as displayed to you at the time of acceptance. (A small number of pre-launch internal test records predate this mechanism and used a hash of a fixed summary of the terms rather than the full displayed text.)

4.7 Messages. When agents exchange messages through ENYAL, each message is stored encrypted, once to the sender's key and once to the recipient's key. Message records are append-only and are kept. On erasure ENYAL destroys your keys, so your copies can no longer be read; the other party keeps their copy, and the record of the exchange — when it was sent and between which agent identifiers — remains.

5. Who We Share Data With

5.1 Greenland AI Ecosystem

Each product has its own privacy policy. Data shared between products is limited to what is necessary for the service to function. As ENYAL serves as the identity provider for the ecosystem, suspension of your ENYAL account may affect your ability to authenticate with JoulePAI, GREENLANDAI, and RAREEAI. Your data and records on those products are not altered by an ENYAL suspension; however, an ENYAL security freeze may also place your linked JoulePAI wallet in a read-only state (balance queryable, transfers blocked), affecting funding and payouts on those products until the freeze is lifted.

5.2 Service Providers

ENYAL's primary infrastructure is hosted in the European Union (Helsinki, Finland) by Hetzner Online GmbH. For disaster recovery, encrypted database replicas and backups are also maintained on a host located in the United States (Hetzner, Ashburn, Virginia); this transfer is covered by the safeguards in Section 6.

Proofs are made in two places, both in the European Union. Standard and quantum-resistant proofs are made on a separate ENYAL proof server in Ireland; it receives only the hashes of the records a proof covers and the proofs it checks — never your keys, key shares or the content of your records. Your key fingerprint and content-integrity proofs are computed inside ENYAL on its servers in Helsinki, Finland.

Operational and security alerts to our team are delivered via Telegram (Telegram FZ-LLC). These alerts may include technical data such as source IP addresses, requested endpoints, and the reason for an account action. Telegram acts as a processor for these operational notifications.

5.3 Selective Disclosure Recipients

When you use ENYAL's selective disclosure feature, you choose to share specific archived data with specific recipients. The disclosed data is re-encrypted for the recipient. ENYAL facilitates the disclosure as instructed by you. Once data is disclosed to a third party, the recipient's handling of that data is governed by their own privacy practices, not ENYAL's.

5.4 Legal Requirements

We may disclose data if required to:

For archived content, the answer depends on how it was encrypted (Section 4.2). Content ENYAL can decrypt — an ENYAL-recoverable account's archive, and the zero-knowledge content described in Section 4.2 as remaining on ENYAL's archive key — could be compelled by a legally binding order to be produced in readable form. Zero-knowledge content encrypted to your own key cannot be produced in readable form, because ENYAL cannot decrypt it. Your knowledge graph is encrypted at rest. While you are signed in, its key is held on ENYAL's servers for the length of your session (Section 4.2), so under either model an order could reach your knowledge graph during a live session. Outside a session, ENYAL can derive that key only for ENYAL-recoverable accounts, through the recovery paths described in Section 4.2.

We may disclose data where required to comply with a legal obligation or court order, to protect the rights, property or safety of ENYAL, our users or the public, or to detect and prevent fraud. Where a legal request includes a non-disclosure order, we cannot notify you.

5.5 No Sale of Data

We do not sell, rent, or trade your personal data to third parties for marketing or any other purpose.

5.6 Sub-Processor Changes

We may update our sub-processors from time to time. The current list of sub-processors is available on request by contacting info@enyal.ai.

5.7 Data Residency

ENYAL's primary infrastructure is located in the European Union (Helsinki, Finland); encrypted disaster-recovery replicas are also maintained in the United States (Hetzner, Ashburn, Virginia) — see Section 6. Enterprise customers may request EU-only data residency as part of a separate Data Processing Agreement.

6. International Data Transfers

Your data is primarily stored and processed in the European Union (Helsinki, Finland). For disaster recovery, encrypted database replicas and backups are also maintained on a host located in the United States (Hetzner, Ashburn, Virginia).

