Privacy notice

Kawl Now provides the optional AI voice widget on this website. The widget loads from app.kawlnow.com, which receives the browser request information needed to serve it. If you start a conversation, your question and the AI answer are processed to provide the service and saved in a transcript that our team can review. Microphone access requires your browser permission; you can end the conversation at any time. Please keep passwords, payment details, customer records and sensitive personal information out of the conversation. Contact us through this website for questions about a transcript or a privacy request.

This draft covers tokenobserve.com and describes the distinct data flows of the Token Observe cloud pilot and optional customer-hosted software. Tenhaw LTD operates the marketing website and the hosted workspace service. Their records are different and must be assessed separately.

The cloud pilot stores account and workspace records, provider-cost evidence, encrypted connection credentials and configured activity evidence on Token Observe infrastructure. The statement that a customer-hosted runtime sends the software vendor no telemetry does not describe cloud hosting.

An optional customer-hosted installation keeps its runtime data on infrastructure its operator controls. Support access or information voluntarily sent to Tenhaw creates an additional data flow. Legal roles and agreements for each arrangement remain subject to counsel review.

Tenhaw LTD is registered in England and Wales, company number 12735685, incorporated on 10 July 2020 and based in London. The Companies House record is linked below.

Privacy questions and requests about website or cloud records go to hello@tenhaw.com. Vulnerability reports go to security@tenhaw.com. Whether a data protection officer or registration with the Information Commissioner’s Office is required remains an open legal-review item.

The AI spend estimator processes amounts, labels and checklist choices in the current browser tab. Those inputs are not sent to Token Observe, included in analytics event properties or saved in browser storage. An explicit export creates a CSV containing the inputs you chose to download.

Plausible page analytics and named events run only if you accept analytics. Events carry a page and a short label; the assisted-form submission event also carries the company-size band. They do not include the email, name, company or role you entered. The Cloud Trial Handoff event records a click to the hosted portal, not a completed account or workspace signup. Marketing analytics stops at that cross-origin handoff. Plausible uses no persistent browser identifier or analytics cookie.

Hosting providers may record ordinary request information, including IP address, timestamp, path and user agent. The assisted form separately collects your work email and optional name, company, role and company-size band. There is no free-text field on that form.

The homepage includes a Cal.com discovery calendar. Its script and embedded scheduler load as you approach the booking section, independently of your analytics choice. Cal.com receives the technical request information needed to load it. If you book, Cal.com and James Rooney receive your name, email address, selected meeting time and any answers you submit in the booking form. Booking fields are not forwarded to this website’s Plausible events.

The current /start journey hands you to the cloud portal. This marketing site no longer requests email codes, verifies evaluation accounts or provides an evaluation ZIP. Records created by the previous Supabase Auth and download-entitlement flow may remain; retiring that flow does not delete those records.

The on-page assistant sends your question to this site’s server and then to Anthropic, as described in clause 8. Neither the assisted form nor entering the cloud journey subscribes you to marketing email.

This website stores your optional analytics decision in localStorage under tokenobserve_consent, with the categories, notice version and date. It carries no visitor identifier and is not sent to the server. Assisted-form drafts and calculator inputs are not written to localStorage or sessionStorage. Calculator state is lost when the page closes; an exported CSV remains wherever you choose to save it.

The retired evaluation-download flow used an essential Secure, HttpOnly, SameSite=Lax cookie named __Host-to_evaluation, expiring within one hour or sooner with its authentication token. The current journey creates no new cookie for that flow. An older cookie can be removed by clearing this site’s cookies; its presence does not authorize a ZIP download.

The cloud portal is a separate origin and uses essential authentication and CSRF cookies. Its session cookie is Secure and HttpOnly on HTTPS, and browser mutations require an origin and session-bound CSRF check. Ending website analytics does not sign you out of the cloud service.

The embedded scheduler is provided by Cal.com. Its own privacy notice describes its cookies for authentication, preferences and security. This website’s analytics setting governs Plausible and Google Analytics; it does not switch off the functional booking calendar. You can use the published email address instead of submitting a booking form. The consent-notice version is 5 so returning visitors are asked about Google Analytics.

The footer’s Cookie settings control changes optional website analytics. Declining analytics does not prevent following the cloud journey, submitting the assisted form or discovery scheduling.

Using the calculator or downloading a worksheet does not require analytics consent. Calculations run locally, and export is an action you choose. The calculator sends no form contents to analytics.

Plausible and Google Analytics 4 load only after analytics consent. Google Analytics, provided by Google LLC, uses first-party analytics cookies to measure page visits and website interactions. Google receives technical request information and filtered public page URLs; form contents, contact details and calculator inputs are not sent as event properties. Google Analytics advertising features remain disabled. Google Ads requires a separate advertising choice, described on this privacy page. Declining prevents both trackers from loading; withdrawing consent stops future collection and removes this site’s Google Analytics cookies.

