Eney Privacy Notice
Introduction
To all our users of Setapp!
Thank you for your participation and welcome to the Eney AI Assistant (Beta).
We are committed to being clear, transparent, and respectful of your privacy and personal data protection rights. This Privacy Notice has been specifically developed for our new desktop application - Eney AI Assistant (“Eney”). This Notice will give you a clear understanding of Eney’s functionalities, the models we use, and how we process and protect your personal data.
Please note: this app is in Beta – it’s an early version still under development, so things may change and some features are experimental.
Eney Team has developed a special Handbook, where you can find a lot of valuable information about Eney, including Privacy & Security commitments and FAQs.
This Privacy Notice should be read in conjunction with Eney’s Terms of Service. Please make sure you are familiar with the Terms and understand how to use Eney, including the specific conditions that apply.
If you want to learn more about how we handle your personal data when you use Setapp, please visit Setapp Privacy Notice.
About us
MacPaw Way Ltd. (hereinafter “We”, “Us”, “Our” or “MacPaw”)
registration number 428214
registered address: 25 Serifou, Allure Center 11, Office No. 11-12, 2nd Floor, 3046 Zakaki, Limassol, Cyprus.
[email protected]
macpaw.com
You
User of Setapp
Developer (Vendor) if you are a party to the License Agreement with you.
If you do not agree with this Notice, please refrain from using Eney AI Assistant (Beta). If you change your mind in the future, you must stop using Eney; here you can exercise your right to be forgotten as set out in this Notice.
Beta Status & Human Review
Eney is an experimental (beta) service designed to help you by providing suggestions, performing your tasks and simplifying your interactions with different apps. Because Eney is still learning, it may sometimes be inaccurate, unreliable or limited in its responses. This means it might be sometimes unstable, produce inaccurate or unexpected results, or change as we update it. We may also change Large Language Models during development and testing.
We appreciate your understanding and welcome your feedback to help improve Eney.
Eney does not make any decisions with legal or significant effects on you – any answers or recommendations it gives are for guidance only, not final or binding decisions. Under data protection laws, you have the right to ask for a human review of any fully automated decision that significantly affects you. While Eney doesn’t make decisions of this nature, we want to uphold the spirit of this right. If you ever have concerns about an AI-generated output or need clarification, you can request human intervention (a manual review by our team). To do this, simply use the feedback form on our website to submit your concern or request, and a member of our team will review the assistant’s response and get back to you within 30 days upon your request. This way, you can always have peace of mind knowing that you can get human help and oversight whenever you feel it’s needed.
Definitions and your Data
To help you understand and navigate this Privacy Notice, here are short explanations of key terms we use:
Data Categories
- Account information - your email, username, or sign in with a Setapp token. In many cases, the beta is part of the Setapp platform, so your existing account details for the Setapp are also held by us. Those are covered by Setapp Privacy Notice, but relevant parts are summarized here for convenience.
- Vendor Extension Data - the data we collect when you as a vendor integrate your application through extensions (plug-ins). This data includes Vendor app metadata (such as app name and bundle identifier), commands, command parameters, command execution status, command output, and command execution logs. Please follow Vendor Extension attached below.
- Device Data – basic technical info about your computer, like its operating system version, installed apps, and system logs. This data is used to make Eney work better for you and helps us diagnose compatibility issues.
- Feedback and Bug Reports: If you choose to send us feedback (for example, by using feedback form on our website), we will collect whatever information you provide. This might include screenshots, error messages, or your comments about Eney’s performance. We use this solely to fix performance, human review and improve Eney.
- Task Execution Data – shows whether your request is handled locally on your device or remotely through our servers. To learn more about local storage, jump into section On-Device Processing below; to learn more about remote functionalities, jump into section Remote Processing below.
- User Input Data – the queries, commands, or text you type. We do not intentionally gather any personal data from User Input Data, unless you choose to include personal data in your query.
- User Interaction Data – information about how you use Eney (e.g., clicks, task requests, usage patterns).
- Output Data means the information Eney receives back after processing your request with remote LLMs (like OpenAI). This data helps Eney to give you useful responses and perform the actions you asked for. This data may, for example, contain output text (message), converted User Input Data, extracted files, autocompleted phrases, etc.
- Usage Logs and Metadata is a basic usage information that helps us monitor system performance and usage trends. These data may include timestamps of requests, the features you use, performance metrics (e.g. response time, success/failure flags).
Data Types
- app_version – the version of app you are using
- build_number – a technical number that shows which specific version of the app is running.
