Privacy policy

Who processes your data

enhanzu is a brand operated by Andrés Lazo, based in San José, Costa Rica. This policy covers the enhanzu.com website, the workspace at app.enhanzu.com, the enhanzu HR (hr.enhanzu.com), enhanzu Apply and enhanzu Científico (cientifico.enhanzu.com) services, on the web and in their desktop apps, and the applications enhanzu operates on the Meta and Google platforms.

For any privacy matter you can write to contacto@enhanzu.com.

Applications covered

On Google: enhanzu, the application through which enhanzu HR, enhanzu Apply and enhanzu Científico ask your permission to sign in with your Google account and, if you authorize it, to use your Gmail or your Drive, on the web and in the desktop apps. What it does with that data is under Your Google account data.

On Meta: Enhanzu, App ID 1447197480772761, in the Meta business portfolio Enhanzu (identifier 951707104201176). It serves, through the WhatsApp Business Platform, the numbers connected to enhanzu, including enhanzu's own number, and it is the application a client business uses to connect its own WhatsApp Business account.

If the application changes its commercial name, this page is updated and remains its official privacy policy.

Data we collect

From people who chat with a number served by enhanzu. WhatsApp name and phone number, and the content of the messages sent and received, needed to keep the conversation going.

From a business that connects its WhatsApp to enhanzu. Its WhatsApp Business account identifier, its phone number identifier, its verified business name and the access token Meta issues when the business authorizes the connection. That token allows sending and receiving messages on behalf of the business and is stored with restricted access, outside the code.

From people who write to us through the website. Name, email, company when given, and the message. If you book a call, the appointment is stored in enhanzu's Google calendar.

Health data. When enhanzu serves a clinic, a patient may mention something about their health in the chat. That information is used only to route their appointment and is seen by the clinic's staff. We do not give diagnoses or medical advice: those questions always go to a person at the clinic.

We do not collect financial information and we do not track you outside these conversations.

What we use it for

To answer inquiries over WhatsApp, note what is needed to book an appointment, hand the conversation to a person at the business when needed, and write once to someone who asked and did not book when the business has agreed to it. On the website, to reply to people who write to us.

We do not sell or rent personal data, we do not use it for our own advertising or to train models, and we do not use it for purposes other than those described here.

When enhanzu works for a client business

If a business connects its WhatsApp account to enhanzu, that business is the controller of its own customers' or patients' data and enhanzu acts as a processor: it processes those conversations only on the business's instructions and to provide the service, under the data processing agreement both sign. The business can ask at any time to disconnect its account and delete the stored conversations.

enhanzu HR

enhanzu HR, at hr.enhanzu.com, ranks the job applications a company receives by email. The company is the controller of its candidates' data and enhanzu acts as processor, under the data processing agreement both sign.

What data is involved. By signing in with Google, the company authorizes enhanzu HR to read its Gmail and save files to its Drive. The service reads application emails and the attached CVs, with what they contain: name, email, phone, experience, education and sometimes details the candidate chose to include. In Drive it only sees the files the service itself creates. It reads email in read-only mode: it does not delete, send or mark emails. The web app asks Google for read-only Gmail permission; the desktop app, which reads the inbox over IMAP, needs the full permission, and even so it only reads.

Who does the analysis. The text of each CV is sent to Anthropic PBC, in the United States, to compare it with the job profile the company writes. Anthropic does not train its models on this data. The result ranks and explains, and the hiring decision is always made by a person at the company.

Where it stays. CVs, reports and the candidate sheet are saved in the company's Google account. While the company works, the service builds a temporary working copy on our server, uploads it to their Drive after each change and deletes it after 30 minutes without activity. That copy never goes into a database.

What we keep. The company's license; its subscription status (plan, status, expiry date and the PayPal subscription id, with no card data); the access permission to its Google account, encrypted with the key kept outside the database; and minimal technical logs, with no email or CV content.

How everything is deleted. The company can cut access at any time from its Google account, under Security, Apps with access. When the service ends we revoke and delete the access permission, delete the license within thirty days and confirm it in writing. CVs and the sheet stay in the company's Google account, which decides what to keep. If you are a candidate, you can ask the company you applied to to see, correct or delete your CV, or write to us and we will help them handle it.

enhanzu Científico

enhanzu Científico helps draft and review graduate research documents. To use it you sign in with your Google account or with a code sent to your email, and connect your Google Drive: the service creates an «enhanzu Científico» folder there and only sees the files it creates in it.

Who does the analysis. The text of your document and, if the thesis includes analysis, the dataset you upload are processed on our server, and the text is sent to Anthropic PBC, in the United States, to draft and review it. Anthropic does not train its models on this data. Your dataset may contain health data of your study participants: you, as the researcher, are responsible for having obtained it with their consent and the applicable ethics approval, and we ask you to upload it without names or data that identify people.

Temporary custody in «Con revisión del equipo» (team review). In this mode the document the tool produces does not go straight to your Drive: it is stored in our database until the team reviews it. While it waits:

• it is encrypted, with a key kept apart from the database and not used by any other service;
• only the academic team member who reviews it opens it; that person sees an alias, not your email, and every download or approval is logged with who and when, without copying the content;
• it is kept for at most 30 days. When it is delivered to your Drive, or when that period ends, it is deleted from the database. Daily backups keep it encrypted for up to 14 more days and then delete it automatically.