Authentication, workspace provisioning, billing collection and evidence storage are essential operations of the cloud service you request. The website’s analytics choice does not control those operations. The legal bases for cloud processing, abuse prevention, enquiries and contractual records remain part of this draft pending counsel review.

There is no Google Tag Manager container, heatmap or session replay. Google Ads remarketing stays off unless you separately allow advertising. Google Analytics uses Google’s analytics tag only after you accept analytics. Fonts and product media are served from this website. The homepage’s Cal.com discovery calendar loads as you approach its section.

Following the cloud portal or another external link takes you to that service. The server-side services listed in clause 10 are additional to what a marketing page loads in your browser.

Email to a published address reaches our correspondence mailbox and is read by James Rooney or the person named on that address. We hold the address, any signature details and the message so that we can respond. The correspondence provider and its processing arrangements remain open items in this draft.

The assisted form asks for your own work email and optional name, company, role and company-size band. A submission is stored as one private record in Vercel Blob. The record contains no IP address, user agent or referring page. An in-memory rate limit reads the request IP to limit abuse; it does not add it to the submission record.

The configured notification path uses Resend to send an application-arrival notice containing the submission time, storage location and company-size band. It does not contain the submitted email, name, company or role. Notification delivery depends on the deployment’s notifier configuration and is not promised by saving the record.

Booking a discovery call submits your attendee details, chosen time and any booking answers to Cal.com so it can arrange the meeting with James Rooney and deliver booking correspondence. Scheduling is separate from cloud account creation: it does not create a product workspace or subscribe you to marketing. Do not put confidential or regulated personal data in booking answers.

Nothing is enriched with third-party contact data or added to a marketing list. Do not send provider credentials, passwords, confirmation links or authentication codes in correspondence, the assisted form or booking answers.

Questions are sent to this website’s server and then to Anthropic PBC to generate an answer. The API key remains on the server. Each message is capped at 1,000 characters and at most the last ten messages are sent.

This website does not persist the assistant conversation to a database, file or object store. Its endpoint keeps a short in-memory IP-based rate-limit record, discarded within a minute. This differs from the assisted-form record and the cloud workspace evidence described elsewhere.

Anthropic’s own terms govern its processing. Do not put confidential or personal information in the public assistant; it is a reading aid, and support correspondence uses the published email address.

The calculator requires no submission to Tenhaw. You control whether its in-tab data is exported to a local file, and you are responsible for handling that file. This technical description does not settle any legal basis for other website or cloud processing.

The website uses consent for optional analytics. The proposed bases for responding to an enquiry or arranging a discovery call are legitimate interests or taking steps at your request before a contract, depending on the enquiry. Those proposals and the cloud service’s processing roles and bases require counsel review.

Creating a cloud account or workspace is separate from optional analytics consent. No settled data processing agreement, transfer assessment or cloud commercial terms are asserted by this notice.

Vercel hosts the marketing website and its private assisted-form Blob records. Plausible and Google LLC provide consent-gated website analytics. Google processing may occur outside the UK and EU; supplier transfer arrangements remain part of the draft review. Anthropic receives public assistant questions. Resend is used by the configured assisted-form notification path and transactional authentication email arrangements. Cal.com Inc. provides the homepage discovery calendar and processes attendee and meeting details for bookings. The correspondence mailbox provider remains to be named in this draft.

The cloud pilot runs on Railway and uses Supabase Auth for account passwords and email verification. Railway’s persistent cloud storage holds the directory database, encrypted connection credentials and workspace databases. The cloud portal sends signup and confirmation requests to the fixed configured Supabase project; no service-role key or provider secret is delivered to the browser.

The old marketing evaluation flow used Supabase Auth, a Supabase-hosted entitlement/rate-limit database and a private installer archive in Vercel Blob. Those historical records and artifacts are distinct from cloud workspace evidence; no current route offers the archive for download.

These are technical service disclosures, not an approved subprocessor list or a statement that supplier contracts and transfer terms have been agreed.

The product deployment handoff records the cloud pilot’s Railway replica and persistent volume in Amsterdam. The assisted-form Blob store was created in Vercel’s London region on 18 September 2026. A request served through a London network edge does not establish the location of the cloud database.

These observations do not establish that all processing, backups, email or supplier access stays in one country. Supabase Auth location, supplier access, transfer arrangements and applicable contractual safeguards, including the Cal.com scheduling arrangements, require deployment and legal review. No UK-only or EU-only residency guarantee is made.

Optional customer-hosted runtime records stay on the infrastructure chosen by that operator, with outbound calls to configured providers and integrations. Any support data sent to Tenhaw needs its own assessment.

