Legal

Privacy Policy

Last updated: 18 March 2026

1. Introduction

Kanue ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Information you provide

  • Account information: name, email address, and password when you create an account.
  • Workspace information: business name, address, logo, and tax settings.
  • Client data: contact details, project information, invoices, contracts, and proposals you create through the Service.
  • Payment information: billing details processed securely through our payment partners (Stripe and GoCardless). We do not store card numbers.
  • Communications: messages you send through the platform, support requests, and feedback.

Information collected automatically

  • Usage data: pages visited, features used, timestamps, and interaction patterns.
  • Device information: browser type, operating system, device identifiers, and screen resolution.
  • IP address: used for security, fraud prevention, and approximate geolocation.
  • Cookies and similar technologies: see Section 5 below.

3. How We Use Your Information

  • To provide, maintain, and improve the Service.
  • To process transactions and send related information (invoices, receipts).
  • To send administrative messages, security alerts, and support communications.
  • To personalise your experience and deliver content relevant to your interests.
  • To monitor and analyse usage trends to improve the Service.
  • To detect, prevent, and address technical issues, fraud, and security vulnerabilities.
  • To comply with legal obligations and enforce our terms.

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

  • Contract performance: processing necessary to provide the Service you have signed up for.
  • Legitimate interests: improving the Service, preventing fraud, and ensuring security.
  • Consent: where you have given explicit consent, such as for marketing communications.
  • Legal obligation: where processing is required by law.

5. Cookies

We use cookies and similar tracking technologies to enhance your experience. Cookies are small data files stored on your device.

  • Essential cookies: required for the Service to function (e.g. authentication, session management).
  • Analytics cookies: help us understand how visitors interact with the Service so we can improve it.
  • Preference cookies: remember your settings and preferences.

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Service.

6. Third-Party Services

We share data with trusted third-party providers only as necessary to operate the Service:

  • Stripe & GoCardless: payment processing.
  • Neon: database hosting and storage.
  • Vercel: application hosting and content delivery.
  • Resend: transactional email delivery.

We do not sell your personal data to third parties. We may disclose information if required by law or to protect our rights.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal, accounting, or regulatory purposes.

Client data you create (invoices, contracts, proposals) will be permanently deleted when your workspace is deleted, subject to any legal retention requirements.

8. Your Rights

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate or incomplete data.
  • Erasure: request deletion of your personal data ("right to be forgotten").
  • Restriction: request that we limit the processing of your data.
  • Portability: request your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at privacy@kanue.io. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest, row-level security for data isolation between workspaces, and hashed storage of sensitive tokens.

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the UK and EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with applicable data protection laws.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.

Your Rights

  • Right to Know: You may request details about the categories and specific pieces of personal information we have collected, the sources and purposes of collection, and the categories of third parties with whom we share it.
  • Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt-Out: You may opt out of the sale or sharing of your personal information. Kanue does not sell your personal information to third parties.

We Do Not Sell Personal Information

Kanue does not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. We do not share your personal information for cross-context behavioural advertising.

Non-Discrimination

We will not discriminate against you for exercising your CCPA/CPRA rights. You will not receive different pricing, a different quality of service, or be denied access for making a privacy request.

Submitting a Request

To exercise any of these rights, please email privacy@kanue.io or visit our Privacy Rights page. We will verify your identity and respond within 45 days.

12. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

14. Data Processing Agreement

For customers who process personal data through Kanue, we offer a Data Processing Agreement (DPA) that outlines our commitments as a data processor. Our DPA is available at kanue.io/dpa.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Privacy Policy | Kanue