## Kana Privacy Policy
**Effective Date:** 2026-09-10
**1. Data Collected from Devices**
The Kana app collects the following information from devices: device name, OS and version, and the results of security checks (disk encryption/FileVault or BitLocker, screen lock, firewall, automatic updates, malware protection/XProtect/Defender/ClamAV, Gatekeeper, SIP, starts-at-login). We do not collect screenshots, keystrokes, browsing history, location data, or file contents.
**2. Google Data**
We collect your sign-in email and hosted domain. For a Google Workspace admin, we also collect the user list (name, email) to build the team. This data is used only to sign in and show the team. Kana's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. No Google data is transferred to others except as needed to provide the service, for security, or by law. It is never used for ads. Humans read it only with consent, for security, or by law.
**3. No Sale or Sharing for Marketing**
Kana does not sell user or device data, and does not share it for advertising, marketing or third-party analytics.
**4. Purpose, Retention, and Processing**
- **Purpose:** To show a manager whether team devices meet the controls and to provide auditor evidence.
- **Retention:** Data is retained while the account is active. It is deleted within 30 days of a deletion request.
- **Access and Deletion:** Users may request access to or deletion of their data at any time.
- **Sub-processors:** Data is hosted using generic hosting providers.
- **Security:** We use TLS encryption and access is limited to the organization's own managers.
- **Children:** This service is not intended for children under 16.
**5. Changes to this Policy**
We may update this policy from time to time. Changes will be posted on this page.
**6. Contact Us**
Operator: Kana Inc.
Email: privacy@kana.io
