Privacy Policy
This policy explains what personal information Kentora handles, why, where it is kept and the choices you have.
1. Two kinds of data, two roles
Your account. For the people who use Kentora (names, emails, phone numbers, sign-in activity, billing details) Kentora Inc. is the controller and this policy applies directly.
Your business records. For the information your business brings into Kentora (customers, suppliers, sales, payments, WhatsApp conversations) your business is the controller and Kentora processes it on your behalf under the Data Processing Addendum. If you are one of our customers’ customers, please contact that business first; we will help them answer you.
2. What we collect
- Account details: name, email, optional WhatsApp number, password (stored only as a salted hash), two-step sign-in secrets (encrypted), the terms you accepted.
- Usage and security: sign-in times, IP address, device type, actions in the security activity log.
- Billing: plan, invoices and payment status. Card details go straight to Stripe; we never see or store full card numbers.
- Business records you connect: as described above, only from the systems and files you choose.
3. How we use it
- To run the Service: sign you in, keep your data separate and secure, sync your systems, run the agents you subscribe to, send the messages you approve.
- To send account emails (confirmations, password resets, invites, notices about your account). We do not send marketing email without your consent.
- To bill you, prevent abuse and fraud, and meet legal obligations.
- To improve Kentora using aggregated, non-identifying statistics. We do not sell personal information, and we do not use your business records to train AI models.
4. AI processing
When an agent or the Assistant works on your data, only what the task needs is sent to our AI provider, Anthropic. Under Anthropic’s commercial terms, data sent through its API is not used to train its models. We record how many tokens each request used and what it cost, never the content.
5. Where your data is kept
Kentora is hosted on Google Cloud in Sydney, Australia. Each business has its own database and its own encryption key. AI requests are processed by Anthropic in the United States, and WhatsApp messages travel through Meta’s infrastructure. Our engineering partner Tropical AI in Sri Lanka can access systems only to build and support Kentora, under contract. Where data leaves your country, we rely on contractual safeguards.
6. Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud (Google LLC) | Hosting: application servers, databases, file storage, encryption keys | Sydney, Australia (australia-southeast1) |
| Anthropic, PBC | AI models behind the agents and the Assistant | United States |
| Meta Platforms (WhatsApp Business Platform) | Delivering WhatsApp messages you or your agents send and receive | Global |
| Stripe, Inc. | Card payments for subscriptions and AI credit | United States and global |
| [Email provider] | Account emails: confirmation, password reset, invites, account notices | [Region] |
| Tropical AI (Private) Limited | Engineering and support for Kentora, under contract and confidentiality obligations | Sri Lanka |
7. How long we keep it
- Business records: while your account is open. When you close a business, everything is read-only for 60 days, then its database, files and encryption key are deleted. Encrypted backups expire within [backup retention period].
- Account and security logs: kept for [security log retention period] to protect accounts and investigate incidents.
- Billing records: as long as tax law requires.
8. Security
Encryption in transit and at rest, a separate database and key per business, two-step sign-in, role-based access, and a log of every security event and record change. See Security.
9. Your choices and rights
You can view, correct, download and delete your information in the app at any time. Depending on where you live (for example under Sri Lanka’s Personal Data Protection Act, Australia’s Privacy Act or US state privacy laws) you may have rights to access, correct, delete or object to processing, and to complain to your data protection authority. Write to [privacy contact email] and we will answer within the time the law sets.
10. Children
Kentora is a service for businesses and is not meant for anyone under 18.
11. Changes
We will tell you about material changes by email and in the app before they take effect.
12. Contact
Kentora Inc., [registered address] · Privacy: [privacy contact email]