Privacy Policy

EntryDesk Privacy Policy

1. Introduction

GNTC Inc. (“GNTC,” “we,” “us,” or “our”) provides EntryDesk, an enterprise AI agent platform that connects to and automates workflows across third-party software-as-a-service systems used by our customers. This Privacy Policy (this “Policy”) explains the nature, purpose, use, and sharing of any in Personal Data in connection with the services of EntryDesk.

EntryDesk is a business product. It is purchased by an organization (the “Client”) for use by that organization’s personnel (the “Authorized Users”). This Policy describes how GNTC handles Personal Data in connection with EntryDesk for Authorized Users and for Clients evaluating or using EntryDesk.

2. Scope

This Privacy Policy applies to personal information we process in connection with:

• the EntryDesk web and mobile applications;
• EntryDesk APIs, software development kits, and command-line tools;
• integrations between EntryDesk and third-party systems authorized by a Client (for example, Google Workspace, Microsoft 365, Slack, Notion); and
• the GNTC marketing website and support channels in support of EntryDesk.

This Policy does not apply to:

• third-party products that a Client or Authorized User chooses to connect to EntryDesk; those products are governed by their own privacy terms;
• large language model providers and compute providers used by GNTC as sub-processors (their processing of Client Data is subject to contractual terms and, where applicable, our Data Processing Addendum); and
• GNTC’s other products unrelated to EntryDesk.

3. Definitions

To keep this Policy readable, we use consistent terms. Capitalized terms not defined below have the meanings given in the EntryDesk Terms of Service (the “Terms”).

“Authorized User” means an individual (typically an employee, contractor, or invited collaborator of the Client) who is granted access to a Workspace by the Client.

“Client” means the organization or individual that has entered into the Terms with GNTC and within whose Workspace Authorized Users operate.

“Client Data” means content that a Client or its Authorized User submits to EntryDesk, or that EntryDesk retrieves on the Client’s instruction from a third-party system connected by the Client. Examples: prompts, commands, query history, uploaded files, calendar entries, chat messages, AI outputs, and API responses ingested through authorized integrations. Client Data includes any Personal Data of third parties contained in such content.

“Service Data” means information we generate, collect, or infer through the operation of the Services that is not Client Data. Examples: Client and Authorized User account registration details, billing records, authentication metadata, usage and telemetry data, product analytics, security logs, support tickets, and cookie or device data.

“Personal Data” means information relating to an identified or identifiable natural person, as defined under applicable laws.

“Workspace” means a logically isolated tenant within EntryDesk that holds a single Client’s configuration, Authorized User list, and Client Data.

“Sub-processor” means a third party engaged by GNTC to process Client Data on GNTC’s behalf in furtherance of the Services (for example, cloud infrastructure and large language model providers).

4. Our Role: Controller or Processor

EntryDesk handles two very different kinds of information, and GNTC plays a different role for each. Understanding the distinction is the key to this Policy.

What this means in practice:

• For Client Data, the Client is the “controller”. The Client decides what data enters the Workspace, for what purpose, and for how long. GNTC processes that data under the Client’s instructions, under confidentiality and security obligations described in the Terms (and, where applicable, a separate Data Processing Addendum).
• For Service Data, GNTC is the controller and decides purposes and means. We describe those purposes in Section 6 below.

Where a data subject wishes to exercise rights over Client Data about themselves (for example, to correct a record), the request must be made to the Client — not GNTC — because the Client is the controller. See Section 11 below.

5. Information We Process

5.1 Client Data

EntryDesk processes whatever content a Client or Authorized User chooses to submit or have the AI agent retrieve. Depending on the Client’s configuration, Client Data may include:

• prompts, instructions, and commands issued to the AI agent;
• files, documents, spreadsheets, images, and other materials uploaded to a Workspace;
• content retrieved from connected third-party systems (for example, email bodies, calendar entries, chat messages, CRM records, issue-tracker tickets) pursuant to the Client’s authorization;
• AI outputs generated by the Services in response to the foregoing inputs; and
• contextual memory retained per project or task, as configured by the Client, to preserve continuity across AI agent sessions.

