Privacy Policy

Effective date: September 2026

Kanarytale connects to your HubSpot or Salesforce account, reads a minimized set of records, and writes a plain English report of what marketing spent and earned. This policy explains what we collect, why, how we protect it, and how you can delete it.

What we collect and why

Account information

When you sign in, we store your login email and your organization, provided through our sign-in provider. We use this only to sign you in and to keep your data scoped to your organization.

CRM data you authorize us to read

When you connect HubSpot or Salesforce, we read only the fields the report uses, and we store only those fields:

• Campaigns: name, channel, cost, and budget.
• Companies: name, industry, and employee count.
• Contacts: job title and traffic source only, plus a one way hashed key derived from the email address so a record can be matched across systems. We do not store contact names, email addresses in readable form, phone numbers, or postal addresses.
• Deals and opportunities: name, amount, stage, close date, and source.
• Leads: source.
• Campaign influence, email and form engagement counts, and traffic sources.

Fields we never store include phone numbers, postal addresses, notes, activity history, attachments, and custom fields. The report cannot use what we do not store, and what we do not store cannot leak.

Uploaded spend files

If you upload an advertising spend file, we store the campaign names and costs it contains so the report can compare spend against results.

Reports and operational records

We keep the reports we generate for you, and we keep operational records such as connection status, sync and generation status, and error summaries. Error summaries are sanitized and never contain secrets or personal data.

CRM access is read only and authorized by you

We request read only access to your CRM. We never write to, change, or delete anything in your CRM. You authorize each connection, and you can revoke it at any time by disconnecting in the dashboard.

How we use your data

We use your data only to produce your marketing reports and to operate the service for you. We do not sell your data. We do not use it for advertising.

How we protect your data

• Access tokens for your CRM are encrypted at rest using AES-256-GCM. They are never displayed to you and never written to our logs.
• Every record is scoped to your organization, so one customer can never see another customer's data.
• Data travels over encrypted connections (HTTPS), and our database provides encryption at rest and automated backups.

Sub-processors

We rely on a small set of service providers to run Kanarytale. Each processes only what it needs for its function:

• Railway: application hosting and the PostgreSQL database, in the United States West region.
• Clerk: authentication and sign-in.
• Anthropic: generates the written report from your data.
• Resend: delivers report emails.
• Cloudflare: domain name service and email routing.

Data retention and deletion

• We keep your CRM data while a connection is active, so we can generate your reports.
• Disconnecting a CRM in the dashboard deletes that CRM's stored data and revokes its access token.
• Deleting your account removes all of your data, including your reports, and revokes any remaining tokens.
• Reports are kept as your business records while your account is active, and are removed when you delete your account.
• Our database keeps automated backups for a limited period. Deleted data ages out of those backups over the normal backup cycle.

To delete your data or your account, use the dashboard or email support@kanarytale.com.

No selling, no advertising, no tracking on this site

We never sell personal data, and we do not run advertising. This marketing website sets no cookies and makes no third party requests. The application at app.kanarytale.com uses a session cookie from our sign-in provider so that you stay signed in. That cookie is used only for authentication.

Your rights

You can access, correct, export, or delete your data. To make a request, email support@kanarytale.com and we will respond promptly.

Children

Kanarytale is a product for businesses. It is not directed to children and is not intended for personal use.

Where your data is processed

Your data is processed and stored in the United States.

Changes to this policy

If we change this policy, we will post the new version on this page and update the effective date above.

Contact

Questions about privacy? Email support@kanarytale.com.