Privacy notice

Personal data means information about an individual who can be identified from that information, alone or together with other information reasonably available to the relevant party. Project content can contain personal data even when it is described as test material, internal documentation or a business requirement.

For account administration, service security, usage metering, support and our own billing records, we determine the purposes of processing. For content submitted on behalf of an employer or client, that organisation may determine those purposes and we may act as its data intermediary or processor. The role depends on the actual activity and applicable law. Workspace administrators remain responsible for their own instructions, permissions and notices; this does not remove our obligations for processing within our responsibility.

This notice is a disclosure of processing practices, not a waiver of privacy rights and not an enterprise data-processing agreement. Contact us before submitting data that requires a negotiated agreement, a particular processing location or specific regulatory controls.

Account and access data: email address, user ID, verification status, authentication identities where applicable, password authentication records managed by the authentication provider, session tokens and account-related timestamps. Passwords are submitted to the authentication service for verification; stored authentication credentials are handled by that service rather than displayed to workspace members.

Workspace and project data: workspace names, ownership, membership, roles, invitation addresses and tokens, project names, descriptions, requirements, functions, viewpoints, matrix decisions and reasons, test cases, revision or review flags, and output that you save or that is retained to support an AI operation. Data may include material you paste from other tools. We do not need production customer datasets to provide test-design assistance.

Usage and billing data: AI action type, run and request identifiers, token counts, credit reservations, grants, consumption and status; plan, payment, invoice, customer and subscription identifiers where relevant; and records needed to reconcile an existing entitlement. Full card numbers and card security codes are not collected by our application forms or stored in our application database.

Technical and support data: IP addresses and request metadata processed by hosting and security systems, browser or device information supplied with requests, request paths, timestamps and errors; and the topic, reply email, optional name and message you submit to support. Our contact endpoint stores a one-way keyed network fingerprint for abuse prevention, not the raw network address in the contact record. Hosting providers may separately process the raw address.

We receive information directly from you; from a workspace owner or member who invites you or enters content about you; from authentication, payment and email providers when they report the result of a requested action; and from technical operation of the service. Previously imported account, workspace and entitlement records may originate from the earlier Kanten deployment.

If you supply another person’s information, you must have authority to do so, provide required notices and obtain any required permission. Use fictional or de-identified test examples where possible. Do not put passwords, API secrets, government identifiers, full payment details, medical records or other unnecessary sensitive information in requirements, AI prompts or support messages.

We use data to create and verify accounts; maintain sessions; apply workspace permissions; store, retrieve, edit and export projects; produce requested AI drafts; measure usage and prevent duplicate charges; preserve and reconcile entitlements; answer requests; deliver service emails; investigate failures and misuse; protect the service; and meet applicable legal, accounting and dispute-handling requirements.

Where the Singapore PDPA requires consent, we seek it or rely on an applicable form of deemed consent or legal exception only where its conditions are met. We do not treat acceptance of Terms as permission for every unrelated use. Optional AI processing is initiated by an authorised user’s action; choosing not to run AI does not prevent use of supported manual features.

We do not currently sell personal data, use project content for advertising, or operate application-owned advertising profiles. We do not use customer project content to train a Kanten model. A materially different purpose will require an updated notice and any additional consent or other legal steps that apply before that use begins.

The production application is hosted on Vercel, with Supabase for the database and authentication. Requested AI work is sent by the Kanten server directly to OpenAI’s API. Contact messages are recorded in Supabase and sent through Resend to the operator’s Google-hosted support mailbox. The private destination address is not displayed to visitors. Authentication emails are handled through the authentication/email delivery configuration.

Providers receive information relevant to their function. Hosting necessarily processes requests passing through the application; the database stores application records; AI providers receive the context supplied for generation; and payment providers process billing information. Provider privacy notices describe their practices, but do not replace our own responsibilities. Providers may use subprocessors and may act separately for their own account, legal or security purposes.

Depending on the action, a request can contain project or feature requirements, function descriptions, selected viewpoints, existing matrix decisions and reasons, test-case context, output-language settings and instructions. The context can be wider than the text currently selected on screen. Remove confidential or personal details that are not needed before running the action. A workspace member with permission to run AI may cause shared project content to be processed this way.