Client Data is determined entirely by the Client, and that it may include Personal Data of the Client’s employees, customers, partners, vendors, or other third parties. The Client is responsible for the legal basis for submitting such Personal Data into EntryDesk and for providing data subjects with sufficient information regarding such submission, including, without limitation, the relevant provisions set out in this Policy.

5.2 Service Data

In the ordinary course of operating EntryDesk, we collect the following categories of Service Data:

5.2.1 Account and Workspace Data

• Client organization details: company or organization name, billing address, Workspace identifier, plan and seat count.
• Authorized User profile data: name, business email address, password hash or federated identity identifier (for single sign-on), role and access scope, profile picture (if provided).
• Authentication artifacts: session tokens, multi-factor authentication enrollment, login timestamps and IP addresses.

5.2.2 Billing Data

• Payment method details handled by our payment processor (see Section 7.1); we do not store full payment card numbers on our systems.
• Billing contact name, email, VAT or tax identification number (if supplied).
• Invoices, usage counters per Billing Period, Usage Balance top-up history, refund records.

5.2.3 Service Telemetry and Usage Data

• Product events: feature invocations, session durations, connector usage, API call patterns.
• Model telemetry: request and response size, latency, token counts, error codes (the content of prompts and responses is Client Data; see §6.1 for how such content is processed, including through product-analytics Sub-processors).
• Device and environment data: IP address, browser type, operating system, locale, device identifier for mobile apps.
• Cookies and similar technologies (see Section 13).

5.2.4 Security and Audit Logs

• Authentication and authorization events.
• Administrative actions taken in the admin console (connector additions, user invitations, retention changes).
• Security alerts, anomaly detection events, incident response records.

5.2.5 Support Communications

• Support tickets, chat transcripts, and email correspondence between the Authorized User or the Client’s administrators and GNTC.
• Screenshots or logs the Authorized User voluntarily shares in the course of a support interaction.

5.2.6 Marketing Data

• Contact information collected through the GNTC website, events, or sales outreach (for example, to respond to an enterprise inquiry or to issue a newsletter the Authorized User subscribed to).

For clarity, we do not use Client Data for marketing.

6. How We Use Information

6.1 Client Data

We process Client Data for the following purposes based on the Client’s instructions and/or the agreement between the Client and us:

• to execute the AI agent’s tasks on the Client’s behalf;
• to route data between EntryDesk and connected third-party systems;
• to maintain contextual memory within a project or task, for the duration the Client has configured;
• to provide support when the Client’s administrator requests it;
• to monitor, measure, and diagnose use of the Services, including through product-analytics and observability Sub-processors (see §7.1), for the purposes of understanding usage patterns, identifying bugs and performance issues, and evaluating feature quality;
• to develop, improve, GNTC’s own AI and non-AI features and models;
• to enforce the Acceptable Use Policy and detect unlawful or abusive use; and
• to comply with legal obligations (see Section 7.3).

We do not sell Client Data. We do not use Client Data for advertising or third-party marketing. We do not share Client Data with third-party foundational AI model providers (e.g., OpenAI, Anthropic, Google) for the purpose of training or improving those providers’ general-purpose models; contractual “no-training” or equivalent terms are in place with such providers (see §7.1). Where reasonably practicable, we use de-identified or aggregated Client Data for analytics and improvement purposes.

6.2 Service Data

We process Service Data for the following purposes:

• Performance of the contract with the Client: to authenticate Authorized Users, bill the Client, deliver support, and operate the Services.
• Legitimate interest of GNTC and its Clients: to maintain security, prevent fraud and abuse, measure product quality, debug issues, and improve the Services at a system level (without using Client Data).
• Consent: for optional features such as marketing email; the Authorized User can withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, and law-enforcement obligations applicable to GNTC.

Specifically, we use Service Data to:

• authenticate Authorized Users and authorize actions on connected systems;
• bill the Client, reconcile usage, and issue refunds;
• monitor service health, capacity, and performance;
• detect, investigate, and respond to security incidents, abuse, and violations of the Terms or AUP;
• develop and improve EntryDesk at a system level (for example, adjusting rate limits or fixing a bug) using aggregated or de-identified telemetry;
• communicate with the Authorized User about the Services, including service announcements, security notices, and administrative communications; and
• comply with legal obligations and, where necessary, to establish, exercise, or defend legal claims.

