En6ia uses the following third-party AI providers to process the data you submit to our AI-powered features. Each subprocessor is bound by a written Data Processing Agreement (DPA) and listed here per Quebec Law 25 article 8 transparency requirements. We notify our customers at least 30 days before adding or changing any subprocessor on this page so they can object before the change takes effect.
Last updated: 2026-06-17
Only the personal information necessary for the specific AI feature is transmitted to subprocessors: for the receipt scanner, the binary content of the receipt image you upload (which may contain vendor name, merchant address, line-item descriptions, payment-card last-four, and your own name if printed on the receipt); for invoice and email drafting features, the natural-language text you ask the AI to work with (which may include client names, addresses, project descriptions, and email addresses). Account credentials, login passwords, encrypted API keys, payment-method details, and audit-log records are NEVER transmitted to any AI subprocessor.
Anthropic Claude, OpenAI GPT, and Google Gemini are used interchangeably (per tenant choice) for: optical character recognition (OCR) and structured extraction of receipt fields; semantic similarity matching for vendor and category suggestions; and natural-language generation for draft invoices and email replies. Self-hosted endpoints are used only by tenants who have configured their own approved private inference server, and only for the same three purposes. No subprocessor is used for profiling, advertising, training on your data, or any purpose outside the specific AI feature you triggered.
| Provider | Jurisdiction | Retention | Sub-processors | Training opt-out | PIA |
|---|---|---|---|---|---|
| Anthropic Claude | United States | 30 days | AWS US-East/West | Yes | |
| Google Gemini (paid) | United States | 55 days | Google Cloud US | Yes | |
| OpenAI | United States | 30 days | AWS US, Microsoft Azure US | Yes | |
| Self-hosted (custom) | Operator-controlled (varies by endpoint) | — | Operator-approved hostname (Together AI, Groq, Fireworks, OpenRouter, or other allowlisted endpoint) | Yes |
Under Quebec Law 25 article 27 you have the right to access, correct, or request a copy of the personal information En6ia holds about you, and under article 28.1 you may withdraw consent to AI processing and request erasure at any time. AI usage events are retained for 6 years 11 months for Revenu Québec tax-audit substantiation and are then purged by automated nightly process; revoked encryption keys are zero-overwritten after a 30-day grace period.
Iulian Enescu serves as En6ia's privacy officer responsible for protection of personal information. To exercise any privacy right or report a concern, contact iulian.enescu@icloud.com. We respond to access and erasure requests within the 30-day window required by Law 25.