Privacy.
By design.

Portami, operating Kanna.one, is the intended controller of personal information received for its business. Address: I. Struge 4, 10000 Zagreb, Croatia. OIB: 74372972622. The full registered legal name/form is awaiting confirmation. For privacy questions or rights requests, contact hello@kanna.one.

This notice covers the Kanna website and brief preview. It does not govern websites we create for other businesses, which need their own notices and data-processing arrangements.

Your brief may contain a business name, description, audience, goals, page choices, references, domain information and selected file names. These can include personal information if you enter it. Answers are held in the open page and are saved between visits only if you choose “Save my progress on this device” in the questionnaire. When you continue to test Checkout, your contact details and brief are sent to the server and stored in Supabase. Selected file contents are uploaded to private Supabase Storage before the Stripe redirect. A pending order is stored even if you cancel payment. Merely selecting files does not upload them.

Vercel hosts the website and API and may process connection information such as IP addresses and requested paths in its security and operational logs. Supabase stores briefs, private files, project access hashes and payment references. Stripe receives your email, ordered service, quantities, amount and an order reference for hosted test Checkout. We do not send your brief answers or uploaded files to Stripe.

If you choose an email link and send a message, your email provider sends the address, message and attachments through email systems. Please send only information needed for your enquiry, not passwords, card details or sensitive information about you or others.

For a live service, necessary enquiry, quotation and project administration may rely on steps requested before a contract or performance of that contract. Required accounting records rely on legal obligations. Proportionate security and legal-claims handling may rely on legitimate interests after assessing the effect on your rights.

Optional browser draft storage relies on your choice. Optional analytics and marketing technologies will require a separate valid consent where required. Refusal will not prevent you from using the brief. We will not treat accepting service terms, scrolling or inactivity as consent to advertising.

These bases must be confirmed against the actual live processing before launch. We do not use this preview for automated decisions with legal or similarly significant effects.

Google Analytics is installed on the public homepage and legal pages with analytics and advertising storage denied by default. Analytics cookies are enabled only after you choose “Accept analytics”; advertising cookies remain disabled. Necessary, HttpOnly cookies protect the requested service: kanna-checkout-* authorizes a pending order for up to 7 days; kanna-room authorizes private project access for up to 7 days; kanna-admin* maintains the internal admin session according to Supabase session settings. These are not advertising identifiers. Session storage kanna-test-checkout temporarily retains the current order reference and brief for Checkout retries/cancellation, and is removed on success, reset or tab closure. Local storage is used as follows:

• kanna-storage-preferences-v1: remembers your draft-storage and analytics choices and their expiry. The choice lasts 180 days; after expiry the site asks again. This record contains no advertising identifier.
• kanna-project-v1: stores your brief answers, selected file names, price and progress only when “Save my progress on this device” is enabled. It remains until you clear the draft, withdraw that preference, clear site data or your browser removes it. It has no automatic draft-expiry timer.
• kanna-ga4-checkout-* and kanna-ga4-purchase-*: consent-gated deduplication markers containing a pseudonymous order fingerprint, not contact details or private links. These prevent repeated event submissions in this browser. They remain until browser/site data is cleared; no automatic expiry is set. They are not read or written while analytics consent is denied.

Use Cookie settings on any page to disable optional storage, or use the save-progress checkbox in the questionnaire to enable or disable draft saving. “Essential only” disables optional draft saving and removes the saved draft from this browser; an already open questionnaire keeps its current answers in memory until you leave or refresh it. “Clear draft & start again” resets the questionnaire. Browser settings can also delete this site’s stored data.

People with access to your browser profile may be able to read a saved draft. Avoid saving confidential information on shared devices. If storage is blocked, the form can still be used during the current page visit, but it may not be recoverable after leaving.

Portami uses Google Analytics 4 for basic page measurement on the public homepage, Privacy Policy and Terms pages at kanna.one and www.kanna.one. Google scripts remain excluded from client subdomains, admin pages, project rooms and secure previews. With analytics consent, package selection, a genuine Checkout start and a server-verified successful order are measured using catalogue items, EUR totals and a pseudonymous order fingerprint. Questionnaire and receipt pages pass only those allowlisted fields to an empty same-origin measurement frame; Google scripts do not run against the private form or receipt content. Page addresses exclude query strings and fragments, and private-page referral paths are not sent. Brief answers, file names and email addresses are not included.

Consent Mode currently defaults analytics storage, advertising storage, advertising user data and advertising personalization to denied. Before a choice, or after “Essential only”, Google may receive cookieless measurement requests, but the tag does not set analytics cookies. “Accept analytics” grants analytics storage only. Your explicit choice is remembered for 180 days in the existing preference record. You can withdraw it using Cookie settings → Essential only. Older draft-only records are not treated as analytics consent; the same popup asks for a choice once. Google Signals and advertising personalization are disabled in this installation. Event-data retention is managed separately in Google Analytics. See Google’s Consent Mode documentation.

Stripe provides hosted Checkout in test mode. No real money is charged. Enter only Stripe test card details, not real card numbers. Stripe may process submitted test billing details, device and fraud-prevention information under its applicable roles and terms. Kanna stores the Checkout Session and Payment Intent references, amount and status, not card numbers. Payment details should be entered only into the secure payment flow, not this brief. See Stripe’s Privacy Policy.

Marketing tools have not been selected. This preview has no advertising pixels, retargeting or marketing-cookie category enabled. We will identify any future providers and purposes and request any required separate consent before enabling them. A general agreement to “future marketing” is not requested.

Authorised Kanna staff, Vercel (hosting/API), Supabase (database, authentication and private file storage), and Stripe (test Checkout) receive information necessary for their role. Disclosures may also be required by law. Actual providers and their roles must be recorded before that processing starts. This preview does not sell brief information or share it for cross-context advertising.

Google and Stripe are international providers. Before enabling relevant transfers outside the EEA, Portami must verify the applicable transfer mechanism, such as an adequacy decision or appropriate contractual safeguards, and any necessary supplementary measures. This draft does not assert that a particular provider setup or transfer has already been assessed.

Browser retention is described above. Portami’s final schedule for email enquiries, accepted projects, invoices and legal claims must reflect the actual service and applicable Croatian retention duties; those periods are not yet confirmed. Data should be kept only for the purpose and period justified, then deleted or anonymised, unless lawful retention is required.

The local draft is not encrypted by this application and is not backed up to a Portami account. Project files are private; project access uses random tokens and internal administration requires authentication. Pending test orders and uploaded files are not automatically deleted by this version. Contact hello@kanna.one to request removal. Provider retention, backup/deletion procedures and incident handling must be finalised before real orders. No website or storage system can promise absolute security.

Where the GDPR applies, you may request access, correction, erasure, restriction or portability, and object to processing where applicable. Rights depend on the circumstances and legal basis. You may withdraw consent without affecting processing that was lawful before withdrawal.

Email hello@kanna.one. A response is normally due within one month; where a lawful extension is needed, you must be informed within that first month. Proportionate identity verification may be required. Portami cannot remotely read or erase a draft held only in your browser; you can remove it through the controls described above.

You may complain to Croatia’s Agencija za zaštitu osobnih podataka (AZOP), or another competent supervisory authority, including where you live or work in the EEA. Contacting us first is not a condition of that right.

We will revise this notice when the service, providers or purposes change. Material new optional processing will not be activated merely by changing this page; any necessary notice and consent must come first. The update date appears above.