7. How We Share Information

7.1 Sub-processors

GNTC engages sub-processors to operate EntryDesk. These sub-processors process Client Data and, in some cases, Service Data, strictly under written agreements that require the sub-processor to provide the same or an equivalent standard of data protection as the obligations GNTC owes to its Clients under this Policy and under applicable law, including commitments regarding confidentiality, security, use limitations, onward transfer, incident notification, and deletion or return of data.

Categories of sub-processors we use include:

• cloud infrastructure providers (for compute, storage, networking, and content delivery);
• large language model (LLM) and inference providers (see Section 7.1.1 below);
• payment processors (which handle Client payment method data);
• transactional email providers (for account, billing, and security notifications);
• customer support platforms;
• security-monitoring, logging, and error-reporting services; and
• product-analytics and observability providers (for example, PostHog Inc.), which receive events about use of the Services and — where configured by GNTC for analytics or service improvement — the content of prompts and AI outputs. Such providers are engaged as processors subject to written data-processing agreements; we apply PII-minimization measures (for example, pseudonymization of user identifiers and masking of sensitive fields) and do not permit such providers to use Client Data for their own product development beyond what is necessary to provide services to GNTC.

7.1.1 Third-Party AI Providers

To generate AI responses and perform agent workflows, EntryDesk transmits Client Data — including the content of Prompts and, in some cases, retrieved context and generated Outputs — to third-party large language model (LLM) and inference providers. As of the Effective Date, these providers are: OpenAI, L.L.C. (United States); Anthropic PBC (United States); and Google LLC (United States, via Vertex AI or the Gemini API). GNTC will update this Policy and revise the Effective Date as providers are added or replaced.

For each LLM or inference provider, GNTC configures the commercial relationship so that Client Data transmitted for inference is not used by the provider to train or improve that provider’s general-purpose models. This is accomplished through “no-training” or equivalent contractual terms, which we confirm before engagement and monitor on an ongoing basis.

Where EntryDesk is accessed through the Apple iOS application, and consistent with Apple App Review Guideline 5.1.2(i), the application presents each Authorized User with a separate in-app disclosure and consent screen identifying the then-current third-party AI providers before the application first transmits Client Data to any such provider. That in-app consent operates independently of any acceptance of this Policy or the Terms by a Workspace Administrator; an Authorized User may withdraw the in-app consent at any time through the application settings, in which case certain features of EntryDesk may no longer be available on the iOS application for that Authorized User.

7.2 Third-Party Integrations Chosen by the Client

EntryDesk is designed to work with third-party systems (the “External Systems”) that the Client or its Authorized Users choose to connect, such as Google Workspace, Microsoft 365, Slack, Notion, and similar platforms. When the Client authorizes such an integration:

• EntryDesk uses OAuth or API credentials granted by the Client to access the External System within the scopes the Client authorized;
• data retrieved from an External System becomes part of Client Data within the Workspace; and
• data sent to an External System is delivered to, and thereafter handled by, the External System under its own privacy terms.

The External System is an independent controller (or independent processor of its own customers). GNTC is not responsible for an External System’s handling of data once the data is transmitted to that External System in accordance with the Client’s authorized configuration.

7.2.1 Google user data — Limited Use Disclosure

If a Client connects a Google Workspace account, EntryDesk’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• we use Google user data solely to provide or improve user-facing features that are prominent in the EntryDesk user interface;
• we do not transfer Google user data to third parties except (a) as necessary to provide or improve those features, (b) to comply with applicable law, or (c) as part of a merger, acquisition, or sale of assets with notice to the Client;
• we do not use Google user data for advertising; and
• humans do not read Google user data except (i) with the Client’s explicit consent, (ii) for security purposes (such as investigating abuse), (iii) to comply with applicable law, or (iv) where the data is aggregated and used for internal operations in accordance with Google’s policies.

The Limited Use requirements above are more restrictive than the general use authorizations for Client Data set forth in Section 6.1 (including the analytics and fine-tuning uses described in that section). For data received from Google APIs specifically, the restrictions in this Section 7.2.1 control and supersede Section 6.1 to the extent of any conflict. In particular, Google user data is not used by GNTC for product analytics performed through third-party analytics sub-processors or for fine-tuning of GNTC’s own models, except as permitted by the Limited Use requirements.