Some data is also processed by service providers outside the EU (e.g. Stripe for payment processing). For such transfers, we rely on:

Encrypted data committed to the permanent cryptographic ledger may be distributed across multiple jurisdictions as part of the ledger's infrastructure. By using ENYAL, you acknowledge that encrypted archived data may be stored in any jurisdiction where the ledger infrastructure operates. This data is encrypted and unreadable without the decryption keys. Which keys can decrypt it depends on your archive trust model (Section 4.2).

For Users in the United Kingdom, UK GDPR applies alongside GDPR. The rights and protections described in this policy apply equivalently under UK GDPR. References to GDPR in this policy should be read as including UK GDPR where applicable. The United Kingdom has an adequacy decision from the European Union, meaning data flows between EU infrastructure and UK Users are permitted without additional safeguards.

7. Data Retention

Data Type Retention Period
Account data (email, company name) Duration of account; after you delete your account, deleted at the earlier of 30 days or one calendar month (so 28–29 days when the request falls in February), within about an hour of that deadline
Password hash Duration of account, deleted on account closure
Key management data (ENYAL's key share) Duration of account, securely destroyed on account closure. See Section 4.4 for what this does and does not make unreadable.
Poseidon key hash Duration of account, deleted on account closure
API key hashes Duration of the account, including revoked keys (kept so we can detect a cancelled key being used); deleted when you close your account
Archival records (type, key, agent identifier, timestamps, hashes, ledger reference) Retained (append-only, permanent); your account identifier removed on erasure — see Section 8.3
Search index (sanitised summary, entity names, embedding vectors) Duration of account; deleted on erasure
Proofs you request Retained with the records they prove; your account identifier removed on erasure
API usage logs Duration of account; deleted on erasure
OAuth session data Duration of session, deleted on logout or expiry
Credit purchase records 7 years (financial record-keeping under Irish law)
Support correspondence 24 months after resolution
Encrypted ledger data Permanent (immutable, see Section 4.4)
Terms acceptance records Permanent (archived to ledger, see Section 4)
IP address (technical data, security monitoring) Removed after 90 days (see 'IP addresses and backups', Section 7)

Some records are retained by design: the append-only archival records and on-chain references, and the proofs you requested, are not deleted. On erasure your account identifier is removed from them, so they remain only as records no longer linked to you.

IP addresses and backups. We remove IP addresses from our records 90 days after we record them; the rest of the record is kept. This does not apply to records that are permanent by design (Section 4). An address we block for abuse is kept for as long as the block is needed for security. Our backups are encrypted. They can hold copies of data, including IP addresses, until the backup is destroyed; database backups are destroyed after 12 months.

Where a record cannot be deleted from a backup, it stays there in encrypted form and is excluded from all processing until the backup is destroyed.

Encrypted data on the permanent cryptographic ledger cannot be deleted. What account closure does to its readability depends on how it was encrypted. See Section 4.4.

8. Your Rights

Under GDPR, you have the following rights:

8.1 Right of Access (Article 15) — You can request a copy of all personal data we hold about you. This includes account data, archival metadata, and API usage logs. It does not include your encrypted archived content by default: archived content is available to you at any time through the archive and disclosure APIs.

8.2 Right to Rectification (Article 16) — You can request correction of inaccurate or incomplete account data (e.g. email address, company name).

8.3 Right to Erasure (Article 17) — You can request deletion of your personal data. On erasure, ENYAL destroys the key shares it holds (cryptographic erasure — copies of content encrypted to your own key that remain in database replicas or backups cannot be decrypted without the destroyed shares; backups are destroyed after 12 months) and the salt that links your on-chain consent record to you, revokes your API keys and tokens, deletes your knowledge-graph data, your search index and your API usage logs, removes your account identifier from your archived records and the proofs you requested, and deletes your account record — so the linkage between your identity and your data is destroyed. A proof still waiting to be made is cancelled. Encrypted content on the permanent cryptographic ledger cannot be deleted; whether ENYAL can still decrypt it depends on how it was encrypted (Section 4.4). Archival records and the on-chain transaction references are append-only and are NOT deleted — after erasure they remain only as records no longer linked to your identity. Credit purchase records are retained for 7 years as required by Irish financial record-keeping law (GDPR Article 17(3)(c)) and are pseudonymised on erasure: your email address is replaced with an anonymised identifier so the records cannot be linked back to you.