- event_time – the date and time when you use a feature.
- eney_uid – a random ID number we assign to identify your session (not linked to your name).
- file names – names of files on your device, only used when you request Eney to find or work with them. Please note that we do not collect file names, unless you specifically request Eney to do so and share your files for this operation.
- file paths – means the location of a file or folder on your device. We use it to help Eney perform file-related tasks only you ask for. Please note that file path is relative and does not expose your Mac user name or your full home folder name to our server.
- install_id – a unique ID given to Eney app installation to help us support and improve the service.
- query embedding means converting User Input Data into a numerical format that helps Eney understand what you are asking contextually. This allows Eney to compare your request with available actions or information and find the best match. To learn more, navigate section Remote processing by using fine-tuning LLMs services below.
- string identifiers are text labels, names, files, or codes used to identify commands, parameters, statuses, outputs, logs, or apps. They help Eney and vendor apps understand what action to take, what data to use, and how to track what happened. Note that it applies only to Vendor Extensions.
- task_id – a unique number for each task you ask Eney to perform. This data can not identify you.
- text input – the actual text (input) you enter when interacting with Eney. For example, your questions or commands.
- uti (Uniform Type Identifier) is a code that describes the type of a file or data on your Device. For example, it tells the system whether a file is a PDF document, image, text file, audio file, or some other type. It does not alone contain the file’s content, name, or personal information.
ML Models (Machine Learning Models) - are computer programs that learn patterns from large amounts of data to provide helpful answers, suggestions, or perform tasks. In Eney, ML Models are used to understand your requests and generate responses.
LLM (Large Language Model) - is a type of smart AI that can understand and generate human-like text. It has been trained on large amounts of publicly available information to help answer your questions, give suggestions, or assist with tasks. In Eney, we utilize trusted third-party LLMs to process your requests and provide helpful responses. Please note: LLMs are not trained on provided data. Data stays locally.
Skills Orchestration is the process of converting natural language into the command Eney is able to execute. We operate Skills Orchestration to execute actions provided by external vendors’ applications. You will find more about external vendors’ integrations in section Third-Party Apps’ Integrations and Service Providers.
AI Limitations
Eney can answer questions and help with tasks, but it has certain limitations:
- It may occasionally give incorrect or irrelevant answers. Always double-check important information in User Input Data and Files, based on your own understanding of what you consider important for you.
- It is not a professional advisor. Do not rely on it for medical, legal, financial, mental health, or other critical decisions. We do not intentionally process sensitive data. We kindly ask you to avoid sharing any sensitive (such as health details, political opinions, or similar) and personal information (to the extent you prefer not to share with us). when using Eney. We also encourage you not to share your confidential information, based on your own understanding of what you consider confidential. If you believe we have inadvertently processed your sensitive data or confidential data, please contact our Customer Support or submit a request using this form and we will promptly review and delete this data.
- We do our best to filter out offensive or inappropriate content, but Eney might inadvertently generate unsuitable responses. If you see any, please let us know by using this form. Use your own judgment when acting on the AI’s suggestions.
Data we process, purposes and legal grounds
Purpose | Data Category | Data Type | Legal Ground |
To offer you Eney app; Collection and pre-processing of User Interaction Data for internal analytics, understand user behavior, and improve Eney | Account information, user input data, user interaction data, feedback and bug reports, task execution data, device data | event_time, eney_uid, app_version, build_number, task_id, install_id, text input, file names, file paths |
|
To execute your tasks by local MLs | user input data | text input, file names, file paths |
|
Remote LLMs training | For remote LLMs all data is synthetically generated. Your personal data is not used. | ||
Tasks recommendation generation | Task execution data, user input data | file type, file paths, history of previously executed tasks |
|
Storage and feedback analysis for continuous learning and product improvement | Feedback and Bug Reports, log data | event_time, eney_uid, app_version, build_number, task_id, install_id, text input, file names, file paths |
|
Search assistance on your device by using local ML Models that helps to fasten search over your files and text input | Task execution data, Device Data | file path, file name, file size, uti, access date, modification date, creation date |
|
Contextual search by using local ML Models (Echo) | Usage Logs and Metadata, Device Data | text input |
|
Text completion and suggestions by using local ML Models to expand and summarize your text input | Task execution data, Device Data | text input |
|
Local LLM-based skill execution | user input data, attached files | text input |
|
Setapp Vendor extensions (see Vendor Extensions for more details) | Vendor Extension Data | string identifiers, file paths, error messages, execution status, execution logs, message text |
|
On-Device Processing
For contextual search and task execution, Eney utilizes local ML Models on your Device to understand the context of your User Input and Device, without sending your data to any external providers.
