Who is responsible
Kenstow is operated by Arcan Dinc
38 Porter Road, Basingstoke, RG22 4JS, United Kingdom
support@kenstow.com
For the account details you give us (your email address and your company’s name) we are the data controller. For the documents and other content your company puts into Kenstow, your company decides what is stored and why. We process that content on your company’s behalf, under the data protection terms in our Terms of service.
What we collect
| Information | Examples | Why |
|---|---|---|
| Account details | Email address, password (held in hashed form by our sign-in provider), company name, your access level | To create and run your account |
| Your company’s content | Uploaded files, document titles and numbers, text read from documents, filing categories, cases, questions, discussion messages, proposed and approved revisions, recorded decisions, notes | To provide the service |
| Usage records | Which action was run (for example a question or a case), when, by whom, how large it was, and a short label such as the question or file name | To show your monthly usage and keep the service within each plan’s allowance |
| Billing information | Company name, billing address, VAT number if you give one, your plan and its payment status, and your invoices. Card details are entered on Stripe’s page and held by Stripe, never by us | To take payment, issue invoices and keep our accounts |
| Technical information | IP address, browser type and request details, kept by our hosting providers’ systems | To run and protect the service |
| Messages to us | Anything you send to support@kenstow.com | To reply to you |
Documents may contain personal information about your colleagues, customers or suppliers, for example names on approval records. Please upload only what you need.
How we use it, and why we are allowed to
- To provide the service you signed up for (performance of a contract).
- To keep Kenstow secure, prevent abuse and measure usage fairly (our legitimate interests).
- To keep the records the law requires, such as tax records (legal obligation).
We do not sell personal information, we do not use it for advertising and we do not send marketing emails. The emails we send are about your account, such as sign-up confirmation and password reset.
How your documents are analysed
To find the documents a request affects, answer a question or write a proposed change, Kenstow sends the request and short excerpts of the relevant documents to a language model provider, Anthropic. Only the excerpts needed for that request are sent, never a company’s whole library.
- Under Anthropic’s commercial terms (checked 12 October 2026), Anthropic may not train its models on customer content submitted through the service, and it handles that content under its data processing addendum.
- Anthropic’s published default is to delete the inputs and outputs of API requests from its systems within 30 days. It may keep them longer where the law requires, or to enforce its usage policy.
- Kenstow does not train or fine-tune any model on your documents. Each company’s content and recorded decisions are kept separate, and nothing learned from one company is used for another.
- A proposed change to a document never takes effect without a person’s approval.
Who else receives information
Only the companies listed with their purpose and location on the sub-processors page, which includes the companies that send our emails and route our mail. We do not share information with anyone else, except where the law requires it.
Transfers outside the UK
Your workspace is stored with Supabase in London, and the application runs in London. Several of the companies we use are US companies or process some information in the United States, for example Anthropic (request excerpts), Stripe (payments), Resend (sign-up emails), Cloudflare (domain name service and support email) and Vercel (hosting). Anthropic’s data processing addendum includes the standard contractual clauses and the UK Addendum for such transfers. We send personal information outside the UK only where UK law allows it, using the UK–US data bridge (where the company takes part in the UK Extension to the EU–US Data Privacy Framework), standard contractual clauses together with the UK Addendum issued by the Information Commissioner, or another route that UK law allows. What each company handles is shown on the sub-processors page. To ask for a copy of the safeguards, write to support@kenstow.com.
How long we keep information
| Information | How long |
|---|---|
| Account details and your company’s content | While your company’s account is open. An owner can delete the company and all its data at once in Settings, Account. If you ask us to do it, we delete within 30 days. |
| A plan that ends | If your plan ends and you do not delete your company, your content stays readable for 30 days from the end of the period you paid for and is then deleted. |
| A document you delete | Removed from your library when you delete it. |
| Revision history and approval records | They are your company’s document control records, so they are kept while the account is open and deleted with it. Ask us for a copy before you close the account. |
| Usage records | While the account is open, because the usage page and the monthly allowance depend on them. Deleted with the account. |
| Copies in our providers’ backups | Our database provider keeps daily backups for 7 days. A copy of deleted information can remain in them until they are overwritten, which is within 7 days. Until then it is protected and not used. |
| Billing records | At least 6 years after the end of the tax or financial year they relate to, as UK tax record-keeping rules require. |
| Messages to us | 2 years after the last message. |
You can delete your own sign-in at any time in Settings, Account (or ask us to). Your company and the work you did stay. Approval records that your company needs for document control keep your email address as the approver’s name, because they are your company’s records. The only owner of a company must first make someone else an owner, or delete the company.
Your rights
You can ask us for a copy of your personal information, ask us to correct or delete it, ask us to restrict how we use it, ask for it in a portable form, and object to our use of it. Write to support@kenstow.com. We reply within one month. If your information is inside a company’s workspace, we may need to pass your request to that company, because it decides what is stored.
If you are not happy with how we handle your information, please tell us first: write to support@kenstow.com. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk at any time.
Cookies
Kenstow uses only the cookie it needs to keep you signed in. See the cookie notice.
Changes
When we change this notice in a way that matters, we update the date at the top and tell account owners by email.