Privacy Policy
Last updated: 6 October 2026
How Business117 OÜ handles personal data in Engine117 and on engine117.com.
The short version
We collect what we need to run your account and the Service, and nothing to sell. We do not use tracking or advertising cookies on our website.
What you keep inside your workspace, such as your clients and your messages, is yours: we process it only on your instructions, as your processor, under our Data Processing Addendum.
We run Engine117 with hosting providers that hold independent security certifications, and data is encrypted in transit and at rest. Where personal data is transferred outside the EU, it is covered by the safeguards the GDPR requires.
1. Who is responsible
1.1 Business117 OÜ, registry code 17582615, Õnne tn 4, Tallinn, Harjumaa 11214, Estonia, is the controller of the personal data described in this policy. Contact: legal@engine117.com.
1.2 This policy covers the people who hold or use Engine117 accounts, people who visit engine117.com and people who contact us.
1.3 Personal data that our customers put into their workspaces, such as their clients, contacts, staff and the people they screen, is processed on our customers’ behalf. For that data the customer is the controller, and we act as its processor under our Data Processing Addendum. Questions about it are best sent to the organisation whose workspace it is.
2. What we collect
2.1 Account data: your name, email address, organisation, role, login method (password, Google or Microsoft) and your security settings, such as two-step login.
2.2 Usage and security data: logins, activity recorded in your workspace’s audit trail, AI usage counts, device and browser information, IP addresses and technical logs.
2.3 Billing data: the details needed to invoice and take payment. Card payments are handled by our payment provider; we do not store full card numbers.
2.4 Communications: what you send us when you contact us or ask for support.
3. Why we use it, and on what basis
3.1 To provide the Service and your account, and to take payment: performance of our contract with you or your organisation.
3.2 To keep the Service secure, prevent abuse and fix problems: our legitimate interest in running a safe and reliable service.
3.3 To keep accounting records and answer lawful requests: our legal obligations.
3.4 To tell you about changes to the Service and, where you have agreed, about new features. You can opt out of non-essential messages at any time.
3.5 We do not sell personal data, and we do not use it for advertising. We may ask a customer for permission to name it as a customer or to quote one of its people, and we do so only with that permission.
4. Who we share it with
4.1 We use the following service providers to run Engine117. Each processes personal data only as needed for its part of the Service:
Supabase: database, authentication, file storage and server functions, running on Amazon Web Services.
Vercel: hosting of the website and the application, served through its global network.
Anthropic: AI features, including the assistant, summaries and background-check analysis.
Google: image generation in the website builder, login with Google, and the Google services you choose to connect.
Microsoft: login with Microsoft.
Resend: delivery of account and notification emails.
Stripe: payment processing.
4.2 When you run a background check, the names and details you check are sent to the sources used for it, such as OpenSanctions, the Estonian e-Business Register, UK Companies House and public web search through our AI provider.
4.3 When you connect another service, data moves between it and Engine117 as you configure.
4.4 We disclose personal data to authorities only when we are legally required to, as described in section 8 of our Terms of Service.
5. Transfers outside the EU
5.1 Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it, or on the Standard Contractual Clauses approved by the European Commission.
6. How long we keep it
6.1 Account data: for as long as the account is active, and for 30 days after it closes so that it can be exported, after which it is deleted.
6.2 Billing records: for seven years, as Estonian accounting law requires.
6.3 Technical and security logs: for a limited period, normally no longer than twelve months, unless they are needed to investigate an incident.
7. Your rights
7.1 You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent.
7.2 To use these rights, write to legal@engine117.com. We answer within one month.
7.3 You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority where you live or work.
8. Security
8.1 We protect personal data with measures appropriate to the risk, including encryption in transit and at rest, separation of each workspace’s data in the database, access controls and two-step login. Our hosting providers hold independent security certifications, such as SOC 2 Type 2 and ISO 27001. The measures are described in our Data Processing Addendum.
9. Cookies and similar technologies
9.1 The application uses only the storage needed to keep you logged in and to remember your settings.
9.2 The public website engine117.com does not set advertising or tracking cookies.
10. Changes to this policy
10.1 We may update this policy. We will tell account holders about material changes by email or in the Service before they take effect.
Privacy, answered
Who is responsible for my personal data?
For your account and our website, Business117 OÜ in Tallinn is the controller. For the data inside your workspace, your organisation is the controller and we are its processor.
That means we handle what your organisation puts into Engine117, such as its clients, contacts and messages, only on its instructions, under our Data Processing Addendum.
You can reach us about any of it at legal@engine117.com.
What do you collect about me?
What we need to run your account and keep it secure: your name, email, organisation, role and login method, usage and security logs, and billing details.
Usage and security data includes logins, activity in your workspace’s audit trail, AI usage counts, device and browser details, IP addresses and technical logs.
We collect nothing in order to sell it.
Do you use tracking or advertising cookies?
No. engine117.com sets no advertising or tracking cookies, and the app stores only what keeps you logged in and remembers your settings.
There is nothing to opt out of, because there is no cross-site tracking to begin with.
Who else processes the data?
A short list of established providers that run parts of the Service, each only for its own part: database and hosting, AI features, and payments.
The full list, with what each provider does, is in section 4 of the Privacy Policy. We give workspace owners at least 30 days’ notice before adding a new one, and you can object.
Our hosting providers hold independent security certifications such as SOC 2 Type 2 and ISO 27001.
Each provider is bound to process data only for its part of the Service, and we choose providers with recognised security certifications.
Is our data transferred outside the EU?
Where it is, we rely on a mechanism the GDPR recognises: an EU adequacy decision, such as the EU–US Data Privacy Framework, or the Standard Contractual Clauses.
The Data Processing Addendum sets out the same commitment for the personal data inside your workspace.
How long do you keep personal data?
Account data for as long as the account is open plus 30 days for export. Billing records for seven years, as Estonian law requires. Technical logs normally no longer than twelve months.
Logs are kept longer only when they are needed to investigate an incident.
How do I see, correct or delete my data?
Write to legal@engine117.com. We answer within one month.
You have the right to access, correct or erase your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing relies on it.
You can also complain to the Estonian Data Protection Inspectorate (www.aki.ee) or the authority where you live or work.
If you use Engine117 through your employer, requests about the data inside the workspace may be answered by your organisation, as it is the controller of that data.
How is personal data protected?
Encryption in transit and at rest, each workspace’s data kept separate in the database, role-based access and two-step login.
The full set of measures is listed in the annex of our Data Processing Addendum.
Will you email us marketing?
We tell account holders about changes to the Service. News about new features is sent only where you have agreed to receive it, and you can opt out at any time.
We never use the contact details of your clients for our own marketing.