Visitor Privacy and Data Processing

When running a website, you often want to know how many people visit and which pages are popular; visitors, in turn, care about how their data is used. Kanorio’s design principles are: use only the data necessary to provide and improve services, minimize third-party tracking by default, and allow site owners to provide Cookie consent options as needed.

This page explains the relationship between Kanorio’s built-in analytics, default privacy design, multi-tenant data isolation, Cookies, third-party tracking, and infrastructure safeguards. This is not legal advice; if your website has specific regulatory, industry, or cross-border data requirements, please consult a qualified legal professional.

Kanorio Built-in Analytics and Default Privacy

1. Built-in Analytics with Automatic IP Anonymization

Built-in analytics are primarily used to show overall usage trends, such as page views, visitor sources, popular pages, and button interactions. The goal is to help you determine if your website content is effective, not to identify individual visitors.

Original IP addresses are anonymized. In simple terms, parts of the information that could directly identify an individual are removed rather than saving the full original IP as standard analytical data. Some aggregated statistics may still use general location, device, or source information to help you understand overall traffic.

2. Self-hosted Fonts and Form Validation Without Third Parties

Many websites inadvertently send visitor connection information to external tech giants: for example, loading web fonts directly from Google servers (which transmits the visitor's IP to Google every time the page loads) or embedding Google reCAPTCHA on forms (which adds third-party tracking Cookies).

At Kanorio, your public website avoids these two issues by default:

• Website fonts are self-hosted by platform edge nodes: When visitors browse your site, fonts are loaded directly from Kanorio’s edge network, eliminating the need to connect to external font servers (see ).
• Form and checkout anti-spam are handled by our own servers: We use lightweight, open-source, device-side validation that does not load third-party scripts or set tracking Cookies, ensuring visitor data is not sent elsewhere due to form submissions (see ).

Cookie Consent and Returning Visitor Identification

Cookies are small pieces of data that websites temporarily store in your browser. If you enable the on your site, visitors can choose to accept all Cookies or only necessary ones.

When a visitor has not yet consented to analytics Cookies, or chooses to accept only necessary Cookies, Kanorio does not store the analytical identifiers used to recognize returning visitors. The site can still retain anonymous, aggregated traffic statistics so reports are not completely interrupted, but these visits will not be treated as identifiable returning visitor data.

The Cookie Consent Banner is a feature enabled by the website owner. Whether it needs to be enabled depends on your visitors' locations, tracking tools, and data processing methods; it cannot be determined by a single switch for all regulatory scenarios.

Responsibility for Third-Party Tracking Tools

You can connect Google Tag Manager, Google Analytics (GA4), Meta Pixel, or other third-party services yourself. These services are not part of Kanorio’s built-in analytics and have their own Cookies, data usage, and privacy policies.

Before enabling them, we recommend that you:

1. Read the service provider's privacy policy and data usage instructions.
2. Ensure your own privacy policy clearly informs visitors.
3. Enable the Cookie Consent Banner based on visitor location and actual usage.
4. Do not include sensitive personal data in tracking events, URL parameters, or tag names.

To learn about the setup steps, please read .

Your Customer Lists, Form Data, and Multi-tenant Isolation

Contacts in the customer area, order records, and form content or attachments submitted by visitors on your site are legally data managed by you (the website owner); Kanorio only stores, organizes, and sends them on your behalf. Specific safeguards include:

• Multi-layered data isolation between different websites: Kanorio enforces a "site-scope" binding at both the database structure and backend system access layers. Contacts, orders, form responses, and media files for every website are independently isolated. Whether it is another user's website or another site under your own account, data is never mixed or cross-read.
• No selling, no sharing: Kanorio promises in our never to sell personal data, share data for cross-context behavioral advertising, or use your customer lists for Kanorio’s own marketing.
• Only send to those who have subscribed: Newsletters are only sent to contacts who have subscribed; those who have unsubscribed, bounced, or marked emails as spam will not receive them again. Automated notifications like order confirmations will always be sent, but cannot be used to include promotional content. See for rules on who is considered subscribed, and for international requirements.
• No external lists accepted: We do not currently provide CSV list imports; lists purchased, rented, scraped, or obtained from third parties are strictly prohibited.
• Retention and complete deletion: Contacts and form submissions are retained until you delete them or the website itself. When a contact is deleted, their consent records, activity logs, and form submissions are removed as well; database backups are automatically cleared after a maximum of 90 days.
• Data storage location and encryption: The main database is located in a cloud data center in Singapore, and uploaded files are stored in Cloudflare’s cloud storage. Data is fully encrypted during network transmission and at rest. Important operations like list deletion or export leave immutable audit logs.
• Multi-layered protection for list and order exports: Exporting customer lists and store order CSVs requires corresponding export permissions (default for owners and admins; must be granted to other roles; not open to external AI or API keys). If more than 15 minutes have passed since the last login, re-authentication (2FA, Passkey, or re-login) is mandatory before export. Single exports have limits on record counts and date ranges, and exported text fields automatically apply spreadsheet formula security protection (preventing external visitors from injecting malicious formulas that execute when opening Excel).

If a contact exercises their right to access or delete data, you can search for the record under "Customers › Contacts" and click "Delete Contact" or "Export CSV". Form responses can also be exported to CSV directly from the form, allowing you to handle these requests without needing Kanorio support.

