This document is published in English only, and the English text is the binding one. We do not translate it because a machine-translated contract can promise something we did not agree to. If any part of it is unclear, write to support@esan.ai and we will explain it in your language.

Privacy Policy

Last updated: October 27, 2026

This Privacy Policy explains how Unanue Guinea Capital S.L., which operates Esan ("Esan", "we", "us", "our"), collects, uses, shares and protects personal data when you use the Esan website at esan.ai and the Esan AI agent product (together, the "Service"). It also describes your rights under the EU General Data Protection Regulation ("GDPR") and the Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights ("LOPDGDD").

By using the Service you confirm that you have read and understood this Policy. If you do not agree, do not use the Service.

1. Who is the controller of your data

The data controller, as defined in Art. 4(7) GDPR, is:

• Legal name: Unanue Guinea Capital S.L.
• Form: Private limited company (sociedad limitada) under the laws of Spain
• Tax identification number (NIF): B05735113
• Registered office: Pagola Kalea 5, 20018 Donostia – San Sebastián, Gipuzkoa, Spain
• Contact (privacy): support@esan.ai

We have not appointed a Data Protection Officer because our processing activities do not meet the thresholds of Art. 37 GDPR. You can still raise any privacy concern via the contact email above; we will route it to the person responsible for privacy matters.

2. What data we collect

We process the following categories of personal data:

2.1 Account data

• Email address
• Display name (optional)
• Profile photo (optional): one you upload, or your Google account’s when you sign in with Google. Only you see it, and you can change or remove it in Settings → Account.
• Internal account identifier and, if you sign up with Google or GitHub, the OAuth provider identifiers
• Hashed password (never the plaintext)

2.2 Profile and Memory data

• The answers you give when you sign up: your name, date of birth, whether you use Esan on your own or with a team and, if you choose to answer, how you heard about Esan
• The name you set in Settings, which is also the name other people's assistants see when your assistant contacts them
• "Memories" you save explicitly — short rules you want the agent to remember across sessions (e.g. "I prefer Tailwind for CSS")

2.3 Conversation data

• Messages you send to the agent
• Files you upload
• Agent responses, including tool calls, search results, code execution outputs and generated artifacts
• Metadata: timestamps, session ids, model identifier, token counts

2.4 Connector data (third-party services)

When you connect a third-party service (Gmail, Google Drive, Google Calendar, GitHub, Slack, Notion, etc.) we receive and process data from that service as needed to fulfil your instructions:

• OAuth tokens issued by the provider (access token + refresh token), stored encrypted at rest
• Scopes you have granted
• Service-specific data retrieved only when an agent action requires it (e.g. an email's content when you ask to summarise it). This data is processed in memory and is NOT persisted on Esan's servers beyond the duration of the request

Esan Mail, your own mailbox in Esan, is not a connector: its messages are stored by Esan (see Section 2.8).

2.5 Technical data

• IP address, user agent, device type
• Pages viewed, features used, error reports
• Cookies strictly necessary for the Service (session, CSRF). We do not use advertising or cross-site tracking cookies.
• Only with your consent, during your account's first 7 days: recordings of how you use the app, with all text, typed input and images hidden (see section 10)

2.6 Billing data (when applicable)

If you subscribe to a paid plan, our payments processor (Stripe Payments Europe Ltd) collects your billing email and card details. We never see or store your card number — only the last four digits, brand and an opaque customer id.

2.7 Wallet and transaction data (optional feature)

If you enable the optional Wallet feature (see Terms Section 16), we additionally process:

• The @handle you adopt or that the platform auto-assigns to your account on first Wallet use. This is a public identifier visible to anyone with whom you share it; we use it to route payments by username instead of by bank-account number.
• Transaction records of sends and receives initiated through the Service: amounts, currencies, timestamps, counterparty handle, status of the underlying Stripe operation and Stripe-side reference identifiers.
• Card metadata returned to us by Stripe when you save a card: the last four digits, brand, expiry month and year, the country of the issuing bank and the funding label (credit, debit, prepaid). We use the issuing- bank country and brand to compute the exact Stripe processing fee to charge you (Terms Section 16.3). We do not receive, see or store the card number, full expiry token or CVV.
• Connect account state as reported to us by Stripe: whether your account is enabled to receive payments, your default settlement currency and the country of incorporation you declared during onboarding. We do not receive the identity-verification documents you upload to Stripe.

Stripe Payments Europe Ltd acts as an independent data controller for the payment- card, identity-verification and bank-account data you provide to it directly through the Stripe-hosted card capture form and the Stripe Connect Express onboarding flow (see Section 5). Esan shares with Stripe only the minimum necessary to initiate each operation: your account user-id, the recipient identifier and the parameters of the requested send or save.

