Privacy Policy

1. Who we are

Kandryn is a product of Venakan Info Solutions LLC, incorporated in Ohio, United States. We provide an AI-powered software delivery platform at kandryn.com that connects project management tools with version control systems to assist engineering teams in generating, reviewing, and committing code. This policy applies to the platform and all related services.

2. Information we collect

Information you provide directly

• —Email address and name (via sign-up or OAuth)
• —Authentication credentials managed by Clerk (our auth provider)
• —API tokens for connected services: Jira, Azure DevOps, GitHub, Azure Repos, Confluence, Notion, Anthropic, OpenAI. Stored securely, never included in AI prompts or logs.
• —Work item content: titles, descriptions, acceptance criteria
• —Any information provided when contacting us

Information generated automatically

• —Run metadata: timestamps, status, scores, PR URLs, commit hashes
• —Audit log data: action names, timestamps, IP addresses, user agents
• —Session data managed by Clerk
• —Usage patterns for product improvement

Information from connected integrations

• —Work items from Jira or Azure DevOps
• —Selected source code file sections — at most eight files, and a few thousand characters in total — read at run time from GitHub or Azure Repos. Sent to AI model providers. NOT stored by Kandryn after the run completes.
• —Repository metadata: file paths, branch names, commit hashes

We do NOT read your full repository, production databases, environment variables, GitHub Actions secrets, or any data outside the scope of the connected work item.

3. How we use your information

To provide the Service

• —Execute AI agent runs using your connected credentials
• —Generate code suggestions, security reports, test cases, runbooks
• —Open pull requests and update work item status
• —Send run result notifications via email (Resend)

For security

• —Maintain audit logs for security and compliance
• —Detect and prevent unauthorised access and misuse
• —Enforce our Terms of Service

To improve the Service

• —Analyse usage patterns and performance
• —Diagnose technical problems
• —Develop new features

To communicate with you

• —Respond to support requests
• —Send operational emails
• —Send product updates (if opted in)

To comply with legal obligations.

We do NOT use your source code, work item content, or AI-generated outputs to train any AI model. All AI inference uses Anthropic and OpenAI enterprise APIs, which prohibit training on API customer data.

4. What we share and with whom

We do not sell your personal information.

Sub-processors

Complete list at kandryn.com/trust/#sub-processors:

• —Supabase: database (run metadata, audit logs) — US East region
• —Clerk: authentication and sessions — US region
• —Anthropic: AI inference (work item + selected code) — US region
• —OpenAI: AI inference (same content as Anthropic) — US region
• —Vercel: application hosting — US region
• —Resend: transactional email — US region

Your API credentials are NEVER shared with AI providers or email services.

Business transfers

Information may transfer in an acquisition or merger. We will notify you before your data is transferred.

Legal requirements

We may disclose information when required by law or to protect rights and safety.

5. How long we keep your data

• —Account data: Until account deletion plus 30 days.
• —Run metadata: Indefinitely while account is active; deletable on request.
• —Source code sent to AI: Not stored by Kandryn after run completion.
• —Audit log: 30 days (Free), 90 days (Pro/Max), 365 days (Enterprise).
• —Credentials: Until deleted from Settings or account deletion.
• —Database backups: Up to 30 days.

6. Your rights and choices

• —Access: Request a copy of your data — privacy@kandryn.com
• —Correction: Update account info in Settings at any time.
• —Deletion: Request account deletion — privacy@kandryn.com. Processed within 30 days. Some data retained for legal compliance.
• —Data portability: Request an export — privacy@kandryn.com
• —Objection/restriction: Contact us to object to certain processing.

California residents (CCPA)

Right to know what we collect. Right to delete. Right to opt out of sale (we do not sell data). Right to non-discrimination.

Contact: privacy@kandryn.com

We verify identity before processing requests and respond within 30 days.

7. Data security

Our security measures

• —All data in transit: TLS 1.2 or higher
• —All data at rest: AES-256 disk encryption (AWS RDS). Integration credentials are additionally encrypted with AES-256-GCM at the application layer before storage, under a key held outside the database.
• —API credentials stored per-user, never written to logs
• —Production access restricted to named individuals with MFA
• —Audit log records all significant platform actions
• —Aegis security agent scans AI-generated code before PRs open

No transmission method is 100% secure. If you discover a vulnerability, report it to security@kandryn.com — we respond within 1 business day.

8. Children's privacy

Kandryn is not directed to children under 16. We do not knowingly collect information from children under 16. Contact privacy@kandryn.com to report any inadvertent collection.

9. Changes to this policy

We update this policy as needed. For material changes:

• —We update the Last updated date
• —We notify registered users by email at least 30 days before changes
• —Continued use after the effective date constitutes acceptance

10. Contact us