Security and data
How Tendo handles your data
Each workspace's data is kept separately and only its members can see it; New Odyssey staff access it only to fix a problem you ask about. Data is hosted with Render in the United States. To write a reply, the customer's message, the recent conversation and the most relevant passages go to Anthropic, which doesn't train on it, and Tendo logs each AI call's model, length and cost, never its text.
What Tendo holds
- Knowledge: pages read from the website addresses you give, uploaded files, pasted text, past replies and answers your team approved.
- Customer messages: emails forwarded to your inbox addresses and website chat messages, with the customer's name, email address and chat page when given.
- Replies, drafts, internal notes and what happened to each conversation.
- Your team's accounts and roles.
- Billing: plan and subscription status. Card details are held by Stripe.
How long it’s kept, and how to export or delete it
Conversations with no new message for the period you choose (3 months to 5 years, 1 year unless you change it) are deleted automatically, and removing a knowledge source deletes what was read from it at once. Owners and admins can export everything, delete every conversation with one customer, or delete the whole workspace in Settings.
The full detail is in Tendo’s data export and deletion policy.
Who processes it
Service providers (subprocessors), each on our instructions and only for the purpose shown:
- Render: hosting, databases and backups, in the United States.
- Stripe: subscription and license payments (card details go to Stripe, never to us).
- Resend: sending email.
- Anthropic: answering questions from your help docs.
Questions and security reports
Tendo is run by New Odyssey. To ask what we hold about you, to have it exported or deleted, or to report a security problem, email clio@new-odyssey.com. The privacy policy covers the rest.
Questions buyers ask
Where is Tendo's data kept, and for how long?
Tendo keeps each workspace's data separately, hosted with Render in the United States, and only workspace members can see it. Conversations with no new message for the period you choose, from 3 months to 5 years and 1 year by default, are deleted automatically. Owners can export everything, forget one customer or delete the workspace.