Eney will suggest relevant files, apps, or actions based on what’s already stored on your Device, like applications installed on your Device, your contacts and calendar events.
With your permission, Eney can also understand and work with what’s currently visible on your Device screen, like open apps or buttons. This feature only activates if you grant accessibility access on your device and allows Eney to detect certain visible elements and perform actions inside those apps (e.g., “Open Calendar and create a meeting”). For this functionality, we engage trusted third parties service providers described below. Please note: in any case, we ask for your permission to access your screen to perform this function.
Our goal is not to collect unnecessary data, but to responsibly improve Eney’s ability to serve you better. Since Eney is currently in beta, we are actively working to improve its performance before the official release. To support this, your User Input Data, User Interaction Data, Output Data, and Task Execution Data may be used to train and fine-tune our local ML Models. As part of this process:
|
Remote Processing by using fine-tuning LLMs services
For more complex inquiries, Eney may process your requests using external AI LLMs. This occurs only when necessary to fulfill your request.
To put it simply: if On-device processing operation is not successful, then it goes to remote processing.
How it works:
For example, if you ask “Summarize my uploaded document,” we send the document text but not who you are. The LLM service uses your User Input Data solely to generate the User Output Data and then returns it to us. |
LLMs Services we use
To provide Eney’s Remote Processing functionality, we integrate with third-party AI language model services.
Services we use: We currently use OpenAI’s GPT-4, LlaMA 3.2. and Google Gemini-2.0. These providers act as our data processors, meaning they are bound to handle the data on our behalf and not for their own purposes. We have agreements in place with each provider to ensure your data is kept confidential and secure. To learn more about it, refer to Data we disclose to service partners, purposes and data transfer mechanisms below.
Isolated LLaMA 3.2.:We use the LLaMA 3.2 model to process your User Input Data on our company-controlled servers. The model is locally integrated and operates in an isolated environment—your data is not sent to the original LLaMA model developers or any external third parties. We may use your User Input Data, text input and history data solely for internal analytics and to improve the functionality of Eney.
Please note: by default, LLMs do not train their models on your data. Some metadata may be logged temporarily to improve service quality and combat abuse, however it does not contain any personal identifiable information. |
In the table below, we provide you with information about LLMs, what data is processed and for what purposes.
Created by | Purpose | Input data | Output data |
OpenAI | Validate if user query contains any abusive, harmful, or other inappropriate content | User Input Data, text input | Usage Logs and Metadata |
OpenAI | Analyse user query to preprocess it for further steps. This includes defining query category, defining whether history of previous actions is necessary, rephrasing query | User Input Data, text input, history data | rephrased input, Usage Logs and Metadata |
OpenAI | To help Eney find the right actions for user input | Rephrased User Input Data | query embedding |
OpenAI | Select suitable actions for user input | User Input Data, file paths, history data and timezone | action, uti |
OpenAI | Generate textual messages for user | User Input Data, text input | Output text (message) |
OpenAI | Analyse output data from executed action | User Input Data, history data | Output text (message), Usage Logs and Metadata |
Third-Party Apps’ Integrations and Service Providers
Eney is a part of Setapp, which includes a variety of integrated applications. During the beta release, Eney may interact with third-party apps to perform specific tasks, enhance functionality, or connect with external apps. Please be aware that the use of the Third Party Apps is a subject of their own terms and conditions of use and privacy policies.
Name of Third Party App | Link to their privacy policies |
Downie | |
Permute | |
CleanMyMac | |
ClearVPN |
This list is not exhaustive. We may add, update, or remove third-party integrations as Eney evolves.
For contextual search and task execution, we engage trusted third-party service providers to help deliver specific features based on your requests. Please be aware that the use of the Third Party Service is a subject of their own terms and conditions of use and privacy policies.
Name of Third Party Service | Purpose/Task | Link to their privacy policies |
ApyHub | Files converter | |
Rapid | Photo editor | |
NewsAPI | To get news | |
AI Upscale by Gitbook | To work with image resolutions | |
DOCGuard | To check your URL for security | |
ExchangeRate-API | To get exchange rates | |
IPInfo | To get location for weather check | |
Brave Browser | Web search |
This list is not exhaustive. We may add, update, or remove third-party services as Eney evolves.