2.8 Esan Mail (optional feature)

If Esan Mail is enabled for your account, you get your own email address at esan.email and a mailbox inside Esan (see Terms Section 17). We then process:

• Your address — random when the mailbox is created, then the one you choose — and the addresses you had before, which keep receiving your mail and are never given to anyone else.
• Your mailbox settings: the name your mail goes out under, your signature, whether images load without asking, and the addresses you block.
• Messages you receive: the sender's and recipients' names and addresses, subject, date, text, attachments, technical headers, and the results of the checks run on arrival (spam, viruses, and whether the sender's domain vouches for the message — SPF, DKIM and DMARC). We keep the original message as it arrived.
• Messages you send and your drafts, including drafts the agent prepares for you, their attachments and their delivery status (delivered, bounced, reported as spam).
• Addresses that must not receive mail: an address that bounced permanently, or whose owner reported mail from you as spam, is recorded so that nothing more is sent to it.

The mail you receive contains personal data of people who are not Esan users: whoever writes to you, and anyone named in the correspondence. For correspondence you receive and send for your business or profession, you are the controller of that data and Esan processes it on your behalf as a processor, under the data processing terms in Terms Section 17.6. For purely personal correspondence the same safeguards apply.

Confidentiality of your correspondence. We treat your mail as confidential communications. It is processed automatically only to receive, store and deliver it; to protect you and the Service (spam and virus scanning, sender authentication, blocking addresses that bounce or complain, preventing abuse); and when you ask the agent to work with it. Nobody at Esan reads your mail unless you ask us to (for support), it is necessary to investigate a specific security incident or abuse, or the law requires it. Your mail is not used to train AI models and is never used for advertising.

The agent and your mail. The agent searches and reads your mail, opens attachments and prepares drafts only when you ask it to, in a conversation with you. It cannot send mail: a message leaves only when you press Send. Your mailbox is never available to other users or to their agents.

Images in the messages you receive. Many messages show images kept on the sender's servers. When you open one, Esan fetches those images for you from its own servers: the sender's server sees a request from Esan, not your IP address, your device or your cookies. It can still learn that the message was opened, and when — as with any email program that shows images. In Spam, and when a message fails the sender checks described above, its images stay hidden until you choose to show them. Esan does not keep these images; your browser may keep a copy for up to seven days.

2.9 Requests to our sales team

When you write to us from the Contact sales page, with or without an Esan account, we process:

• What you type: your name, work email, company, team size and message.
• The language of the page, so we can answer in it.
• Technical data: a salted hash of your IP address (never the address itself) and your browser's user agent, used only to stop one source from flooding the form.

We use these details only to answer you and, if you want, to discuss a contract with you. Writing to us does not create an Esan account and does not add you to any marketing list. Your request is stored in our database and sent by email to our sales mailbox (sales@esan.ai), through the providers listed in Section 5.

2.10 Sign-ins in Esan's browser (optional feature)

If you turn on "Stay signed in while working" in Settings → Browser, Esan keeps your sign-ins to the sites you sign in to in its browser, so that later tasks start signed in. It never keeps your password. You can see and delete them in Settings → Browser, and while the setting is off Esan does not use them.

3. Why we process your data and on what legal basis

Each processing operation has a specific legal basis under Art. 6(1) GDPR:

4. Google API Services — Limited Use

Esan's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide and improve the user-facing Esan AI agent features that you have explicitly requested.
• We do not transfer Google user data to third parties for serving advertisements, including retargeting.
• We do not use Google user data for any purpose unrelated to providing or improving user-facing features.
• We do not allow humans to read your Google data unless (a) we have your specific consent, (b) it is necessary for security purposes (such as investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data (including derivatives) is aggregated and used for internal operations in accordance with applicable privacy and other laws.

5. Who we share data with

We share personal data only with the following recipients, each of whom acts as a processor on our behalf under a Data Processing Agreement compliant with Art. 28 GDPR:

For payment-card, identity-verification and bank-account data that you provide directly to Stripe through its hosted card capture form or Stripe Connect Express onboarding, Stripe acts as an independent data controller under its own privacy policy. Esan shares with Stripe only the minimum necessary to initiate each operation (see Section 2.7).

An up-to-date list of sub-processors is maintained at /legal/subprocessors. We notify you of material changes at least 14 days in advance so you can object before they take effect.

We do not sell personal data, and we do not share it with third parties for advertising purposes.

6. International transfers

Some recipients are located outside the European Economic Area. Where this is the case we rely on appropriate safeguards under Art. 46 GDPR, in particular the European Commission's Standard Contractual Clauses (Decision 2021/914). You can request a copy of the safeguards in place by writing to support@esan.ai.

