Last updated: September 30, 2026
This policy explains what personal information Kunjae Security LLC (“Kunjae”, “we”, “us”) collects, why we collect it, and what we do and don’t do with it. We keep our operations simple and collect as little as we can.
The software sends us nothing by default
Kunjae is self-hosted software. It runs inside your own Azure tenant and connects only to your identity provider, the platforms you configure, and your own mail service. It does not send your business data, credentials, or telemetry to us. There is one opt-in exception, described below.
Community Edition (pending release) requires no licence, sign-up, or tenant ID. We collect nothing to let you use it. The rest of this policy applies to Community Edition users only if you contact us.
What We Collect
We collect only what we need to enter into and fulfil our contract with you, and to support you:
- Business contact information. Name, work email, and company, so we can administer your account and licence.
- Licence records, for paid editions. Your Microsoft Entra tenant ID and a customer identifier. Both are written into the signed licence we issue, which binds it to your tenant.
- Registry access, for paid editions. You download the paid-edition image from our private container registry with a pull token we issue to you. The registry records each use of that token.
- Notification email copies, paid editions only, and only if you opt in. If you set
notifications.cc_kunjae_io_on_failure: true, your deployment copies its failure notification emails (a failed rotation, a crashed run, or a failed cleanup) to our support mailbox (debug@kunjaesec.io) through your own mail service. Expiry warnings, licence warnings, and reports are never copied. The copies can contain tenant, platform, application, and account names, certificate thumbprints, error details, and a summary of the last HTTP request to the failing platform. The software is designed to remove secrets before sending, but you are responsible for reviewing what the copies contain. The setting is off by default. Turn it off and the copies stop. Community Edition ignores the setting and never sends these copies. - Correspondence you send us. If you email us with a question, a support request, or a vulnerability report, we keep that correspondence to respond and to keep a record of the interaction.
- Billing information, for paying customers. Stripe processes payments. We don’t collect or store your card details. Stripe handles them under its own privacy policy.
Our website. We don’t use website analytics, tracking cookies, or any other visitor-tracking tools on our site, and it loads nothing from third parties. Our hosting provider processes standard request data, such as IP address, to deliver and protect the site. We don’t use that data to identify or profile visitors.
We don’t collect anything beyond this list. If we ever need more, we’ll ask you directly and update this policy first.
How We Use It
We use your information only to:
- Issue, renew, and administer your licence and registry access
- Diagnose problems from notification copies you’ve opted in to send us
- Respond to questions, support requests, and vulnerability reports
- Send you necessary account, billing, contract, and security communications, including notice of a security incident that affects software we’ve supplied to you
- Keep the records the law requires, such as tax and accounting records
Legal basis (EEA and UK). We rely on performance of our contract with you, on our legitimate interest in supporting and securing the software we supply, on your consent for the opt-in email copy and for bulk communications, and on legal obligation for statutory records.
What We Don’t Do
- We do not sell or share your information. We disclose it only to the service providers listed below, who process it on our behalf, or where the law requires us to.
- We do not send marketing or bulk communications of any kind (including product or connector updates) unless you’ve explicitly opted in. Being a customer, or asking us a question, doesn’t opt you in. Account, licence, and security notices, including notice of security fixes, are not bulk communications and don’t need an opt-in.
- We only email you to respond to an inquiry you’ve raised with us, or for communications necessary to your account, licence, contract, or security.
Service Providers
| Provider | Location | Purpose |
|---|---|---|
| Stripe | United States | Payment processing |
| Proton | Switzerland | |
| Cloudflare | United States | Website hosting and DNS |
| Microsoft Azure | United States | Private container registry for paid editions |
| Notion | United States | Internal documentation and records |
Community Edition images are distributed through GitHub Container Registry. GitHub processes download requests under its own privacy policy. We receive only aggregate download counts.
We are based in the United States. If you are outside it, your information is processed in the United States and in the other locations listed above.
Opting In
To receive product updates, new connector announcements, or other bulk communications, contact us to opt in. You can opt out at any time, in the same way.
How Long We Keep It
- Notification email copies: 30 days from receipt. We keep a copy longer only while it is needed for an open support case, or where the law requires it.
- Everything else: for as long as you’re a customer, then for as long as we need it for legal, tax, or accounting purposes.
We delete your information on request, unless the law requires us to keep it.
Security
We restrict access to your information to the people who need it to serve you, and we store it only with the providers listed above.
Your Rights
You can ask us at any time to see the information we hold about you, correct it, or delete it. You can also withdraw consent you’ve given, including by turning off the opt-in email copy. We respond within 30 days. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.
Business Transfers
If Kunjae is involved in a merger, acquisition, or sale of assets, your information may transfer to the successor. It remains subject to this policy.
Children
Our software and website are for businesses. We don’t knowingly collect information from anyone under 16.
Changes to This Policy
If this policy changes, we’ll update the date at the top of this page. If a change materially affects how we handle your information, we’ll also email current paid-edition customers before it takes effect. Community Edition requires no sign-up, so we give Community Edition users notice through the date on this page and the release notes.
Contact
Questions about this policy or your information: privacy@kunjaesec.io