What we keep afterwards is your project (what you bought, when it expires and how many runs you used), the PayPal payment (no card data), the access permission to your Drive, encrypted, and technical logs with no content from your documents.

How everything is deleted. You can cut access to your Drive at any time from your Google account, under Security, Apps with access. If you ask us to delete your account, we delete the access permission, your project and any document still in review, within thirty days. The documents in your Drive are yours and stay there.

Your Google account data

Each service asks only for what it uses, and only when you connect it:

• enhanzu HR reads the company's Gmail and saves files to its Drive, as explained above.
• enhanzu Apply, in the desktop app, reads your Gmail in read-only mode when you click «Revisar mi correo» (Check my email), to find replies from the companies you applied to. It only takes emails from those companies, and their text is sent to Anthropic to tell whether it is an interview, a rejection or something else. The permission is stored on your computer, not on our servers, and disconnecting Gmail from the app revokes and deletes it. On the web, Apply saves your files to your Drive and only sees the files it creates.
• enhanzu Científico saves your documents in an «enhanzu Científico» folder in your Drive and only sees the files it creates there.

enhanzu HR, enhanzu Apply and enhanzu Científico's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

No one at enhanzu reads your Google data, except in these cases: when you ask for it or authorize it, for example by purchasing the team review in enhanzu Científico or by asking us for help with a specific problem; when it is needed to investigate abuse or a security issue; when the law requires it; or, to operate the service, in aggregated form that cannot identify anyone.

We do not use your Google data for advertising, we do not sell it, and we do not use it to train artificial intelligence models, and neither does Anthropic.

You can remove the permission at any time from your Google account, under Security, Apps with access. From that moment the service can no longer access your Gmail or your Drive.

enhanzu Apply extension for Chrome

The extension stores in your browser, using Chrome's own storage, the profile you load (name, email, phone, city, links and frequent answers), your CV and the jobs you choose to save. Your profile and your CV are not sent to enhanzu or anyone else; saved jobs only travel if you use enhanzu Apply on the web (below).

When you click «Llenar este formulario» (Fill this form), the extension writes your data and attaches your CV in the form you have open, which belongs to the company or job platform that publishes it. What they do with your application is governed by their policy. The extension never submits the form: the last click is yours.

If you use enhanzu Apply on the web (apply.enhanzu.com) with your account, that page can ask the extension for your saved jobs. Only the title, company, location, published salary, link, source site of each job and its identifier on that site are passed on, and they are stored in the «enhanzu Apply» folder of your Google Drive. Your profile and CV in the extension never leave the browser.

The extension uses no analytics or advertising. To delete what it stores, remove the extension from Chrome. Jobs you already passed to the web stay in your Drive, where you delete them.

Who it is shared with

Messages are processed through Meta's platforms, which apply their own policy. We also use providers that act as processors and only handle data on our instructions. They are located outside Costa Rica.

360dialog GmbH, Germany, with servers in the European Union, a WhatsApp provider authorised by Meta, through which WhatsApp messages pass. Railway Corporation, United States, hosting of the application, the conversations database and the enhanzu HR, enhanzu Apply and enhanzu Científico servers. Anthropic PBC, United States, processing of message text to generate replies, of enhanzu HR CVs to rank them, of the reply emails enhanzu Apply checks, and of enhanzu Científico documents to draft and review them. PayPal, United States, billing for the enhanzu HR subscription and enhanzu Científico projects, which receives an account reference and not the email address. Cloudflare, United States, hosting of this website and anti-abuse protection for the form. Resend, United States, delivery of contact form messages. Google, United States, enhanzu's email and calendar, plus sign-in, Gmail and Drive for people using enhanzu HR, enhanzu Apply and enhanzu Científico.

We do not share data with third parties for purposes other than providing the service.

How long we keep it

We keep conversations as long as needed to provide the service and to meet legal obligations. When a client business ends the service, we hand over its conversations and delete them from our systems within thirty days. You can ask for your data to be deleted at any time.

Your rights and how to delete your data

You can request access, correction or deletion of your data, and withdraw your consent, by writing to contacto@enhanzu.com from the associated email or phone number, stating that it is a data deletion request. We handle requests within thirty days and confirm through the same channel once they are completed. If the conversation was with a clinic or another client business, you can also ask that business directly.

You can also write BAJA in the same WhatsApp conversation so we stop writing to you and your history is deleted.

In Costa Rica you may also contact the Agencia de Protección de Datos de los Habitantes (PRODHAB), under Law 8968.

Security

We apply reasonable technical and organizational measures. Restricted access to conversations, sessions that expire, lockout after failed sign-in attempts, credentials stored outside the code and TLS encryption in transit on every integration. If an incident affects a client business's data, we notify it within 48 hours of becoming aware of it.

Contact

Andrés Lazo, enhanzu, San José, Costa Rica. contacto@enhanzu.com.