1. Introduction

Kontaim is an enterprise platform for creating interactive training and engagement experiences. This Privacy Policy explains how we handle data on behalf of the organizations that purchase Kontaim(“Customer”) and the individuals who join their live sessions (“Participants”).

Core principle: data minimization by design. We collect only what is necessary to deliver the service, and we do not require Participants to create accounts or provide personal identifying information to join a session.

For the personal data Customers process using our Platform, the Customer is the “data controller” and Kontaim is the “data processor.” The terms of that relationship are governed by our Data Processing Addendum.

2. Information We Collect

2.1 Customer Accounts

For the people inside your organization who sign in (Facilitators, Admins), we collect:

Account information: email address, name, and a hashed password (or SSO identifier).
Organization metadata: company name, role, and authorized email domain.
Usage data: experiences created, sessions launched, feature usage.
Billing information: for paid subscriptions, billing details are processed by Stripe; we do not store full payment card numbers.

2.2 Live Session Participants (Zero-PII Architecture)

Participants join a live session via a short join code and a display name of their choice. We do not require Participants to create an account.

No name, email, phone number, or employer information is required.
The display name is whatever the Participant types — it may be a real name, nickname, or anonymous string.
The only data tied to a Participant record is the events they generate while playing (responses, scores, completion) and, when the Facilitator has the in-activity AI assistant on and the Participant uses it, an AI-written summary of that help exchange for the Facilitator. The exchange itself is not stored.
When the AI assistant is used, the Participant's typed question, the text visible on their screen and their progress in that activity are sent to the AI provider, with no name, display name or session identifier attached. Facilitators can switch the assistant off for any activity; an organization-wide switch is planned.
Participant records are scoped to the session and visible only to the Facilitator who launched it.

2.3 Automatically Collected Information

Technical data: browser type, device, and operating system. IP addresses are not stored against user records (see Section 5.1).
Cookies: session cookies for authentication and preferences (see Section 5).

3. How We Use Information

We use collected information to:

Provide, secure, and improve the Platform.
Process subscriptions and billing.
Communicate operational updates about Customer accounts.
Detect and prevent fraud, abuse, and security incidents.
Comply with legal obligations.

We do not:

Sell personal information.
Use Participant data for advertising or marketing.
Share Customer data with third parties for their own marketing.
Use Customer content to train AI models without explicit, separate authorization.

4. Customer Content

Activities, experiences, and session data created by a Customer (“Customer Content”) belong to the Customer. We process Customer Content solely to provide the service. The terms governing this processing — including subprocessors, security measures, and breach notification — are set out in our Data Processing Addendum.

5. Cookies & Analytics

We use cookies for:

Essential cookies: required for authentication and core functionality.
Preference cookies: remember user settings (theme, language).
Analytics cookies: help us understand Platform usage to improve the service.

We do not use cookies for cross-site advertising or behavioral retargeting.

5.1 Privacy-Hardened Analytics

We use PostHog for product analytics, configured in a privacy-hardened mode:

No IP collection: IP addresses are disabled at the SDK level and never stored.
Anonymous identifiers only: Users are identified by opaque database UUIDs — not by name, email, or username.
Masked session replays: all form inputs and screen text are masked as asterisks; copy-paste content is never captured.
Participant data protection: for live-session Participants we send only role-level signals; no display names, organization names, or content text.

This configuration ensures that even in the event of a downstream provider incident, no personally identifiable information about Participants could be exposed — because it was never transmitted.

6. Data Security

We apply enterprise-grade security controls:

All data encrypted in transit (TLS 1.2+) and at rest (AES-256 on managed Postgres).
Passwords hashed with bcrypt. Single sign-on (SAML/OIDC) is planned for enterprise plans and not yet available.
Least-privilege access: production data is reachable only through row-level security policies and a small set of server functions that check the caller's role.
Dependency monitoring with automated update alerts. An independent penetration test is planned; until it is complete we answer security questionnaires on request.

For our full security posture, including subprocessor list and breach-notification commitments, see the Security & Compliance page.

7. Data Retention

Active accounts: data is retained while the Customer subscription is active.
Deleted accounts: personal data is deleted within 30 days of account deletion, except where retention is required by law.
Participant records: retained alongside the session they belong to, governed by the Customer's retention configuration.
Backups: rolling encrypted backups are purged on a 35-day cycle.

8. Your Rights (GDPR / CCPA / Equivalent)

Depending on your jurisdiction, you (or, for Participant data, the relevant Customer) may have the right to access, correct, delete, port, or object to processing of personal data.

If you are a Customer user (Facilitator, Admin), contact us directly to exercise these rights.
If you are a Participant in a session, direct requests to the Customer organization that hosted the session — they are the data controller.

9. International Transfers

Data is primarily stored in Canada. Where Customer data is transferred to processors in other jurisdictions (e.g., AI providers, payment processors), we rely on Standard Contractual Clauses and equivalent transfer mechanisms. The current subprocessor list is in our DPA.

10. Third-Party Services

We rely on the following subprocessors:

Stripe — billing and payment processing.
Supabase — database and authentication infrastructure (hosted on AWS Canada).
Vercel — hosting and content delivery.
PostHog — product analytics, in privacy-hardened mode (see 5.1).
AI providers (Google, OpenAI, Anthropic) — generation requests are processed through their business APIs, whose published terms exclude API inputs from model training. We hold no separate enterprise agreements beyond those terms.

Each subprocessor has its own privacy policy. Our configuration prioritizes privacy and minimizes data exposure. The authoritative subprocessor list lives in the DPA.

11. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email to account owners, or via a prominent notice in the Platform. The “Last updated” date at the top reflects the most recent revision.

12. Contact

Questions about this Privacy Policy or our data practices? Reach us at support@kontaim.com.

Privacy Policy