Privacy policy
Effective October 18, 2026
In short: Kennu collects only what you and your organization choose to enter, and shares it only with the people you meet. Your profile is shown to colleagues in your organization, to attendees of meetings you take part in and, later, to your connections. Meetings are never public or searchable. We do not sell data or share it with advertisers, and we use no tracking cookies.
The English version of this policy is legally binding.
1. Who we are
Kennu is operated by Concept & Code, LLC, a U.S. limited liability company. Privacy contact: legal@kennu.io. For users in the EEA and the UK, Concept & Code, LLC is the data controller for accounts and for operating Kennu. For the content an organization puts into Kennu (its content modules, attachments and meetings), we process data on the organization's behalf as its processor; organizations can request a data processing agreement at legal@kennu.io.
2. Data we collect
2.1 Account data. Your email address. Kennu has no passwords: you sign in with one-time links sent to your email.
2.2 Profile. Name, role, short intro, optional photo, contact details (email, phone, LinkedIn, website) and preferred language, as you enter them. You can change or remove them at any time.
2.3 Organization and content. Organization name and website, departments, members and their roles, and content modules (text and attachments; PDF and images only).
2.4 Meetings. Title, time, duration, purpose, attendees, the content shared, and whether each attendee has opened the briefing (so organizers know who is prepared).
2.5 People invited to a meeting. When an organizer invites you, they provide your name and email address. Until you open the briefing, we store only these for that meeting and use them to send you the invitation. Adding your address never reveals to the organizer whether you already use Kennu; your profile is shared only once you open the briefing yourself.
2.6 Access requests. If you open a meeting link not addressed to you and ask for access, the organizer sees your name, email and optional note.
2.7 Security and audit log. We record important actions (for example sign-ins, profile and content changes, invitations, and denied access attempts) with time and the account involved, so organizations and you can see who did what. For sign-ins and denied access attempts we also store the IP address and browser (user agent). For each signed-in device we store an approximate location (city and country) so you can recognize your devices.
2.8 Usage statistics. Cloudflare Web Analytics counts page views without cookies and without identifying you. We do not use session recordings, heatmaps or per-person click tracking.
2.9 Payment data. Kennu is in early access and free of charge; we collect no payment data. Before any paid plan starts, we will update this policy and name the payment provider.
3. How we use your data
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing Kennu: profiles, organizations, content, meetings, briefings | 2.1–2.4, 2.6 | Contract (Art. 6(1)(b)) |
| Inviting people to meetings | 2.5 | Legitimate interests of the organizer and us in preparing the meeting (Art. 6(1)(f)) |
| Transactional emails: sign-in links, invitations, meeting notices, updates you opted in to | 2.1, 2.5 | Contract (Art. 6(1)(b)) |
| Security, audit log, abuse prevention, bug fixes | 2.7 | Legitimate interests (Art. 6(1)(f)) |
| Aggregate usage statistics | 2.8 | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | as required | Legal obligation (Art. 6(1)(c)) |
3.1 Emails. Transactional emails are sent as part of the service. Update emails contain real changes only, at most one digest per day, and you can turn them off. We send no marketing emails without your opt-in consent.
4. Third-party service providers
- Supabase: database and authentication. Stored in a U.S. region.
- Cloudflare: hosting and delivery (Workers), file storage (R2), anonymous web statistics.
- Resend: sending emails. United States.
All act as processors on our behalf under data processing agreements.
5. Data retention
- Active accounts: while the account is active.
- Deleted accounts: deleting your account in Kennu (Profile → Delete account) is immediate and irreversible; requests sent by email are actioned within 30 days. Audit log entries are kept, with personal identifiers replaced by a pseudonym.
- Invited people without an account: as long as the meeting exists.
- Attachments: until they are removed or their content module is deleted.
- Audit log: 24 months.
- Sign-in sessions and device locations: until you sign out or the session expires.
- Backups: encrypted backups may persist for up to 90 days after deletion.
- Legal holds: longer where required by law.
6. Your rights
You have the right to access, correct, delete and export your data, to restrict or object to processing, and to withdraw consent. You can edit your profile and delete your account at any time in Kennu (Profile → Delete account). For a copy of your data, write to legal@kennu.io. Requests are free and non-discriminatory. If you are in the EEA or the UK, you may also lodge a complaint with your local data protection authority.
7. U.S. state privacy rights
California (CCPA/CPRA): you have the right to know, delete and correct your personal information. We do not sell personal information or share it for cross-context behavioral advertising. Requests: legal@kennu.io.
8. Children's privacy
Kennu is a service for professionals and is not directed to children under 16. We do not knowingly collect their data and delete it when we learn of it.
9. Data security
TLS in transit and encryption at rest; row-level security on every database table; files stored privately and served only after an access check; personal invite links are single-use and bound to an email address; secrets kept in server-side vaults; an append-only audit log; restricted access to production data. Report suspected security issues to support@kennu.io.
10. International data transfers
Concept & Code, LLC is based in the United States, and processing takes place there. For transfers of personal data from the EEA and the UK we rely on standard contractual clauses or other lawful transfer mechanisms.
11. Cookies and local storage
Essential cookies only: your sign-in session, your chosen language, your time zone (to show meeting times correctly) and, briefly, where to return after signing in. No third-party tracking or advertising cookies, so no cookie consent is required.
12. Changes to this policy
We signal material changes by updating the effective date and, where appropriate, by email. Continued use after changes take effect means you accept the updated policy.
13. Contact
Privacy and legal: legal@kennu.io · Support: support@kennu.io · Mail: Concept & Code, LLC (address on file with registered agent)