The hosted evaluation lasts 30 days from workspace creation. Expiry stops new model traffic, mutations and automatic billing collection; it does not automatically erase the Auth account, workspace or retained evidence. Authorized reads and exports remain subject to the shared monthly traffic quota.

Cloud activity retention is configured to 30 days. That trace window is not a deletion promise for every table or backup: approvals, audit records, billing evidence and other non-trace records have different scopes. Account, workspace, billing, backup and end-of-trial deletion schedules remain to be settled and operated.

Website correspondence and assisted-form retention periods also remain unsettled. Earlier drafts proposed periods; this notice does not claim they are implemented. Historical evaluation-access records are not automatically deleted because that flow has been retired.

Cal.com holds the scheduling records needed to operate the discovery calendar. The retention schedule for booking records remains an open item in this draft; no automatic deletion period is claimed. Ask hello@tenhaw.com about access or erasure of a discovery-call booking.

Your website analytics choice remains on your device until you clear it or a changed notice requires a new choice. Assistant conversations are not persisted by this website.

Token Observe receives cloud account and workspace information, provider credentials you explicitly connect, provider-reported billing evidence and activity routed through the workspace. Billing and inference credentials are separate. The cloud registry encrypts saved connection secrets; billing credentials are not injected into workspace gateway processes.

Billing sources report supported organization or team costs, not historical prompts or replies. OpenAI and Anthropic organization reporting excludes consumer subscriptions and other stated products; xAI reports team API costs; Google reads a configured Cloud Billing BigQuery export. Permissions and coverage vary. Google queries can incur charges on your account.

Each workspace has its own process, evidence database and application secrets on a shared managed host. These processes share the same OS user. This is application separation, not a tenant container or VM security boundary. Independent security review and stronger isolation remain open qualification items.

Customer-hosted software is optional. Its runtime uses operator-configured provider credentials and stores evidence on infrastructure that operator controls. That mode has no product telemetry or licence callback to Tenhaw. It must not be used as a description of the hosted cloud service.

The operator is responsible for its own installation, access policy, storage, backup and configured integrations. Support bundles, trace excerpts or access granted to Tenhaw create an additional flow; redact before sending and settle the applicable handling arrangements.

The source-available licence and support documents remain templates pending legal review. Permissions to test software on infrastructure you control are not permissions to attack the marketing website or shared cloud service.

Conversation capture defaults to metadata. Prompt and reply text is retained only after opting into redacted capture. Text is mask-redacted before truncation and bounded; hidden chain of thought is unavailable. Tool arguments/results, policy decisions, usage and response metadata may still appear in trace evidence without prompt/reply capture.

Approval action summaries use the tool or model name and the policy’s own reason, mask-redacted and capped at 240 characters. Policy reasons can still contain personal information. Seats, identity attributes and radar findings may contain employee identifiers and hostnames where those records are supplied.

Trace retention and subject erasure reach traces, trace events, the search index and trace scores on the live primary database. They do not erase the audit log, approvals, radar findings or every other table. Backups preserve their snapshot contents, and restoring a pre-erasure snapshot can restore deleted records. Cloud account or workspace deletion is a separate operational/legal-review item.

An optional customer-hosted runtime leaves trace retention unset by default, meaning keep forever until its operator sets a window. The cloud pilot’s configured 30-day activity window is a different setting.

Contact hello@tenhaw.com about access, correction, erasure or another request concerning website or cloud records. The applicable rights, verification process and handling responsibilities remain subject to legal review; this draft does not promise a bespoke operational response time.

For data held only in a customer-hosted installation, contact the organisation operating it. Tenhaw has no automatic copy or access to that runtime. If Tenhaw also received support material, identify that separate material in your request.

You can contact the Information Commissioner’s Office at ico.org.uk about a data protection concern.

This draft will change following counsel review and as the service changes. A website notice is not a substitute for agreed customer terms or an operated data-handling policy.

The site and cloud pilot are intended for business users. They do not request an age or market to children.

Open items include the correspondence provider; confirmed processing and backup locations; supplier access and transfer safeguards, including the applicable Cal.com scheduling contract and transfer arrangements; legal roles and bases; cloud evaluation and commercial terms; data processing and subprocessor arrangements; retention and deletion schedules for accounts, workspaces, billing, backups, enquiries, discovery bookings and historical evaluation records; and any registration or officer requirement.

The product’s current qualification also leaves positive live signup/email confirmation, authenticated customer workspaces, live provider connections and actual cloud backup/key recovery unqualified. Source tests and public health checks do not close those items.

No counsel-approved agreement, automatic deletion schedule, certified assurance or customer service level is invented to fill these gaps.

Privacy questions and data requests: hello@tenhaw.com. Vulnerability reports: security@tenhaw.com.

Tenhaw LTD, London, England. Registered in England and Wales, company number 12735685. Registered office: Tenhaw / Qube, 29-33 Scrutton Street, London, England, EC2A 4HU.