Privacy policy
Last updated 15 November 2026
Kanso Scorecards is run by Kanso (“we”, “us”). This policy explains what personal information we collect when you use Kanso Scorecards, why, who we share it with, how long we keep it, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
What we collect
- Account details: your email address, and your name and profile picture if you sign in with Google.
- Profile details you choose to add: name, job title, organisation, phone number and a short bio. Your teammates see these.
- Your content: the scorecards, goals, measures, check-ins and comments you and your team create.
- Usage records: when you sign in, create scorecards, record check-ins and use Kai (with token counts and estimated cost).
- Technical information: your IP address, used briefly to limit abuse (for example, too many sign-in attempts), and standard request logs kept by our hosting provider.
- Preferences: your time zone.
We don't ask for sensitive information (such as health or financial details). Please don't put it in your scorecards.
How we use it
- To sign you in, run the service and show your work to the people you share it with.
- To send the emails the service relies on: sign-in codes and invitations.
- To provide Kai when you use it (see below).
- To enforce fair-use limits, prevent abuse and keep the service secure.
- To understand, in aggregate, which features are used so we can improve them.
We don't sell personal information, and we don't use it for advertising or share it with advertisers.
Kai, our AI assistant
Kai is the name for Kanso Scorecards's AI features. When you use one (drafting or reviewing a goal, suggesting next steps or summarising a period), the relevant scorecard content is sent to our AI provider, Anthropic, to generate the result. That can include goal and measure names, targets, check-in values and comments, and the names of owners (not their email addresses). It only happens when someone asks Kai for something. Under its commercial terms, Anthropic does not use this content to train its models. AI output can be wrong, so review it before you rely on it or share it.
Who we share it with
We use these service providers to run Kanso Scorecards. They process information on our behalf and only for that purpose:
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting the app and request logs | United States and global edge network |
| Neon | The database | An Amazon Web Services data centre |
| Resend | Sending email | United States |
| Anthropic | Kai (AI features), when used | United States |
| Sign-in, if you choose “Continue with Google” | United States |
Because these providers are overseas, your information may be stored and processed outside Australia. We choose providers with strong security practices and contractual privacy commitments. We may also disclose information if the law requires it, or to protect the safety of people or the service.
Within your workspace, everyone you invite can see the workspace's scorecards, check-ins and comments, and your profile name and job title. Nothing is public: there are no public links.
How long we keep it
| Information | Kept for |
|---|---|
| Your account, profile and content | Until you delete it or your account |
| Sign-in code records (which include your email) | 30 days |
| Rate-limit counters (keyed by IP address) | Up to 2 days |
| Check-in history | Until the scorecard, its workspace or your account is deleted |
| Kai usage and other usage records | While your account exists; AI cost records may be kept without your identity for accounting |
Emails
We only email you sign-in codes you ask for and invitations a teammate sends. There are no marketing emails.
Cookies
We only use cookies the service needs to work:
- a sign-in session cookie (and short-lived ones during sign-in)
- your current workspace
We don't use analytics, advertising or tracking cookies.
Security
Data is encrypted in transit (HTTPS) and stored with our database provider, which encrypts it at rest. Sign-in codes are stored hashed and expire after 10 minutes. Sign-in attempts and other risky actions are rate-limited, and access within the app is checked on every request. No system is perfectly secure; see our security page to report a problem. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Your choices and rights
- See and download your data: use “Download my data” in your profile, or email us.
- Correct it: edit your profile at any time, or ask us.
- Delete it: use “Delete my account” in your profile. It removes your profile and any workspace only you belong to. Shared workspaces stay with your team, without your name attached to check-ins you recorded.
- Use a pseudonym: you may use a nickname as your display name.
Children
Kanso Scorecards is a work tool and isn't meant for anyone under 16.
Changes
If we change this policy in a way that matters, we'll update the date above and tell account holders by email or in the app before the change takes effect.
Contact and complaints
Questions, requests or complaints about privacy: hello@kanso.com.au. We'll reply within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.