Privacy Policy

This Privacy Policy describes how WALLS Entertainment Group Inc., doing business as Kenoo ("Kenoo," "Company," "we," "our," or "us"), collects, uses, and shares personal information when you visit kenoo.io, create an account, or use the Kenoo business operating system, websites, mobile applications, and related services (collectively, the "Services").

Kenoo includes connected product areas such as the marketing site, authentication portal, Settings, CRM, Projects, Calendar, Workflows (email campaigns and automation), Mail, Contracts, PartnerHub, Finance, Wallie (AI assistant and mobile app), AdPilot (ads), Health, Admin, the Kenoo API and tracking script, the Kenoo connector for AI assistants (MCP), and related APIs. Feature availability depends on your workspace, plan, and permissions.

This Policy applies to personal information we process as a provider of the Services. For Customer Content you and your organization store in Kenoo (such as CRM contacts, emails, deals, projects, invoices, campaign audiences, website activity collected with the Kenoo tracking script, and files), your organization is typically the data controller (or equivalent) and Kenoo acts as a processor or service provider, except where we process information for our own purposes described in this Policy (for example account administration, security, billing, and product analytics).

If you are an end user invited into a customer workspace, that organization may control access to your workspace data. If you receive email from, or visit the website of, a business that uses Kenoo, that business controls your information and its own privacy notice applies. We may redirect privacy requests about that data to the relevant organization.

We collect information you provide directly, information generated through your use of the Services, information from third-party services you choose to connect, and information from service providers that help us operate Kenoo.

• Account and profile information: name, email addresses (work and personal), phone number (including mobile numbers you provide for optional SMS notifications), date of birth, address, timezone, country or tax region, avatar, LinkedIn or other profile links, role, and authentication identifiers (including identifiers from Google sign-in if you use it).
• SMS notification preferences: whether you have opted in to Kenoo text notifications, the phone number associated with that consent, consent and opt-out timestamps, and related audit records needed to honor STOP requests and legal requirements.
• Organization and membership data: workspace name, slug, website, description, contact details, icons, member invitations (including invitee email addresses and invitation status), and app access permissions.
• Workspace and Customer Content: CRM companies, people, leads, deals, pitches, sequences, notes, deliverables, commissions, contracts, documents, invoices, vendor and billing details (including optional business identifiers such as VAT or chamber of commerce numbers), time entries and hourly rates, projects, tasks, calendar events, attendees, messages, Wallie chat threads, writing profiles, and similar business records you create or import.
• Workflows and campaign data: contact lists and audiences, email templates and campaign content, sender identities, send schedules and sending-window settings, delivery, bounce, and complaint status, link clicks, unsubscribe and suppression records, and the trigger events and conditions you configure.
• Website activity collected with the Kenoo tracking script: when a Kenoo customer installs kenoo.js on its website, we collect, on that customer's behalf, page views and page URLs, referrers and campaign (UTM) parameters, a randomly generated visitor identifier and Kenoo click ID stored in first-party cookies, browser and device information, custom events and purchase details the customer sends, and identity details (such as email, name, or customer ID) the customer chooses to attach.
• Communications content: email bodies, headers, recipients, attachments, drafts, and thread metadata when you connect Gmail or use Kenoo email features; support and sales messages you send us.
• Financial and accounting information: when you connect bank or card accounts to Finance through Plaid, account names, types, the last four digits of account numbers, balances, and transaction history (dates, amounts, descriptions, merchant names, and categories); when you connect a Stripe account to Finance, balance transactions such as charges, refunds, fees, and payouts; plus chart of accounts, journal entries, categorization rules, statement imports, and reconciliation records you create.
• Invoice and payout information: invoice details, recipient legal name and type, bank account details, addresses, and KYC-related status fields processed through Wise or similar payout providers. Subscription payments are processed by Stripe; we do not store full payment card numbers on our servers.
• Advertising data: Meta and Google Ads account identifiers, campaign and creative metadata, budgets, spend, performance metrics, and automation settings when you connect AdPilot.
• Health and fitness data (optional Health module): sex, height, weight, date of birth used for derived metrics, activity level, nutrition logs, meal photos and generated meal images, saved meals and allergen preferences, goals, workout activities, and metrics you sync from Strava or, through the Kenoo iOS app, Apple Health (such as steps, heart rate, resting heart rate, blood oxygen, sleep, body weight, workouts, exercise and stand time, and mindful minutes).
• Voice and media: audio you submit for transcription or speech features in Wallie, plus generated audio responses where applicable.
• Technical and usage data: IP address, device and browser information, app version, pages and features used, session and analytics events, approximate location derived from IP, and security logs including login history.
• Enrichment and research data: business contact and company information obtained from enrichment providers (such as Apollo), web search providers, or public web and social profile research tools you or your workspace enable.
• Integration credentials: OAuth access and refresh tokens, API keys, and connection metadata for services you authorize (for example Google Workspace APIs, Google Ads, Meta, Slack, GitHub, Strava, Plaid, Stripe Connect, Wise, and AI assistants connected through the Kenoo MCP connector), and Kenoo API keys you create.
• Slack integration data: Slack workspace or team identifiers and names, OAuth connection and authorization metadata, selected public or private channel identifiers and names, channel membership or privacy metadata needed to deliver notifications, and Slack user identifiers, names, and email addresses used to map Slack users to Kenoo users for mentions. Kenoo may also retain delivery and configuration metadata for Slack notifications.
• GitHub integration data: GitHub App installation identifiers, the account or organization and repositories you grant access to, repository names and default branches, branches Kenoo creates or links for your projects and tasks, and the status of related pull requests.