Kanorio’s Security Controls and Boundaries of Responsibility

When evaluating the security of SaaS services or Headless backends, it is crucial to distinguish between "security controls implemented by the platform itself," "infrastructure managed by underlying cloud providers," and "management responsibilities of the website owner":

1. Security responsibilities borne by Kanorio

• No execution of arbitrary user server-side code: Kanorio uses structured content models and controlled module renderers. We do not allow tenants to upload or execute arbitrary server-side scripts, structurally eliminating the risk of cross-tenant unauthorized code execution.
• Multi-layered multi-tenant data isolation and authorization: All website data is strictly bound to its site at creation, and cross-site ownership changes are prohibited. Backend operations, AI/management APIs, and public reads must pass site-specific role permission and access scope checks. This is continuously enforced by runtime security guards and automated dual-tenant isolation tests to ensure no request can cross-read or write contacts, orders, files, or settings of other websites.
• Separation of public site rendering and core backend: Public site rendering services deployed on the global edge network only serve published content and do not connect directly to the main database. Permission verification involving members, orders, customer lists, and setting changes is centralized and managed by the Kanorio core backend (see ).
• Passwordless login, 2FA, and re-confirmation for sensitive operations: We support Passkey biometrics and TOTP two-factor authentication (2FA). For high-risk operations like adding a Passkey, creating or expanding API key permissions, or exporting customer lists/store order CSVs, the system mandates re-authentication if more than 15 minutes have passed since login (see ).
• Third-party credential envelope encryption and least privilege separation: Third-party keys you enter for payment gateways or invoicing are encrypted using AES-256-GCM envelope encryption with unique data keys, with the master key managed by Google Cloud KMS. The production environment only holds the minimum permissions required for daily service and is strictly separated from system management and development environments (see ).
• Daily automated off-site encrypted backups, point-in-time disaster recovery, and self-service restoration: The system performs daily automated off-site encrypted backups of the main database and original website media files, stored in an independent cloud backup environment isolated from the production environment (database encrypted backups are retained for up to 90 days, supporting continuous point-in-time recovery and periodic restoration drills). Site owners enjoy 30-day for pages and posts, 30-day , a 60-day , and free on all plans.
• Immutable audit logs, anomaly monitoring, and security reporting channels: Account security events, key access, list and order exports, team permissions, and important content changes are written to an "append-only" audit log (see ). The system continuously monitors for anomalous cross-site access and bulk data reading, and provides a public for security researchers.

2. Security and compliance scope for the website owner (you)

• Protect the Email account and Google account used for login, and enable two-factor authentication (2FA) or Passkeys for team members.
• Assign based on the principle of least privilege, and regularly review and .
• When enabling third-party ad tracking or connecting external payment, invoicing, or logistics providers, fulfill the corresponding privacy notification and regulatory obligations to your website visitors and buyers.

Infrastructure Providers (Sub-processors) and Third-Party Certifications

Kanorio uses international mainstream cloud infrastructure providers (Sub-processors) to operate our services. The responsibilities of each provider in the data processing flow are as follows (see our for full legal disclosure):

Scope of Third-Party Security Certifications and Kanorio’s Status

The infrastructure providers listed above publicly state that their platforms possess multiple international third-party audit certifications and compliance commitments, such as:

• Cloudflare, DigitalOcean, Neon, Google Cloud, Upstash, Resend: Provide SOC 2 Type II audit reports, ISO/IEC 27001 information security management certifications, and Data Processing Addendums (DPA) in their public trust centers (e.g., viewable at Cloudflare Trust Hub).
• Google Cloud KMS: The hardware and cryptographic modules used to store master keys are FIPS 140-2 validated.
• Stripe and compliant payment providers: Possess PCI DSS payment card industry security standard certification.

Please distinguish between "Infrastructure Provider Certification" and "Kanorio’s Own Certification":

1. Provider certifications only cover the provider's audited service scope: For example, Cloudflare, Neon, and DigitalOcean’s SOC 2 Type II and ISO 27001 prove the effectiveness of their controls regarding physical data center security, edge networks, host virtualization, and managed database foundations.
2. Provider certification does not mean using their SaaS automatically grants the same certification: As an independent SaaS service, Kanorio has not yet independently obtained its own SOC 2 or ISO 27001 certification.
3. How Kanorio protects your data: Beyond the infrastructure layer, Kanorio’s account verification, multi-tenant site permission isolation, third-party key envelope encryption, and internal operational access control are implemented by Kanorio itself through the application security architecture and engineering safeguards described above.

Service Availability Monitoring, SLA Status, and Data Residency

• Public real-time status page (status.kanorio.com): Publicly displays real-time operational status and historical availability records for six major services: marketing site, management dashboard, published customer sites, login verification, Content Delivery API, and Management / MCP API (see ).
• SLA (Service Level Agreement) and Enterprise SSO status: Kanorio maintains high availability through global edge caching (published pages and Content Delivery API respond directly from edge nodes) and multi-layered fault tolerance. However, none of our standard plans (Free, Pro, Business) currently provide a contractual uptime SLA with financial compensation, nor do we offer enterprise SAML/OIDC SSO or SCIM directory synchronization.
• Data Residency: The main database and core application are hosted in a cloud data center in Singapore. Public images and static assets are distributed via Cloudflare’s global edge nodes. We do not currently offer options to switch database storage countries or regions (e.g., EU-only) for individual tenants.

GDPR, CCPA, and Your Website

GDPR is the European Union's personal data protection regulation; CCPA is the privacy law for California, USA. Both require websites to inform users about data usage in an appropriate manner and provide choices or rights in specific situations.

Even if your primary audience is in a single country or region, your website may still receive visitors from the EU or the US once it is public. Whether specific regulations apply depends on your target market, the data you collect, the third-party tools you use, and your legal status. Kanorio provides tools like the Cookie Consent Banner and terms page templates, but you are responsible for completing your own notifications and compliance assessments.

Related Documents