7.3 Legal and Regulatory Requirements

We may disclose Personal Data, including Client Data, where we have a good-faith belief that disclosure is necessary to:

• comply with a binding legal obligation, court order, or governmental request under Taiwan law or other law to which GNTC is subject;
• enforce the Terms or the AUP, including to investigate potential violations;
• protect the rights, property, or safety of GNTC, our Clients, Authorized Users, or the public, including to prevent fraud, abuse, or imminent harm; or
• respond to claims of illegal activity or third-party-rights violations.

Where the legal process targets Client Data, and unless legally prohibited or in an emergency, we will notify the Client before disclosure so the Client has an opportunity to seek a protective order or take other action.

7.4 Corporate Transactions

If GNTC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, Personal Data may be transferred as part of that transaction, subject to the receiving party being bound by commitments that are no less protective than this Policy.

7.5 With Consent or at Direction

We may share Personal Data for other purposes when the Authorized User gives us explicit consent, or when the Client directs us to do so in its configuration of the Services.

7.6 Aggregated and De-Identified Information

We may create and share aggregated or de-identified information that cannot reasonably be used to identify any individual, for any business purpose. Such information is not Personal Data.

8. Region of Use and International Transfers

GNTC operates a cloud service with infrastructure and personnel in multiple jurisdictions. As a result, Personal Data may be transferred to, stored in, or processed in countries outside the jurisdiction in which the data was collected, including Taiwan, the United States, Japan, and other locations where our sub-processors operate.

Whenever we transfer your Personal Data to a third country (i.e., a country outside [the United States] or another jurisdiction that lacks an adequacy decision under applicable law), we ensure that such transfer is conducted in full compliance with applicable data protection legislation.

Where GNTC is subject to the Taiwan Personal Data Protection Act (個人資料保護法; the “PDPA”), any international transfer of Personal Data will comply with PDPA §21 and any applicable transfer restrictions issued by the relevant Taiwanese competent authority. Where such restrictions apply, GNTC will implement reasonable safeguards, which may include:

• written commitments from sub-processors that substantially replicate PDPA obligations;
• technical measures such as encryption in transit and at rest and access controls; and
• organizational measures such as access reviews, employee training, and incident-response processes.

9. Data Retention

9.1 Client Data

Client Data is retained for as long as the Client’s Workspace is active, subject to the retention rules the Client configures in the admin console. Specifically:

• Transient data (in-session prompts and outputs not persisted to project-level context): processed in memory and not stored persistently by default.
• Project or task contextual memory: retained for the duration configured by the Client, and deleted when the Client deletes the project or task, or upon request through the admin console.
• Files and records the Client uploads or stores in the Workspace: retained until the Client deletes them.

Upon termination or expiry of the Client’s subscription, and following any grace period specified in the Terms (by default, thirty (30) days after termination), GNTC will delete or return Client Data in accordance with the Terms.

Client Data processed through product-analytics and observability Sub-processors (see §7.1) is subject to retention rules GNTC configures with each such Sub-processor. GNTC targets a maximum retention of twenty-four (24) months in such systems for identifiable records, after which records are deleted or aggregated/de-identified. De-identified or aggregated derivatives created for analytics or model-improvement purposes may be retained indefinitely.

9.2 Service Data

We retain Service Data for as long as necessary for the purposes described in Section 6.2, consistent with the following general periods:

• Account and Workspace data: for the duration of the Client’s subscription, plus a reasonable wind-down period;
• Billing data: for the period required by applicable tax and accounting law (typically five (5) to seven (7) years in Taiwan);
• Security and audit logs: typically twelve (12) to twenty-four (24) months, subject to legal-hold requirements;
• Service telemetry and usage data: typically twenty-four (24) months in identifiable form, after which it is aggregated or de-identified; and
• Support communications: typically three (3) years after the last interaction.

We may retain information for longer where a legal obligation, legitimate dispute, litigation hold, or law-enforcement request requires us to do so.