We collect personal information through registration and profile forms; workspace activity; OAuth and API connections you authorize; the Kenoo tracking script and tracked email links; payment and payout providers; enrichment and search providers; cookies and similar technologies; device health frameworks you grant access to in our mobile apps; and, where applicable, background sync jobs, webhooks, and admin provisioning tools used by authorized administrators.

We use personal information to operate, secure, and improve Kenoo, and to communicate with you about the Services.

• Authenticate users, enforce MFA, manage sessions, send workspace invitations, and control app and workspace access.
• Provide product features across CRM, projects, calendar, workflows, finance, ads, health, AI assistance, settings, and admin tools.
• Sync and process connected email, calendar, ads, fitness, code repository, and payout accounts as you configure them.
• Send outreach, sequences, campaigns, invoices, notifications, and other communications you initiate through the Services, and honor unsubscribe and suppression requests.
• Attribute website visits, events, and purchases to the emails and campaigns that led to them, and report campaign performance to the workspace that sent them.
• Plan and schedule tasks on your calendar when you use auto-scheduling, including estimating how long tasks will take.
• Send automated transactional and operational SMS messages you opt in to receive (for example account, workflow, application, and user-configured alerts such as AdPilot performance alerts).
• Process subscriptions, invoices, payouts, and related billing or treasury activity.
• Detect, prevent, and investigate fraud, abuse, spam, bot traffic, and security incidents.
• Analyze product usage to improve reliability, performance, and design.
• Provide customer support and respond to sales or partnership inquiries.
• Send product updates or marketing communications where permitted by law; you can opt out of marketing at any time.
• Comply with legal obligations and enforce our Terms of Service.

If you connect Google services, Kenoo may access Google user data according to the OAuth scopes you approve. Depending on the integration, this may include Gmail (reading, sending, modifying, and organizing email), Google Calendar (reading and writing events, including Google Meet details), Google Contacts needed for messaging and scheduling, and Google Ads account data needed for AdPilot (accessible customer accounts, campaign structure, budgets, and performance metrics).

We use Google user data only to provide and improve user-facing features that are apparent in the Kenoo interface, such as inbox sync, sending or scheduling email, CRM email sequences, invoice delivery, calendar sync, task auto-scheduling (reading your availability and writing scheduled task blocks to your calendar), AdPilot reporting and spend automation you enable, and related product features. We do not sell Google user data. We do not use Google user data for serving advertisements unrelated to the advertising accounts you connect. We do not allow humans to read Google user data unless you give us permission for support, it is necessary for security or legal compliance, or the data is aggregated and anonymized for internal operations.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. You may disconnect Google integrations in Settings (or AdPilot settings for Google Ads), after which we will stop new syncing and delete or de-identify stored Google tokens and related synced data in accordance with our retention practices, except where retention is required for security, legal, or accounting purposes.

