Privacy notice

This Privacy Notice explains how Enplix (“Enplix,” “we,” “us,” or “our”) collects, uses, and shares personal information. Enplix is a company in the process of formation. Its founders operate it, and it is based in the United States. When Enplix is incorporated, that company will assume this notice and responsibility for the personal information it describes. We make Fetch, an audit and compliance platform for regulated industries.

This notice applies to:

• visitors to our website at enplix.com and its subdomains (the “Site”);
• prospective customers and business contacts who request a demo, contact us, or otherwise interact with us; and
• anyone else who communicates with us about Enplix or Fetch.

What this notice does not cover. When a business customer uses Fetch, it may upload audit evidence, documents, and information about its personnel into the platform (“Customer Data”). We process Customer Data on our customer’s behalf as a service provider or processor, under our agreement with that customer. That agreement, not this notice, governs Customer Data. If your information appears in a customer’s Fetch workspace, please contact that organization with privacy questions.

For purposes of the EU and UK General Data Protection Regulation (“GDPR”), Enplix is the controller of the personal information described in this notice.

We collect three kinds of personal information: what you give us, what we collect automatically, and what we receive from others.

We do not knowingly collect sensitive personal information, such as government ID numbers, health information, or precise geolocation, through the Site. Please do not submit it in our forms.

We use personal information only for the purposes below. The right-hand column gives our legal basis under the GDPR, which applies only to visitors in the European Economic Area (EEA), the UK, and Switzerland.

No sale and no targeted advertising. We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.

No automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

No AI training on your data. We do not use information you submit through the Site to train artificial intelligence models.

We use essential cookies to run the Site, and cookieless analytics to understand how it is used:

• Essential. These keep the Site secure and working: security and bot protection, and load balancing. Our hosting and security provider sets some of them. The Site cannot work properly without them.
• Analytics. We measure only how many visits the Site receives and which pages those visits view, and we look at the results in aggregate. We do not track individual visitors, build profiles, or follow you across sessions or across other websites. Our analytics do not store cookies or similar identifiers on your device, and they do not retain your IP address. Our analytics provider, PostHog, processes this data on our behalf and may not use it for its own purposes.

We do not use advertising or retargeting cookies, and we do not let third-party ad networks track you on our Site. If that changes, we will update this notice and ask for consent where required before using them.

Visitors in the EEA, UK, and Switzerland. Our analytics do not store information on your device or read information from it, so we do not use a cookie banner. Our legal basis for measuring Site usage is our legitimate interests. You can object at any time by emailing privacy@enplix.com.

Global Privacy Control. We honor the Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, GPC does not change how the Site works for you today. Our commitment to honor it continues if our practices change.

Do Not Track. Browsers do not apply “Do Not Track” signals consistently, and no industry standard governs how to respond to them. We therefore do not respond to them, but we do honor GPC as described above.

Managing cookies. Most browsers let you block or delete cookies. If you block essential cookies, parts of the Site may not work.

We share personal information only with the recipients below and only as described here.

• Service providers. Vendors process information on our behalf under contracts that limit their use of it to providing services to us. They include our hosting, content delivery, and security provider (Cloudflare), our analytics provider (PostHog), our email delivery provider (Resend), which delivers the messages you send through our demo and contact forms to us, and providers of email, customer relationship management, and business productivity tools.
• Channel and implementation partners. We work with consulting, advisory, and reseller partners who help organizations evaluate, buy, and implement Fetch. If you request a demo or contact us, we may share your contact and professional details, and the nature of your inquiry, with a partner who serves your organization or region. They use it to respond to your inquiry or support your evaluation. Partners act on Enplix’s behalf. They must protect your information, must use it only for these purposes, and may not use it for their own marketing or sales. To ask that we not share your information with partners, email privacy@enplix.com.
• Corporate transactions. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. It would remain subject to protections consistent with this notice.
• Legal and safety reasons. We may disclose information when we believe in good faith that the law, a court order, or a government request requires it, or that disclosure is needed to protect the rights, property, or safety of Enplix, our users, or others.
• With your direction or consent. We may share information when you ask us to or agree to it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Enplix is based in the United States, and we process personal information mainly in the U.S. Members of our team and some of our service providers work outside the U.S., including in the European Union (Czech Republic). They may access personal information from there to operate and support our business. Our providers may also process information in other countries where they operate.

When we transfer personal information from the EEA, the UK, or Switzerland to a country that has not been found to provide adequate protection, we rely on an appropriate safeguard. These include the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), or a recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. To get more information about these safeguards, contact privacy@enplix.com.

We keep personal information only as long as we need it for the purposes in this notice, then we delete or anonymize it.

• Prospect and lead information: while we have an active business relationship or conversation with you. We delete inactive leads after 24 months without engagement.
• Correspondence: for as long as needed to respond to you and keep our business records, and to meet legal obligations, resolve disputes, and enforce our agreements.
• Analytics data: for no longer than needed for the analytics purposes described in Section 4.

If you unsubscribe from marketing emails, we keep your email address on a suppression list so we can honor your choice.

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These include encryption in transit, access controls based on job role, and security monitoring. Our security program is designed around recognized frameworks such as SOC 2. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Marketing emails. You can unsubscribe at any time using the link in any marketing email, or by writing to privacy@enplix.com. We may still reply to inquiries you send us.

U.S. state privacy rights. Depending on your state of residence, you may have rights under laws such as the California Consumer Privacy Act (CCPA). These rights may include:

• Know and access: what personal information we have collected about you, the categories of sources, the purposes of use, and the categories of recipients, along with a copy of your information;
• Correct: inaccurate information;
• Delete: your personal information, subject to legal exceptions;
• Opt out: of the sale or sharing of personal information, targeted advertising, and certain profiling. We do not engage in these activities.
• Non-discrimination: we will not treat you differently for exercising your rights.

The categories of personal information we collected in the last 12 months are the ones listed in Section 2. In CCPA terms, they are identifiers, internet or network activity, approximate geolocation, and professional information. We disclose these categories for business purposes to the recipients in Section 5. We do not sell or share them.

Visitors in the EEA, UK, and Switzerland. Under the GDPR, you have the right to:

• access your personal information and receive a copy;
• correct inaccurate information;
• delete your information;
• restrict or object to our processing, including processing based on legitimate interests and processing for direct marketing;
• receive your information in a portable format; and
• withdraw consent at any time, without affecting processing that took place before withdrawal.

You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.

How to exercise your rights. Email privacy@enplix.com and tell us which right you want to exercise. We will verify your identity by matching information you give us against our records. This may include confirming control of your email address. You may use an authorized agent if you give that agent signed permission to act for you, and we may confirm the request with you directly. We will respond within the time the law requires, usually 30 to 45 days. If we deny your request, you may appeal by replying to our decision. We will respond to your appeal within the time the law requires.

The Site and Fetch are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact privacy@enplix.com and we will delete it.

The Site may link to websites and services we do not control, such as partner sites or social media. Their own privacy practices apply to those sites, and we encourage you to review them.

We may update this notice from time to time. When we do, we will change the effective date at the top of the notice. If the changes are material, we will give additional notice, for example by posting a notice on the Site.

If you have questions about this notice, or you want to exercise your rights, contact us at:

Enplix · Email: privacy@enplix.com