Privacy policy

Kanso Roadmaps is run by Kanso (“we”, “us”). This policy explains what personal information we collect when you use Kanso Roadmaps, why, who we share it with, how long we keep it, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

• Account details: your email address, and your name and profile picture if you sign in with Google.
• Profile details you choose to add: name, job title, organisation, phone number and a short bio. Your teammates see these.
• Your content: the projects, charters, timeline items, status reports, summaries and images you and your team create.
• Follower emails: addresses of people who ask to follow a project (members, or anyone with a public link who confirms their address).
• Usage records: when you sign in, create projects or reports, use AI (with token counts and estimated cost), and what changed on a project (for update emails).
• Technical information: your IP address, used briefly to limit abuse (for example, too many sign-in attempts), and standard request logs kept by our hosting provider.
• Preferences: your weekly email day, time zone, and display choices (for example, list or tile view).

We don't ask for sensitive information (such as health or financial details). Please don't put it in your projects.

How we use it

• To sign you in, run the service and show your work to the people you share it with.
• To send the emails the service relies on: sign-in codes, invitations, follow confirmations, project update digests, and your weekly check-in.
• To provide AI features when you use them (see below).
• To enforce fair-use limits, prevent abuse and keep the service secure.
• To understand, in aggregate, which features are used so we can improve them.

We don't sell personal information, and we don't use it for advertising or share it with advertisers.

AI features

When you use an AI feature (drafting a project, charter, status report or summary), the relevant project content is sent to our AI provider, Anthropic, to generate the result. That can include item titles, dates, status, the project charter, and the names of item owners. It only happens when someone presses an AI button. Under its commercial terms, Anthropic does not use this content to train its models. AI output can be wrong, so review it before you rely on it or send it to anyone.

Who we share it with

We use these service providers to run Kanso Roadmaps. They process information on our behalf and only for that purpose:

Because these providers are overseas, your information may be stored and processed outside Australia. We choose providers with strong security practices and contractual privacy commitments. We may also disclose information if the law requires it, or to protect the safety of people or the service.

Within your workspace, everyone you invite can see the workspace's projects and your profile name and job title. Public links are off by default. If someone turns one on for a project, anyone with the link can see that project's timeline, charter summary and latest status report (not item notes or owners) until it's turned off.

How long we keep it

Emails

Sign-in codes and invitations are sent when you (or a teammate) ask for them. Project update digests go only to people who follow a project. Anyone following through a public link has to confirm their address first. The weekly check-in goes to people who lead projects. Every update email has a one-click link to stop it, and you can change your weekly check-in day or turn it off in your profile.

Cookies

We only use cookies the service needs to work:

• a sign-in session cookie (and short-lived ones during sign-in)
• your current workspace
• your list or tile view preference

We don't use analytics, advertising or tracking cookies.

Security

Data is encrypted in transit (HTTPS) and stored with our database provider, which encrypts it at rest. Sign-in codes are stored hashed and expire after 10 minutes. Sign-in attempts and other risky actions are rate-limited, and access within the app is checked on every request. No system is perfectly secure; see our security page to report a problem. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Your choices and rights

• See and download your data: use “Download my data” in your profile, or email us.
• Correct it: edit your profile at any time, or ask us.
• Delete it: use “Delete my account” in your profile. It removes your profile and any workspace only you belong to. Shared workspaces stay with your team, without your name attached to what you wrote.
• Stop emails: use the link in any update email, or your profile settings.
• Use a pseudonym: you may use a nickname as your display name.

Children

Kanso Roadmaps is a work tool and isn't meant for anyone under 16.

Changes

If we change this policy in a way that matters, we'll update the date above and tell account holders by email or in the app before the change takes effect.

Contact and complaints

Questions, requests or complaints about privacy: hello@kanso.com.au. We'll reply within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.