Kainen privacy policy
Last updated: November 14, 2026 · Version française
In short
- Kainen is an online tool for mapping processes. We collect the minimum needed to run it.
- Your data is hosted in Toronto (Canada), at DigitalOcean.
- No advertising, no outside analytics tool, no tracking cookie. We never sell or rent any data.
- You can see, correct, download and delete your data. Write to [email protected].
1. Who we are
Kainen (kainen.io and app.kainen.io) is run by Kainen. For contact: [email protected]. In this policy "we" means Kainen and "you" the person using Kainen.
2. Person in charge of protecting personal information
Kainen's founder is the person in charge of protecting personal information (privacy officer).
- Role: Privacy officer (person in charge of the protection of personal information; Kainen's founder)
- Contact: [email protected] (subject: "Privacy")
The officer answers your questions, handles your requests and keeps the register of confidentiality incidents. Our internal rules are in our governance policy.
3. What we collect, and why
| Information | Why | How long |
|---|---|---|
| Account: first name, last name, email, password (stored only as a hash, never in plain text), chosen language | Create and protect your account, write to you about it (email confirmation, password reset, invitations) | While the account exists |
| Consent: date and version of the terms and policy you accepted | Prove your acceptance | While the account exists; after deletion, the proof is kept until a retention period is set |
| Session: sign-in cookie, IP address, browser type, dates | Keep you signed in, protect the account | A session ends after 14 days unused; expired sessions are deleted |
| Security log: who did what and when, with the IP address (sign-ins, failed sign-ins with the email typed, access changes, opening a map or board, using a share link) | Detect abuse, investigate an incident | 12 months, then the IP address and typed email are erased |
| Content: maps, boards, steps, notes, comments, custom fields, people, teams, hourly rates, costs | Provide the service | Until you delete it; a deleted item stays 30 days in the trash, then is destroyed |
| A map's activity feed: who changed what and when | Show the history to the map's members | The latest 500 entries per map |
| Server logs: method, address requested (share tokens hidden), response code, time, shortened IP address (the last part removed) | Run and troubleshoot the service | up to 30 days (a hosting setting) |
Sign-up source: the short label of the link that brought you (for example ?ref=linkedin), and your optional answer to "How did you hear about Kainen?" | Learn which channels work | Deleted with the account |
| Usage measures: the date you reach your first cost figure, the number of active maps per week | Improve the product | The milestone is deleted with the account; daily totals hold no personal information |
| Support messages: your email and the message | Answer you | 24 months after the last message; deleted sooner on request |
| Billing (only once paid plans are offered): plan, seats, Stripe ids | Bill you | As tax rules require. Your card and billing address are entered at Stripe and never reach us |
Live presence. While you are on a map, your short name ("First L."), cursor and selection are visible to the other people there. None of it is kept after you leave.
What we don't do. No profiling, no location tracking, no automated decisions about you, no advertising, no third-party script in the app. Usage measures are computed on our own server; nobody reads your content to produce them.
4. Cookies and browser storage
| Cookie | Purpose | Lifetime |
|---|---|---|
kainen_session | Essential: keeps you signed in. Not readable by scripts (HttpOnly) | Up to 30 days; ends after 14 days unused |
kainen_ref | Only when you arrive through a link containing ?ref=. It holds the label only (for example "linkedin"), no identifier. It counts where sign-ups come from | 30 days |
No advertising or analytics cookie. On the showcase site (kainen.io), your browser also keeps your language choice if you make one (local storage, key kainen-site-lang); nothing is sent anywhere. Your browser also keeps an offline copy of your maps and your preferences (local storage); that copy stays on your device, and copies tied to your account are cleared when you sign out.
5. Information about other people that you enter
You can record information about your employees or colleagues in a map (name, job title, email, hourly rate). For that information your organisation stays responsible; we act as its service provider and use it only to provide Kainen (see section 6 of the terms of use).
- Enter only what is needed. A role or an average rate is often enough.
- Do not put sensitive information (health, personal financial data, etc.) in free-text fields.
- Inform the people concerned, following your organisation's rules.
- Note: anyone holding a view link sees the whole map, rates and costs included.
6. Who can see your data
- You, and the people you share a map or board with, according to the role you give them. Only the owner sees members' emails; others see "First L.".
- People holding a view link you created (read only, expires after 30 days by default).
- Our providers (section 7), only for what they do for us.
- The founder, as administrator, only to run, secure or support the service, or at your request.
- Authorities, where the law requires it.
7. Where your data is and who helps us
Your data is hosted in Toronto, Ontario, which is outside Quebec. We assess the privacy impact before sending personal information outside Quebec, as Quebec law requires.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| DigitalOcean | Servers, database, backups, logs | All service data | Toronto, Canada |
| Cloudflare | Domain names (DNS); hosting of the kainen.io showcase site; forwarding of email sent to [email protected] to the founder's inbox, once that forwarding is switched on | Site visitors' IP addresses and requests; email sent to support | Global network, including outside Canada |
| Resend | Sending the service's email (confirmation, password, invitations) from mail.kainen.io, once that feature is switched on | Email address, name, message content | United States |
| Have I Been Pwned (Pwned Passwords service) | Check that a password has not already leaked | Only the first 5 characters of the password's hash: never the password itself, nor your email | Public online service, outside Quebec |
| The founder's inbox | Receiving messages sent to [email protected] | Your messages | Contact: [email protected] |
| Stripe | Payments, only once paid plans are offered | Account email, Kainen id, plan, seats | United States |
We add a provider to this list and to our Security page before it receives any data. No artificial intelligence feature is active; if we add one, we will tell you first and it will stay optional.
8. How long we keep data
| Data | Period |
|---|---|
| Account and content | While the account exists. After deletion: erased from the database within 30 days, then from backups within the next 30 days |
| Items moved to the trash | 30 days, then destroyed |
| Sessions | End after 14 days unused; expired sessions deleted |
| Security-log IP addresses and typed emails | 12 months |
| Server logs (shortened IP) | up to 30 days (a hosting setting) |
| Expired or revoked share links | 90 days after expiry or revocation |
| Backups | Not yet active during early access; planned before the official launch (nightly copy kept 30 days, in Toronto) |
| Support email | 24 months after the last message; deleted sooner on request |
| Billing | As tax rules require |
Deleting your account. Maps and boards you own are deleted with your account, including for the people you share them with. Your comments on other people's maps are deleted with your account.
9. Security
Encrypted connections (HTTPS), hashed passwords (Argon2id), an access check every time a map is opened, a security log. Details: Security page.
10. Your rights
Free of charge, you can:
- know what information we hold about you and get a copy;
- correct it if it is wrong or incomplete;
- receive it in a structured, commonly used format (
.kainen.jsonand CSV files), and ask us to send it to another organisation; - delete it by deleting your account;
- withdraw your consent (this may end the account where the information is needed for the service);
- complain (section 14).
How. From the Account page (profile, password, language, "Download my data", "Delete account"), or by writing to [email protected]. We may check your identity before answering. We answer within 30 days.
11. Confidentiality incidents
If personal information is accessed, used, disclosed or lost without authorisation, we act to limit the harm, record the incident in our register and, where it carries a risk of serious injury, promptly notify the Commission d'accès à l'information and the people concerned.
12. Language
This policy is written in French first. This English version is offered at your choice; if they differ, the French version prevails.
13. Age
Kainen is a work tool for people aged 18 or over.
14. Questions and complaints
Write to the officer first (section 2); we answer within 30 days. If our answer does not satisfy you, you can contact the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).
15. Changes
We tell you by email and in the app at least 30 days before any significant change. The date at the top of the page shows the last update.