The current integration uses the OpenAI Responses API with store:false. This setting is not a promise of zero retention: provider abuse-monitoring records and other permitted technical retention may still apply. OpenAI states that API data is not used for model training by default unless the account holder opts in; standard abuse-monitoring retention can be up to 30 days, with exceptions described in its data controls. We do not represent that Kanten has an approved Zero Data Retention arrangement or a particular OpenAI residency commitment.

Kanten stores successful structured results and usage records to return results, support retries and reconcile credits. A short retry cache does not mean the underlying run record is deleted at the same time. AI processing is used to assist test design, not to make a legally significant decision about a person. You and your organisation decide how to use and validate the output.

If you choose to extract requirements from a PDF or screenshots, the selected file contents and optional context are transmitted through our hosting provider to OpenAI for text and visual processing. When extraction starts, Kanten stores original files privately in your workspace using Supabase Storage. You can preview, download and remove source uploads. Removing a source upload removes its original files and saved extraction draft; requirements you saved separately, function/case history and usage records (including cached AI results used for reliable retries) remain under their respective retention rules. Files are transmitted directly in the AI request rather than uploaded to the OpenAI Files API. Extracted drafts and usage records are stored for retries and credit accounting even before you choose to save a draft as your Spec. OpenAI may retain request content under its applicable API terms and account settings; removing files from Kanten does not guarantee immediate deletion of provider logs or backups. Only submit files you are authorised to share for this purpose.

Content is available to people authorised under the relevant workspace roles. Owners control membership; members with appropriate permissions may edit or export content. An export downloaded by a member is a separate copy outside Kanten’s access controls. Removing a member does not recall files that person already downloaded. Do not treat a shared workspace as a private conversation with the operator.

The operator and authorised service providers may access data as needed for support, security, maintenance and legal duties. We may disclose information where required by law or a valid legal process, or where lawfully necessary to investigate abuse or protect rights and safety. Such disclosure is limited to the purpose and applicable legal authority; a general security concern is not permission for unrestricted disclosure.

The current application server region and primary database region are configured in Singapore. This is not Singapore-only data residency. Content delivery, provider support, email delivery and mailbox storage, AI processing, payment services, logs and subprocessors may involve other countries, including the United States and Japan.

Where the PDPA’s transfer limitation applies, we must ensure the required comparable protection through legally available safeguards, such as enforceable contractual obligations, or an applicable lawful exception. Merely listing a foreign provider or using this website does not waive that requirement. We do not promise customer-specific residency, a dedicated environment, or an individually negotiated data-processing agreement unless separately agreed.

We retain identifiable data for the purposes for which it is needed and applicable business or legal requirements, and must stop retaining it or remove its association with individuals when those reasons no longer apply. There is no single retention period for all Kanten records. The relevant considerations include an active workspace, unresolved support or security issues, entitlements, financial record requirements and actual or reasonably anticipated disputes.

Account and project content: retained to provide the account and workspace until deleted through supported controls or an account/content request is handled, subject to legal and operational exceptions. Deleting a row or project does not automatically erase associated accounting records, separate AI-run results, support correspondence, third-party exports or every backup. Contact us if your request is intended to cover those related records too.

Support and security records: retained while needed to answer and evidence requests, prevent repeat abuse and resolve an incident or dispute. Contact submissions are not currently subject to an automatic age-based purge. Provider logs follow the applicable service configuration and terms. Financial records are kept for the applicable statutory period, which for relevant Singapore business records is generally five years measured under the applicable tax rules; that does not require keeping all project content for five years.

Backups and migration copies: may remain separately for recovery, verification and lawful preservation. They are not a second public workspace. Removal from live storage and removal from backups can occur at different times; a universal immediate-erasure or fixed backup-expiry promise is not made. A preservation requirement may delay deletion, and data held solely for that purpose should not be reused for an unrelated purpose.