If you connect a Slack workspace, Kenoo uses the OAuth permissions you approve to identify the connected workspace, list channels available to the installing user, list Slack users (including their names and email addresses) when needed to map them to Kenoo users, post Kenoo notifications (for example task, blocker, and project updates) to channels you select, and format authorized Slack mentions. Kenoo does not use the Slack connection to read or store Slack message history, and it does not post to channels unless an authorized user configures that channel for a Kenoo notification.

Slack connection data is associated with the Kenoo account or organization that authorized the connection. Workspace administrators and other authorized users may configure notification rules, channel destinations, and Kenoo-to-Slack user mappings according to their permissions in Kenoo and Slack. Slack may separately record the installation and activity of the Kenoo app under its own policies.

You can disconnect Slack from Kenoo at any time. When you disconnect, Kenoo stops using the connection for new API requests and requests revocation of the Slack authorization where supported. We delete or de-identify the associated Slack token and connection data in accordance with the retention practices below, subject to security, legal, accounting, and backup requirements.

If you install the Kenoo GitHub App, Kenoo accesses only the repositories you select during installation, using the permissions you approve, to list repositories and branches, create or link branches for your projects and tasks, and show the status of related pull requests. Kenoo does not use the GitHub connection to copy or store your source code. You can change repository access or uninstall the app in GitHub at any time.

Kenoo includes AI features in Wallie and across other apps (for example CRM search and email assistance, project scope generation, task duration estimates for auto-scheduling, and meal image generation in Health). When you use these features, prompts, selected workspace content, chat history, tool results, and, for voice features, audio may be processed by Kenoo and by third-party model providers such as OpenAI, Anthropic, or Perplexity, and by our Wallie backend infrastructure.

AI features are designed to support your team's work within Kenoo. We do not sell your Customer Content as training data to unrelated third parties. Where we use third-party model providers, we require contractual protections consistent with this Policy and applicable law. You should avoid submitting sensitive personal information to AI features unless necessary for the task.

You can connect third-party AI assistants (such as Claude or ChatGPT) to Kenoo through the Kenoo MCP connector. When you authorize a connection, the assistant can read and change Kenoo data (for example CRM, Projects, AdPilot, and Health records) on your behalf, within your permissions and the workspaces you select. Information the assistant retrieves from Kenoo is then processed by that assistant's provider under its own terms and privacy policy, not this Policy.

You can revoke connected assistants and Kenoo API keys at any time. Treat API keys and connector access like passwords; actions taken with them are treated as actions by your account or workspace.

Our CRM may store personal information about your customers, leads, and other third parties that you import, capture from email, or enrich through providers such as Apollo or public web research. You are responsible for ensuring you have a lawful basis to collect, enrich, store, and contact those individuals, including compliance with anti-spam and telemarketing laws.

Outbound email sequences, scheduled messages, and similar outreach tools process recipient contact details and message content as configured by your workspace.

Workflows lets your workspace send automated and one-off email campaigns to its own contacts. Kenoo processes recipient email addresses, names, and other fields your workspace uses to personalize messages, and delivers those emails through Amazon Web Services (Amazon SES). We record delivery, bounce, and complaint events to operate sending and protect deliverability.

Links in campaign emails may be routed through a Kenoo redirect that records the click (including time and browser information used to filter automated clicks) and adds a Kenoo click ID and campaign (UTM) parameters to the destination link. Campaign emails include an unsubscribe link and unsubscribe header; when a recipient unsubscribes, Kenoo records the request and suppresses future campaign email to that address from that workspace.

If you received a campaign email from a business that uses Kenoo, that business decides who receives its email and controls your information. You can unsubscribe using the link in the email, or contact the sending business directly.