Data we disclose to service partners, purposes and data transfer mechanisms
Disclosure to others: Aside from LLMs services, we do not routinely share your personal data with others. The only other instances of sharing would be:
- Within MacPaw: Eney team and other departments within MacPaw may access data as needed to operate the service, preserving its stability and functionality and for internal analytics purposes. For example, when you share Account information for sign in with a Setapp token, or when you integrate with third-party apps available within the Setapp, like CleanMyMac or ClearVPN belonging to MacPaw.
- Service Providers: We use trusted service providers for cloud infrastructure (servers), analytics, error tracking, and for processing your Feedback and Bug Reports Data. All such providers are bound by confidentiality and data protection obligations via contracts.
- Legal Requirements: We may disclose or allow government and law enforcement officials access to your data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and services.
- Merger/Acquisition: If our company is ever involved in a merger, financing, reorganization, or sale, your data may be transferred as part of that deal (under appropriate confidentiality and legal safeguards). You would be notified of any change in data handling due to such an event.
- Communicating with You: We may send you essential service communications related to Eney. For instance, if we update this Privacy Notice or if there’s a significant change (like an important bugfix or the beta ending), we might email or notify you through the Eney app. We won’t send marketing emails unless you separately opted in to those via the main marketplace platform – and you can opt out anytime. We have external communication partners that provide us infrastructure and services for delivery of communications to you. To learn more, refer to Setapp Privacy Notice.
We do not sell your data to any third party. We also do not share it for marketing or advertising purposes (except when you solely use Setapp; to learn more, refer to Setapp Privacy Notice.
In the table below, we provide information about third-party LLMs we share your data with, the purposes of such sharing, and the transfer mechanisms we rely on to ensure secure data transmission.
Third Party | Purposes and Legal basis | Transfer mechanism and Contractual commitments | |||
OpenAI’s GPT-4 OpenAI Inc. 3180 18th Street Suite 100 San Francisco, CA 94110 United States | To provide Eney’s remote processing; to perform Terms of Service and for our legitimate interests (for internal analytics) | Data Processing Addendum following this link | |||
Google Gemini-2.0 Google LLC (USA) | To provide Eney’s remote processing; to perform Terms of Service and for our legitimate interests (for internal analytics) | Data Processing Agreement following this link | |||
Since Eney operates within the architecture of Setapp, most Setapp’s service providers are shared. To learn more about them, follow Setapp Privacy Notice. | |||||
Security
We are committed to protecting the privacy and security of your data. MacPaw has recently achieved ISO 27001 certification, demonstrating our dedication to maintaining a high standard of information security management. This internationally recognized standard sets requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
Here’s how we ensure the security and confidentiality of your data:
- Protection of Processing Environment: Our ML models are secured from unauthorized access or data leakage.
- Access Control: We carefully manage who has access to our systems and regularly review permissions.
- Application & Development Security: All code is reviewed and tested for vulnerabilities before release. We follow secure software development practices and use advanced tools to detect and fix security issues early.
- Threat Detection: We monitor our systems in real time for suspicious activity and respond quickly to potential threats.
- Network & Endpoint Protection: Our infrastructure is protected by firewalls, intrusion prevention systems, and secure device policies. All company devices are encrypted and centrally managed.
- Data Handling: We securely back up data, manage software components responsibly, and follow strict procedures for data deletion and leakage prevention.
- Authentication: We use a centralized identity system and enforce multi-factor authentication (MFA) to protect employees accounts who work with your data.
If, despite our safeguards, a data breach were to occur that poses a risk to your rights (for example, unintended exposure of personal data), we will notify you and regulators as required by law. We have an incident response plan in place for such situations.
As we continue to improve Eney ahead of its full public release, we’re continuing to work on implementation of strong privacy enhancing technologies. While we take strong measures to protect your data, please keep in mind that any information you enter — User Input Data, files, or commands—may be processed by our system and third-party LLMs services to deliver your request. We recommend avoiding the inclusion of sensitive or confidential information unless you consider it necessary. |
Data Retention and Deletion
We retain your personal data only as long as necessary for the purposes described in this notice (or as required by law). Since this is a beta service, we are likely to iterate quickly and we don’t plan to keep large historical archives of beta user data. In general:
- User Input Data and text input: The content of your AI conversations is securely stored on our servers. We will retain some prompts for improvement and training purposes, and will anonymize or delete upon your request or when we run out the purposes of collection.
- Remote Processing by LLM: (1) The content of your requests (inputs and outputs) is retained on OpenAI’s servers by default up to 30 days; (2) Google might store User Input Data and the Output Data for up to 30 days for debugging and quality purposes; (3) Meta’s LLaMA 3.2. is operated within our own server environment with no external retention by Meta.