Use Contact us and select Privacy request. State the account or workspace concerned, what you want us to do and a reply address. Do not include a password or identity document in the initial message. We may request proportionate information to verify identity or authority, particularly before releasing another person’s data or deleting a shared workspace. We may need to direct a request about an organisation-controlled project to that organisation while assisting with our own obligations.

Under the Singapore PDPA, access and correction are subject to statutory conditions and exceptions. Access can include information about use and disclosure within the applicable preceding period. If we cannot respond to an access or correction request within 30 days, we will provide the required written information about when we can respond. A reasonable access fee may apply where legally permitted and will be explained in advance; correction requests are not charged under the PDPA.

You may withdraw consent by reasonable notice where processing relies on consent. We will explain likely consequences and stop the affected processing unless continued processing is legally permitted or required. Essential account or hosting processing cannot be disabled while the same functionality continues unchanged. The PDPA does not create an unrestricted right to erase every record on demand; we nevertheless assess deletion requests against retention duties and other applicable rights.

Other laws may give additional rights, such as objection, restriction or portability, where they apply. We do not require you to waive a mandatory right, complain only through us, or accept a contractual damages cap before making a privacy request. You may contact the relevant regulator, including Singapore’s Personal Data Protection Commission.

Current controls include HTTPS, account authentication, server-side workspace permission checks, database access restrictions, server-only credentials for privileged operations, and abuse controls on selected public endpoints. These controls reduce risk but do not provide end-to-end encryption against the operator or service providers. Do not infer an independent security certification, penetration-test result, recovery guarantee or enterprise security commitment from this notice.

No online system is risk-free. This does not exclude our duty to take reasonable protection measures. If we become aware of a suspected personal-data breach, we will assess and respond to it and make required notifications under applicable law. Under the PDPA, a notifiable breach must be reported to the PDPC as soon as practicable and no later than three calendar days after determining that it is notifiable; affected individuals are notified when required.

Authentication uses technical cookies; language preferences use a cookie and local storage, and some invitation state uses session storage. Kanten uses Vercel Web Analytics for aggregate visitor and page-view statistics on public pages, the guest demo, the viewpoint library and the sign-in/signup page. We also count fixed events for demo use, registration submissions and confirmation-email prompts; these are not proof of email verification. We exclude workspace, project, invitation and authentication-callback pages and remove query strings and fragments from the page URLs we report. We do not send account identifiers, form contents or project content as custom analytics events. Vercel processes request-derived technical information, such as browser/device information, approximate location and eligible referrers, for these statistics. Vercel describes visitor recognition as using a request-derived hash with a visitor-session lifespan of up to 24 hours, without analytics cookies; this is not a 24-hour deletion promise for aggregate reports or other service logs. We do not add advertising pixels or session replay.

Service emails may include verification, recovery, requested support and relevant operational notices. We do not treat a contact submission as a subscription to marketing. You can avoid AI by using manual features, minimise information in submissions, export permitted project records and request account closure through the contact form. The form requires a reply address so we can respond; the operator’s private inbox address is not a public contact field.

Kanten is intended for adults designing and reviewing software tests, not children. The Terms require users to be at least 18 and legally able to use the service. We do not knowingly seek children’s personal data. If you believe a child has supplied personal data, contact us so we can assess access restrictions and appropriate removal. This is a service eligibility rule, not a statement that the PDPA uses 18 as its universal consent threshold.

The website can be accessed internationally, but availability is not a representation that every feature is approved or suitable in every location. This notice is based on the present Singapore-operated service. Mandatory local privacy or consumer protections still apply where the law provides them, including where a law applies despite the absence of targeted marketing.

We will update this notice when the service’s processing practices materially change. The date and version identify the current published description. Where a change needs additional notice, consent or another legal step, publishing an amended page alone does not replace that step.

KASANE PTE. LTD. is the current operator of Kanten. Identifying the company in this notice does not erase responsibility for earlier processing or replace any notice, consent or other step required for a transfer of personal data. If the operator or processing practices change materially, we will update the relevant notices and take the steps required by applicable law. This notice does not grant unrestricted permission to transfer data to another business.