1. Overview
KarnaKreative Content Manager ("we", "our", or "us") provides a multi-tenant client and content management platform. This Privacy Policy explains how we collect, process, isolate, and protect personal and organizational data when you use our multi-tenant software application and services.
2. Multi-Tenant Data Isolation
Our architecture guarantees strict logical data separation between different client organizations ("Tenants"). Each tenant workspace is assigned unique workspace identifiers (`tenantId` and `clientCode`).
Tenant Isolation Guarantees:
- Database queries are strictly scoped to your tenant context.
- No cross-tenant data indexing or leakage across organization accounts.
- Role-Based Access Controls (RBAC) restrict staff permissions to assigned clients only.
3. Google Drive OAuth Data Scopes
When you connect Google Drive to synchronize media assets:
- We request minimum necessary OAuth scopes (`drive.readonly` and `drive.metadata.readonly`).
- Google OAuth Refresh Tokens are encrypted at rest using AES-256-GCM hardware encryption.
- We do not modify, sell, or analyze your raw Google Drive files for advertising purposes.
- Synced file links (`webViewLink`) and metadata are strictly stored for indexing client folders.
4. Information We Collect
We collect the following categories of information to provide service:
- Account Data: Name, business email, encrypted password hash, and assigned staff permissions.
- Client Workspace Data: Client company names, folder structures, file metadata (file names, size, MIME type).
- Audit Logs: Action records, IP addresses, and timestamps for security audit trails.
5. Security Standards & Encryption
We implement industry-standard administrative, physical, and technical safeguards including:
- TLS 1.3 encryption for all data in transit.
- Bcrypt password hashing for local credentials.
- Signed cryptographic session tokens for multi-stage authentication.
6. Data Retention & Deletion
Tenants retain complete ownership of their data. Upon organization termination or account deletion, all cached file metadata and client assignments are purged from active databases within 30 days.
8. GDPR & CCPA Rights
Under European (GDPR) and California (CCPA) privacy laws, tenant users have the right to access, rectify, export, or request deletion of their personal data.
9. Contact Privacy Team
For privacy inquiries, data subject access requests, or security audit logs, please contact our Data Protection Officer at:
privacy@karnakreative.com