Kenoo customers can install the kenoo.js script on their own websites to measure visits and attribute purchases to their email campaigns. The script sets first-party cookies on the customer's website: a random visitor identifier (kept for up to one year) and, when a visitor arrives from a tracked email link, a Kenoo click ID (kept for seven days). It sends page views and the events the customer configures to Kenoo, which stores them in that customer's workspace.

Kenoo processes this information on behalf of the customer that installed the script. We do not use it to build profiles across different customers' websites, and we do not sell it or share it with advertising platforms. Customers are responsible for providing any notices and obtaining any cookie or tracking consent required on their websites; kenoo.js supports a consent mode that sends nothing until the site grants consent.

Kenoo Finance uses Plaid Inc. ("Plaid") to connect the bank and card accounts you choose. When you connect an account, you sign in to your financial institution through Plaid's interface; Kenoo never receives or stores your bank username or password. By connecting an account, you authorize Plaid to collect data from your financial institution and share it with Kenoo, and you agree to Plaid's processing of your information in accordance with the Plaid End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy).

Through Plaid, Kenoo receives account names, types, masked account numbers, balances, and transaction history for the accounts you connect, and it keeps them up to date through periodic and Plaid-initiated syncs. You can also connect a Stripe account through Stripe Connect so that Kenoo can read your Stripe balance transactions (such as charges, refunds, fees, and payouts). Although Stripe may grant Kenoo broader permissions, Kenoo only reads this data and does not create charges, refunds, or transfers in your Stripe account.

We use this financial data only to provide Finance to you and your workspace: importing transactions, suggesting categories for your review, recording the entries you approve in your books, reconciling accounts, and producing reports. Category suggestions are not posted to your books until a person in your workspace confirms them. We do not sell financial data, do not use it for advertising, and do not share it with third parties except the service providers that help us operate Finance. Plaid and Stripe access tokens are kept in restricted storage that only Kenoo's servers can read, encrypted in transit and at rest.

You can disconnect a bank or Stripe connection at any time in Finance settings. When you do, we revoke the connection with Plaid or Stripe, delete its access tokens, and stop collecting new data from it; transactions and entries already recorded in your books stay in your workspace until you delete them or close your account, subject to Section 20.

Separately, invoice and payout features in other Kenoo apps may share bank and KYC-related details with Wise or other payout providers to create and manage recipients and transfers.

Invoice features may generate shareable links or tokens that allow recipients to view or download invoice PDFs. Anyone with the link may be able to access that invoice, so treat share links as confidential.

If you connect Meta or Google Ads accounts to AdPilot, we process ad account identifiers, campaign and creative metadata, budgets, spend, performance metrics, and automation settings you configure. We may call Meta Marketing APIs and the Google Ads API (using OAuth credentials you grant plus Kenoo's developer credentials where required) to list accessible accounts, sync insights, and execute or preview budget and campaign actions you authorize.

AdPilot is designed for operators and authorized client workspaces. Connected advertiser data is stored as Customer Content within the Kenoo workspace that completed the connection, subject to that workspace's access controls.

The Health module is optional. If you use it, we may process health, biometric, nutrition, and fitness information you enter, photograph, or sync from providers such as Strava or Apple Health. This information can be sensitive. We use it only to provide Health features you enable (for example activity tracking, nutrition logging, goals, and analytics) and related security and support.

Apple Health: if you grant the Kenoo iOS app access to Apple Health, we read only the data types you approve and use them only to provide Health features to you. We do not use Apple Health data for advertising or marketing, we do not sell it, and we do not share it with third parties except service providers that help us deliver the Health features. You can change or revoke access at any time in the iOS Health app or Settings.

You can disconnect Strava, revoke Apple Health access, or stop using Health features in the product. Do not use Health features for medical diagnosis or treatment; Kenoo is not a medical device or healthcare provider.

If you opt in to SMS notifications in Kenoo Settings, we use the mobile phone number you provide to send automated transactional and operational text messages from Kenoo and Kenoo applications (such as AdPilot). These messages may include account notifications, workflow notifications, application activity alerts, and user-configured alerts (for example advertising-performance or threshold alerts).