- Usage Logs and Metadata: Basic metadata and logs are kept for a short period during the beta (e.g., to analyze usage patterns or troubleshoot issues). We aim to retain these logs for the minimum duration necessary – often just a few weeks or months of data.
- Account Information: If the AI assistant is tied to your account on Setapp platform, we retain your account data as long as your account is active. You can delete your account at any time, which will remove personal info like your name, email, etc. from our live systems (except information we are required to keep for legal reasons or legitimate business purposes, which we’ll isolate and protect).
- Feedback and Bug Reports: Feedback you send us (e.g., problem reports) may be retained until the end of the beta, as we may refer back to it while making improvements. We may also keep aggregated notes from feedback to carry lessons into the public release. Any personal identifiers in feedback (like your email or name if you included them) will be removed upon your request or when we run out the purposes of collection.
- Internal Analytics and Service Improvement: to improve the accuracy, safety and overall quality of Eney, we may retain your data for internal analytics and development purposes for up to 5 years. These efforts are essential and strictly necessary to enhance the AI’s capabilities before and after its official release following the beta phase. You may request us to delete your data.
Deletion: After the beta or upon your request, we will delete or anonymize personal data associated with the beta. If you leave the beta program, you can request that we erase data you provided, and we will do so (to the extent we control it and it’s not required to keep by law). Our policy is to anonymize or delete data that we no longer need for the purposes for which it was collected. To learn more about your privacy rights, refer to section Privacy Rights below.
Privacy Rights
You have rights over your personal data, and we’re committed to helping you exercise them. Here's what you can do:
- Access & Portability: You can ask for a copy of the personal data we hold about you. We'll send it in a commonly used, readable format.
- Correction: If something we hold about you is wrong—like your account details—you can request a correction. Some information can be updated directly in your Setapp profile settings.
- Deletion: You can ask us to delete your personal data, including Account Information, User Input Data, files and feedback. In some cases, we may keep limited data (e.g., to comply with legal obligations), but we’ll let you know if that’s the case. Once deleted, your data can’t be recovered.
- Restriction: You can request that we temporarily stop using your data—for example, if you’re verifying its accuracy. We’ll restrict access and only use it if absolutely necessary until the issue is resolved.
- Objection: If we use your data to improve the service or for other purposes you disagree with, you can ask us to stop. We'll honor your objection unless we have a valid reason not to, which we’ll explain.
- Request Human Review: if you have concerns about an AI-generated output that significantly affect your rights and freedoms, you can request human intervention. To learn more, refer to section Beta Status & Human Review above.
To make a request, please contact us using details in section Contact us below. We may ask for confirmation to protect your data from unauthorized access. We usually respond within 30 days.
If someone else contacts us on your behalf (like an authorized agent), we’ll need proof of their permission and identity before proceeding.
Changes to This Notice
Because this is a beta and things may evolve, we might update this Privacy Notice to reflect improvements in our practices or changes in the beta program. If we make significant changes, we will notify you (for example, via an in-app alert or email). The “Last Updated” date at the top will always indicate when the latest changes were made. We encourage you to check this notice periodically during the beta. Your continued use of the AI assistant after an update signifies your acceptance of the new terms.
Contact Us
We value your privacy and are here to address any questions or concerns you have. Сontact us at:
Email: [email protected],
[email protected] (dedicated Data Protection Specialist e-mail).
When contacting us about your data, please include the email or Setapp account you used with Eney so we can locate your records. We will verify your identity to protect your privacy.
SKILLS ORCHESTRATION
APPLICABLE ONLY TO SETAPP VENDOR INTEGRATIONS
Vendor Extension
A. Processing operations:
a. All commands, command parameters, and vendor metadata manifests are transmitted over TLS to and stored on MacPaw’s servers (where they’re also processed by LLM).
b. Execution status codes and error messages from all vendor plugins are sent to MacPaw’s servers for Skills Orchestration purposes and troubleshooting.
B. Vendor app data transmitted to Eney:
a. String identifiers
b. Vendor app metadata
C. Data storage:
a. Any data we send to Vendor apps are processed and stored by those Vendors under their own control and subject to their privacy commitments.
b. Applications and files used in parameters and command outputs are stored locally in macOS file system on the user device.
c. Logs data created when Eney performs a task is retained only for as long as needed to execute command outputs and stored only on user’s device
Important:
|