7. How long we keep your data

• Account and Profile data: while your account exists. When you delete your account it is closed at once — you are signed out everywhere and nothing runs for it, its shared links and pages go offline and its Esan Mail address stops taking mail — and it is erased 30 days later. Until then you can restore it by signing in, or have it erased at once from the same screen.
• What we keep after erasing an account: as Spanish law requires (Article 32 LOPDGDD), a minimal record is kept blocked for three years — the account's identifier and email address, the dates it was created and deleted, the consents you gave and your deletion request. Blocked means set apart: nobody at Esan uses it for anything, and it is available only to courts, prosecutors and data protection authorities, for liabilities arising from the processing. After three years it is destroyed.
• Conversation data: until you delete it from the chat history, or until your account is erased. Backups containing it are retained for up to 30 days.
• OAuth tokens: until you disconnect the connector or delete your account; deleted immediately on disconnect from our primary database, with backup purge within 30 days.
• Sign-ins in Esan's browser: until you delete them in Settings → Browser, or your account is erased.
• Logs: technical logs for 365 days; security logs (sign-ins and changes to your account's security) for 2 years. When an account is erased, the technical logs we keep lose the link to it, the IP address and the browser; the security logs lose the link to it and are kept blocked until their 2 years are up.
• Billing records: 6 years (Spanish tax retention).
• Wallet and transaction records: for the life of your account and then for the period required by tax and accounting law (typically 6 years in Spain).
• Esan Mail: messages, their originals and attachments until you delete them or your account; mail in Spam is deleted automatically after 30 days; drafts until you send or discard them. The copy our email provider writes when a message arrives is deleted within 7 days. Delivery events (delivered, bounced, spam reports) are kept for 365 days, and an address that must not receive mail for as long as needed to honour that. Backups up to 30 days. When your account is deleted your address is retired and never given to anyone else.
• Requests to our sales team: 2 years from the day you send one, then deleted, together with our email correspondence about it. If it leads to a contract, the records of that contract are kept for as long as the law requires.
• Data exports: the zip you ask for in Settings → Data controls is kept for 7 days so you can download it, then deleted.
• Backups: database backups are kept for 7 days and file backups for 30, so what is erased from Esan leaves the backups within about a month. If a backup is ever restored, the accounts deleted after it was taken are erased again.

8. Your rights

Under GDPR you have the following rights:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your data ("right to be forgotten").
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)) at any time for processing based on consent.
• Not be subject to a decision based solely on automated processing (Art. 22), including profiling, which produces legal effects concerning you. Esan does not take such decisions.

To exercise any of these rights, write to support@esan.ai. We will respond within one month (extendable by two further months for complex requests, Art. 12(3) GDPR).

You also have the right to lodge a complaint with the Spanish supervisory authority (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid) or your local supervisory authority within the EU.

9. Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

• Encryption in transit (TLS 1.2+) for all communications
• Encryption at rest for OAuth tokens and credentials (AES-256)
• Row-level security on the database, isolating each user's data
• Audit logging of access to personal data
• Least-privilege access controls; access to production systems limited to named individuals on a need-to-know basis
• Regular security reviews and dependency updates
• Sub-processors are required to maintain SOC 2 Type II, ISO 27001, or equivalent certifications

No system is impenetrable. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and, where the risk is high, notify you without undue delay (Arts. 33–34 GDPR).

10. Cookies

Without your consent we use only strictly necessary cookies: session token, CSRF token and theme preference. These are exempt from consent under Art. 22 of the Spanish LSSI-CE because they are technically required for the Service to function. We do not use advertising cookies or third-party advertising trackers.

Session recordings (optional). Only if you accept "Analytics" in the cookie banner, and only during the first 7 days after you create your account, we record how you use the app (where you click, scroll and navigate) to find where it gets in your way. All text, everything you type and every image are hidden in your browser before anything is sent, so a recording never contains your messages, your files or Esan's answers, and addresses are stored without their query strings. Recordings are processed by Sentry (EU, Germany), which keeps them for 30 days. You can withdraw consent at any time in Cookie preferences, and recording stops at once.

11. Minors

The Service is only for people aged 18 or over, and it is not directed to anyone younger. We ask for your date of birth when you create your account and do not let anyone under 18 continue. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

12. AI-generated content and accuracy

Esan uses large language models that generate outputs probabilistically. Outputs may be inaccurate, incomplete or out of date. You should not rely on Esan outputs for medical, legal, financial or other professional decisions without independent verification. We provide a transparency notice consistent with Art. 50 of the EU AI Act: when you interact with Esan you are interacting with an AI system.

When the agent drafts an email for you, the draft is yours to review, change and send, and you are its sender. Mail the agent drafted carries a machine-readable indicator (an X-Esan-AI header), and the AI models we use may add their own invisible marks to the text they generate, so that AI-generated content can be detected as Art. 50(2) of the EU AI Act requires.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via email and a banner on the Service at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent version. Past versions are archived and available on request.

14. Contact

Questions, requests or complaints about this Policy:
Email: support@esan.ai
Postal: Unanue Guinea Capital S.L. (Esan), Pagola Kalea 5, 20018 Donostia – San Sebastián, Gipuzkoa, Spain