SMS is optional and is not enabled merely because a phone number is stored on your profile. Message frequency varies based on your notification settings and account activity. Message and data rates may apply. You can disable SMS in Kenoo Settings at any time, or reply STOP to opt out and HELP for help.

We do not sell your phone number or SMS opt-in information, and we do not share it with third parties for their own marketing purposes. We share phone numbers and message content with communications providers such as Twilio only as needed to deliver the texts you requested and to process standard carrier keywords such as STOP and HELP.

Providing SMS consent is not a condition of purchasing Kenoo. Consent records (including timestamps and the disclosure version accepted) may be retained as needed for compliance, audit, and to honor opt-out requests.

We do not sell your personal information. We may share information in the following circumstances:

• With service providers and subprocessors that help us host, authenticate, store, process, analyze, communicate (including email delivery via Amazon SES and SMS delivery via providers such as Twilio), bill, pay out, enrich, or secure the Services (including providers such as Supabase, Vercel, Cloudflare, Amazon Web Services, Stripe, Plaid, Google (including Google Ads API), Meta, Strava, Wise, OpenAI, Anthropic, Perplexity, Apollo, Twilio, search/enrichment providers, and infrastructure used to run Wallie), under confidentiality and data-protection obligations.
• With other members of your Kenoo workspace according to permissions set by your organization, including administrators with elevated access.
• With third-party integrations you choose to enable, including Slack, GitHub, and AI assistants connected through the Kenoo MCP connector. For Slack, Kenoo shares the notification content and related task or project information needed to post the messages to the channels and workspaces you configure, and may share Slack identifiers needed to resolve authorized user mentions.
• With invoice or document recipients and campaign recipients when you create share links or send communications.
• If required by law, legal process, or to protect the rights, safety, or property of Kenoo, our users, or the public.
• In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

We use cookies and similar technologies to keep you signed in across Kenoo apps (including shared authentication cookies where configured), remember preferences, measure site and product performance, and understand how the Services are used. You can control cookies through your browser settings, though disabling certain cookies may affect functionality.

Separately, websites operated by Kenoo customers may use kenoo.js cookies as described in the Website tracking script section above. Those cookies are set on the customer's website under the customer's control.

We retain personal information for as long as needed to provide the Services, fulfill the purposes described in this Policy, resolve disputes, enforce agreements, and meet legal or accounting requirements. Backups, security logs, billing records, unsubscribe and suppression records, and SMS consent or opt-out records may persist for a limited additional period where needed for compliance.

When an account or workspace is closed, or when you disconnect an integration such as Slack, GitHub, or a connected AI assistant, we delete or de-identify personal information, integration tokens, connection metadata, and related configuration data within a reasonable period, except where retention is required by law or for legitimate business purposes such as security investigation, fraud prevention, financial recordkeeping, or backup recovery.

We use administrative, technical, and organizational measures designed to protect personal information, including encrypted transport, access controls, optional multi-factor authentication, and restricted admin tooling. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use strong credentials, enable MFA where available, and protect access to your workspace, API keys, and connected accounts.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict processing of your personal information, or to object to certain processing. You may also have the right to withdraw consent where processing is based on consent, including for optional Health features, Apple Health access, SMS notifications, marketing, or certain integrations.

You can often manage profile data, SMS notification preferences, disconnect integrations (including Slack, GitHub, and connected AI assistants), and control workspace content directly in Kenoo. You may also reply STOP to opt out of Kenoo SMS messages, or use the unsubscribe link in any campaign email. To exercise privacy rights or request deletion of integration connection data, contact us at hello@kenoo.io. We may need to verify your identity before responding. If your request relates to Customer Content controlled by an organization (including campaign email or website activity collected by a Kenoo customer), we may redirect you to that organization.

Kenoo may process and store information in countries other than the one where you live, including through cloud, communications, and AI subprocessors. When we transfer personal information internationally, we use appropriate safeguards required by applicable law.

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice. Continued use of the Services after an update becomes effective constitutes acceptance of the revised Policy.