If you delete your account on enyal.ai, the deletion cannot be undone. ENYAL at once deactivates the account, revokes your API keys, tokens and sessions, destroys its key shares — so your archive can no longer be decrypted from that moment — and deletes your knowledge graph and search index. Your remaining account data is deleted at the deadline in Section 7.

8.4 Right to Restriction (Article 18) — You can request that we limit how we process your data in certain circumstances.

8.5 Right to Data Portability (Article 20) — You can request your data in a structured, machine-readable format. Account data, metadata and the proofs you have requested are available in JSON format via the account-export API. For archived content, you can retrieve your own chunks through ENYAL's archive and disclosure APIs in JSON format with standardised keys before account closure.

8.6 Right to Object (Article 21) — You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.

8.7 Right to Withdraw Consent — Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of prior processing.

8.8 How to Exercise Your Rights

Submit requests to: info@enyal.ai

We will respond within 30 days. We may request identity verification before processing your request. For accounts using split key management, certain requests may require you to prove account ownership through your recovery phrase or API key.

8.9 Right to Complain

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Irish Data Protection Commission:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.

Website: www.dataprotection.ie

Email: info@dataprotection.ie

9. Cookies

9.1 Essential Cookies

We use strictly necessary cookies only. We do not use analytics, advertising, or third-party tracking cookies.

Name Purpose Duration Type
enyal_token Authentication — maintains your login session 24 hours (default) or 14 days (if 'Keep me logged in' is selected) Strictly necessary (httpOnly, Secure, with browser protections that limit its use from other websites)
cookie_consent Consent status — remembers that you have seen the cookie notice 1 year Strictly necessary

The enyal_token cookie is httpOnly and cannot be accessed by JavaScript. It is transmitted only over HTTPS and is restricted to the enyal.ai domain. The default session duration is 24 hours. Users who select 'Keep me logged in' at authentication extend the session to 14 days.

If we ever add non-essential cookies, we will update this policy and implement a full opt-in consent mechanism with granular category selection.

9.2 Analytics

We do not currently use third-party analytics cookies or tracking scripts. If this changes, we will update this policy and request your consent.

10. Security

We implement appropriate technical and organisational measures to protect your data, including:

No system is completely secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the Data Protection Commission within 72 hours as required by GDPR Article 33.

11. Children

ENYAL is not intended for individuals under the age of 18. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will delete it promptly.

12. Automated Decision-Making and Profiling

We use automated systems for:

These automated processes may restrict platform access or service availability. They are technical controls applied equally to all accounts based on objective criteria (request counts, payload sizes, account tier). They are not decisions about your creditworthiness, trustworthiness, or character.

ENYAL does not perform automated profiling that produces legal or similarly significant effects on Users. We do not infer personal characteristics, preferences, or behaviour patterns from your usage data for purposes beyond service operation and security.

You have the right to request human review of any automated decision that significantly affects you by contacting info@enyal.ai.

We also operate automated security systems that may block source IP addresses exhibiting attack or abuse patterns. A block may be permanent (for clear attack signatures) or temporary. IP-address blocks are network-level and are not account-level decisions about you; they are not individually notified. If you believe your IP address was blocked in error, contact us at info@enyal.ai.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via:

The Version and Effective date shown at the top of this policy indicate the current revision. Continued use of the platform after changes constitutes acceptance.

14. Contact

For any questions about this privacy policy or your personal data:

Email: info@enyal.ai

Data Protection Enquiries: info@enyal.ai

Data Controller: Greenland AI Limited, Company No. 808784, Ireland

© 2026 ENYAL · Greenland AI Limited 808784