Privacy policy

1. Who we are

Enhex LLC ("Enhex", "we") runs the enhex.com website, the Enhex platform at enhex.com/app and the Enhex add-in for Microsoft Excel. This policy explains what personal and company data we hold, why, and the choices you have.

When your company uses Enhex, we handle its account and results on your company's behalf and under its instructions. For website enquiries and the free assessment, Enhex decides how the data is used.

2. What we collect

• Account details: Name, work email, company and role. Used for sign-in, access control and team administration.
• Usage records: Date, user, type of action, markets or Technology areas involved, and document counts. Used for billing, the team activity log and service limits.
• Confirmed Technology results: Items found with counts by department, costs, usage totals, dates, the approved plan and monthly totals. Stored only when a user confirms. Used for keeping the picture current, and showing deadlines, budget, renewals, commitments and vendor price changes.
• Website enquiries: Name, work email, company and role, and for the free Technology assessment the names of the spend areas found. Never figures, supplier names or files. Used for replying to a demo, trial or assessment request, and following up a headline summary download.
• Preferences: Each user's chosen markets. Used for personalising the dashboard.
• Benchmark setting: Whether the company takes part in anonymised benchmarks (off unless an administrator turns it on), when it was changed and by whom. Benchmark bands are worked out on request from confirmed Technology results and are not stored. Used for including the company's ratios in the anonymised pool, and showing it the bands.
• Company branding and templates (optional): A logo, two brand colours and blank document templates (Word, PowerPoint or Excel). Stored only when an administrator selects "Save for my whole company"; otherwise they stay in the user's browser. Used for producing documents in the company's own format and brand.

3. What we never collect or keep

• Uploaded data files of any kind: forecasts, ledgers, invoices, card statements, user lists, inventories, registers or cost exports.
• Documents Enhex produces, whether in the Enhex version or filled into your own templates: they are built in the browser and saved to the user's computer.
• Forecast volumes, budgets, prices paid or supplier names from coverage runs.
• The line-by-line detail behind a result, or where in a file each figure came from.
• Names or email addresses of people listed in your files, phone numbers, asset tags or serial numbers.
• Contracts or contract terms.
• Sign-in tokens, passwords or standing access to your Microsoft 365, Azure or other systems, or the data pulled through Connect: the pull goes straight into the user's browser.
• Benchmark results with a company named or counted: bands only, from at least five companies, never another company's figures.
• Questions asked in Ask Enhex AI, or its answers.
• Anything in a workbook where the Enhex Excel add-in is used: the add-in never reads the client's own sheets.

4. Your files stay on your computer

Forecasts, ledgers, invoices, inventories and other files you open in Enhex are read and processed in your web browser. They are not uploaded to Enhex. Documents Enhex produces are built in your browser and saved to your computer.

5. Cookies and browser storage

Enhex uses no advertising or analytics cookies and no third-party trackers. Your browser stores only what the service needs to work: your sign-in session and its 12-hour timer, and choices you make, such as the document version you prefer and where unrecognised suppliers belong. Clearing your browser's site data removes them.

6. AI features

• Ask Enhex AI: A question, the recent conversation and the relevant Enhex market and price data are sent to our AI provider to produce the answer. Enhex does not store questions or answers; the conversation is held in the browser tab until it is closed, a new topic is started or the user signs out.
• Supplier placement: Only when a user selects "Let Enhex AI place these", supplier names, line descriptions and the company's own account names are sent to our AI provider to identify the right spend area. Amounts and personal data are never sent.
• What is logged: Each AI request is recorded as a usage count with the market or Technology area involved, for billing and service limits. Content is not logged.

7. Who we share data with

We do not sell personal data and do not use it for advertising. We use these service providers to run Enhex, each only for the purpose shown:

• Lovable: Application hosting and AI gateway
• Supabase: Database and sign-in
• Anthropic: AI model for Ask Enhex AI and supplier placement
• Microsoft: Excel add-in platform (Office.js, loaded from Microsoft; receives no Enhex data)
• Microsoft: Connect sign-in (Microsoft Entra ID, to the client's own tenant; data goes straight to the user's browser, Enhex receives none)
• Your data is used only to provide the service to your company. The one exception is opt-in: if your administrators turn on anonymised benchmarks, ratios from your confirmed results join rounded bands that other taking-part companies see, never with your name or figures.

8. How long we keep data

• Data files: never received, so never retained.
• Confirmed Technology results: kept for the company until it deletes them or asks Enhex to; deleted on request.
• Account details and usage records: kept while the service runs, for access control and billing; account data is deleted when your service ends.
• Questions and answers in Ask Enhex AI: not stored by Enhex.
• Website enquiries: kept while we are in contact with you, and deleted on request.

9. Where data is held

Stored records are held by our database provider Supabase and our hosting provider Lovable, and may be processed outside your country. The hosting region is confirmed on request. All traffic is encrypted in transit (HTTPS) and stored records are encrypted at rest.

10. Your rights

You can ask to see, correct or delete the personal data we hold about you, or object to how we use it. Your company's administrators can update or deactivate your account at any time. For anything else, use the contact page and choose "Privacy request"; we reply without undue delay.

If you are not satisfied with our answer, you may contact the data protection authority where you live or work.

11. Children

Enhex is a business service for company users and is not meant for children.

12. Changes to this policy

When we change this policy we update this page and the date at the top.