10. Security

We implement technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, including:

• encryption in transit (TLS 1.2+) and encryption at rest for persistent storage;
• role-based access control, least-privilege principles, and access logging;
• multi-factor authentication for GNTC personnel accessing production systems;
• logical tenant isolation between Workspaces;
• endpoint protection and API gateway filtering;
• regular penetration testing, vulnerability scanning, and access reviews;
• employee security training and confidentiality obligations; and
• a documented incident-response process, with notification to affected Clients without undue delay upon confirmation of a material security incident affecting their Client Data.

No security measures are perfect. Clients are responsible for (i) securing their internal access credentials; (ii) configuring integration scopes appropriately; (iii) applying least-privilege principles when granting Authorized User access; and (iv) notifying GNTC at [email protected] of any suspected compromise of Client accounts.

11. Data Subject’s Rights

Subject to applicable data protection laws, data subjects have a number of rights regarding their Personal Data. These rights may vary depending on the location and the legal basis for our processing of the Personal Data, but generally include the rights to query or access, make a copy of, supplement or correct, stop the collection/processing/use of, and delete the Personal Data that a controller holds about a data subject. Depending on the category of data at issue, the table below set forth where each request should be directed.

For requests addressed to GNTC as controller, we will acknowledge receipt within a reasonable period and respond within the statutory period, subject to verification of the requesting data subject’s identity. We may refuse or limit a request where an exception under applicable laws applies (for example, where complying would be impossible or disproportionate, or where retention is required by law).

The Authorized User may also submit a request to us to withdraw consent to any processing that is based on consent, at any time, without affecting the lawfulness of processing performed before withdrawal.

Please note that a data subject’s request to cease the collection, processing, or use of Personal Data may affect the availability and functionality of EntryDesk.

Where EntryDesk is accessed through the Apple iOS or Android mobile application, an Authorized User may additionally initiate deletion of their individual user account from within the application itself, in accordance with Section 12.5 of the Terms of Service. Individual in-app deletion removes that Authorized User’s access and personal settings associated with the mobile application but does not by itself delete the Workspace, delete other Authorized Users’ data, or constitute deletion of Client Data held at the Client level; Workspace-level and Client Data deletion remain subject to Section 9.1 above and the corresponding provisions of the Terms of Service.

12. Children

EntryDesk is a business product and is not directed to individuals under eighteen (18) years of age (or such age at which they are unable to lawfully provide valid consent under applicable data protection laws, where applicable). Clients shall not permit any individual under such age to access the Services as an Authorized User. If we learn that we have processed Personal Data of a minor in violation of this paragraph, we will delete that data and, where appropriate, notify the Client.

13. Cookies and Similar Technologies

The GNTC website and the EntryDesk web application use cookies and similar technologies for the following purposes:

• Strictly necessary: to authenticate sessions, maintain Workspace state, and enforce security (e.g., CSRF tokens).
• Functional: to remember preferences such as language and display settings.
• Analytics: to measure feature usage and service performance at an aggregate level.

We do not use cookies for advertising on the EntryDesk application. The Authorized User can control cookies through their browser settings. Note that blocking strictly-necessary cookies will prevent the Services from functioning.

14. Links to Third Party Site or Platform

The services of EntryDesk may contain links to other sites or platform owned by the third parties. If the Authorized User clicks a third party’s link, the Authorized User shall be directed to the relevant site or platform. Please note that such external sites or platforms are not operated by GNTC. Therefore, GNTC strongly suggests that the Authorized User reviews the site’s or platform’s privacy notice in advance. GNTC has no absolute control of, and is not responsible for, the content, privacy notice, or practices of any site, platform or services of any third party whatsoever.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make a material change, we will revise the “Effective Date” at the top of the Policy and notify Clients through the EntryDesk admin console or by email to the administrator contact on file. Non-material changes (for example, clarifications) take effect upon posting. The Authorized User’s continued use of the Services after the effective date of a change constitutes acceptance of the revised Policy.

16. Contact Us

If you have questions about this Policy or our handling of your Personal Data, please contact us:

Email: [email protected]

If you are an Authorized User, you may also contact the Client’s administrator to exercise your rights over Client Data.

You also have the right to lodge a complaint with the competent data-protection authority in your jurisdiction.