Privacy policy

The controller of the processing described in this policy is Number Studios SL, the company behind Kanesh:

• Company: Number Studios SL, trading as Nexau.
• Tax ID (NIF): B-14938864.
• Registered office: C/ Doce de Octubre 1, 2º 2, 14001 Córdoba, España.
• Contact email: [email protected].

For any privacy matter, write to [email protected] with the subject “Data protection”.

• people who visit this website;
• people who request a conversation diagnosis or write to us;
• business contacts at companies we talk to about Kanesh (prospects);
• users at companies that contract Kanesh, as regards their account, billing and support;
• people who send us a job application.

It does not apply to the conversations between a brand and its own customers inside the platform. That case is explained under “When you use the Kanesh platform”.

• Browsing data: when serving pages, the website's hosting provider processes technical data such as your IP address, browser, the page requested and the date and time of the visit.
• Your cookie choice: stored in your browser's local storage (kanesh.consent.v1), with the date and time and the banner version, not on our servers.
• Diagnosis and contact requests: name, work email, company or store URL, country, approximate monthly conversations, main channel and any message you choose to add.
• Communications: the emails we exchange with you and what you tell us in sales meetings or calls.
• Business contacts: name, role, work email and phone, and company, when you or your company give them to us in the course of a business relationship.
• Customer accounts: each user's name, work email and role, account activity, support requests and the company's billing details. Payments are processed by Stripe; we don't store card numbers.
• Job applications: the details in your CV and what you tell us during the selection process.

No analytics tool is active on this website. If we enable one, it will only load after you allow it in the cookie banner, and we will list it in the cookie policy first.

We don't ask for special categories of data (health, beliefs, etc.). Please don't include them in your messages.

When each period ends, we delete the data or keep it blocked, without using it, only for as long as liabilities may arise, as provided in article 32 of the LOPDGDD (Spain's data protection act).

Where we rely on legitimate interest, we have assessed that your interests and rights don't override it: the data is professional, handled in a context you can reasonably expect, and you can object at any time. We don't make automated decisions with legal effects on you or build profiles for that purpose.

We don't sell personal data. We share it only with providers that process it on our behalf, under a contract that requires them to protect it and use it only to provide their service to us:

• Cloudflare: hosting and delivery of this website, and protecting it from abuse.
• Diagnosis form receiver: the form is not connected to any provider yet. When it is, we will name the provider here before we start receiving requests.
• Google (Google Workspace): our email, which we use to receive and answer your messages.
• Kanesh customers: the platform providers listed on the sub-processors page, including Stripe for billing.

We may also disclose data to public authorities, judges and courts where the law requires it, and to professional advisers bound by confidentiality.

Several of our providers are based in the United States, or have a US parent, and may process or access data from outside the European Economic Area even when they store it in the EU:

• For the processing in this policy: Cloudflare (website hosting), Google (company email, Google Workspace) and Stripe (payments; it contracts in the EU from Ireland and transfers to its US parent).
• For the platform: the providers listed on the sub-processors page, which shows for each one whether it is in the US and under which safeguard.

Those transfers rely on:

• the EU-US Data Privacy Framework, for providers certified under it (today including Cloudflare, Google and Stripe): the European Commission found that framework adequate in Implementing Decision (EU) 2023/1795 of 10 July 2023 (GDPR article 45);
• the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (GDPR article 46), for providers that aren't certified or if a certification lapses.

Where a transfer relies on standard contractual clauses, we assess its impact first, taking into account the laws of the destination country, and adopt supplementary measures where needed. We periodically check each provider's certification on the official list (dataprivacyframework.gov).

You can ask us about the safeguards that apply to each provider, and for a copy of them, by writing to [email protected].

You can exercise these rights at any time, free of charge:

• access your data;
• rectify inaccurate or incomplete data;
• erase your data;
• object to processing, in particular processing based on legitimate interest and commercial communications;
• restrict processing;
• portability, to receive your data in a structured, commonly used format;
• withdraw your consent, without affecting the lawfulness of earlier processing.

Write to [email protected] with the subject “Data protection” and say which right you want to exercise. If we have reasonable doubts about your identity, we will ask for the information needed to confirm it. We will answer within one month, which may be extended by two further months for complex requests; if so, we will let you know. To unsubscribe from a commercial email you can also use the link in each message.

If you believe we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority in your country.

Brands that contract Kanesh use it to talk to their own customers on WhatsApp, Instagram, Messenger, email, web chat or phone. In those conversations the roles are different:

• The brand is the controller of its customers' data: it decides what the data is used for and on what legal basis.
• Number Studios SL is the processor: it processes that data only to provide the service and on the brand's instructions, under the data processing agreement, which is part of the terms of service.
• The providers involved are listed on the sub-processors page.

If you wrote to a brand that uses Kanesh and want to exercise your rights over that conversation, contact the brand. If you write to us instead, we will pass your request on to it.

For the account and billing data of platform users, Number Studios SL is the controller, as described in this policy.

We apply technical and organisational measures appropriate to the risk. Those that protect the platform are described on Security & privacy.

This website and Kanesh are aimed at businesses and professionals. We don't knowingly process data of children under 14.

We may update this policy to reflect changes in the law or in our services. We will publish the new version here with its date and, if the change is significant and we have your email, we will let you know.