Privacy Policy
1. Introduction
Kenna AI, Inc. (“Kenna AI,” “we,” “us,” or “our”) operates the Kenna AI design studio at studio.kenna.ai (the “Service”). This Privacy Policy describes how we collect, use, store, and protect your personal information.
By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect your email address and, if applicable, your name, organization name, and team role.
2.2 Payment Information
Payment processing is handled by Stripe, Inc. We do not directly collect or store your credit card numbers or bank account details. We receive from Stripe your customer ID, subscription status, and transaction history.
2.3 Uploaded Content
When you use the Service, you may upload images, designs, sketches, and other files (“User Content”). We store your User Content on secure cloud infrastructure (Cloudflare R2).
2.4 Generated Content
Images and designs generated through the Service (“Generated Outputs”) are stored in your account and associated with your user profile.
2.5 Usage Data
We automatically collect technical and usage information including: IP address, browser type, device information, pages visited, tools used, generation counts, credit usage, and timestamps.
2.6 Cookies and Analytics
We use Google Tag Manager and Google Analytics to collect anonymized usage data. We may use cookies to maintain your session, remember preferences, and analyze usage patterns.
3. How We Use Your Information
We use the information we collect to:
(a) Provide, maintain, and improve the Service;
(b) Process transactions and manage your subscription;
(c) Send transactional emails (welcome, upgrade, credit, and password reset emails);
(d) Monitor usage patterns and enforce credit limits;
(e) Detect, prevent, and address technical issues, fraud, or abuse;
(f) Respond to support requests;
(g) Comply with legal obligations.
4. How We Share Your Information
We do not sell, rent, or trade your personal information. We may share information with:
Service Providers: Supabase (authentication and database), Stripe (payments), Cloudflare (storage), Vercel (hosting), Google Cloud (AI inference), and Resend (email). These providers process information on our behalf.
Legal Requirements: We may disclose information if required by law, regulation, or legal process.
Business Transfers: In the event of a merger, acquisition, or sale, your information may be transferred. We will notify you of any such change.
5. Data Storage and Security
Your data is stored on secure cloud infrastructure with TLS/SSL encryption. We implement reasonable safeguards to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
6. Data Retention
We retain your data while your account is active. If you delete your account, personal information is deleted within 30 days, except where required by law. Generated Outputs are retained until you delete them or your account is terminated.
7. Your Rights
Depending on your jurisdiction, you may have the following rights:
Access: Request a copy of your personal information.
Correction: Request correction of inaccurate information.
Deletion: Request deletion of your personal information.
Portability: Request your data in a machine-readable format.
Opt-Out: Opt out of promotional communications.
Contact [email protected] to exercise these rights. We will respond within 30 days.
8. AI Model Training
We do not use your User Content or Generated Outputs to train AI models.
Your content is processed by third-party AI models (Google Gemini) solely for generating the requested output. We do not provide your content to third parties for training purposes. Third-party AI providers may have their own data practices — we encourage you to review Google’s Privacy Policy.
9. Children’s Privacy
The Service is not intended for individuals under 18. We do not knowingly collect information from children. If we become aware of such collection, we will delete it promptly.
10. International Data Transfers
Your information may be transferred to and processed in the United States and other countries. By using the Service, you consent to these transfers.
11. California Privacy Rights (CCPA)
California residents have additional rights under the CCPA, including the right to know, delete, and opt out. We do not sell personal information. Contact [email protected] to exercise your rights.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting the updated policy. Continued use constitutes acceptance of the revised policy.