Legal

Privacy Policy

November 5, 2026

This Privacy Policy describes how Kerna sp. z o.o. ("Kerna", "we", "us", or "our") collects, uses, stores, and discloses information when you use the Kerna email add-on for Gmail and Microsoft Outlook, website (kerna.io), and related services (collectively, the "Services"). By accessing or using our Services, you agree to the practices described in this Policy. It also describes the data we process in running the Kerna Partner Programme (Sections 2.11 to 2.13).

1. Data Controller

The data controller responsible for your personal data is Kerna sp. z o.o., a company registered under the laws of the Republic of Poland, with its registered office at Warszawska 40/2A, 40-008 Katowice, Poland. The company is entered in the Polish National Court Register under KRS number 0001203068 and holds Tax Identification Number (NIP) 9542897132.

For all data protection inquiries, you may contact us at: privacy@kerna.io

2. Information We Collect

We collect only the minimum information necessary to authenticate your identity, deliver our Services, and manage your subscription.

2.1 Account and Authentication DataAll user authentication is handled via Google or Microsoft sign-in. We do not create, manage, or store passwords. When you sign in, we store your email address; a display name (the name Google or Microsoft provides when you sign in on our website or in Outlook, and otherwise a name derived from your email address); your Google or Microsoft account identifier, used to recognise your account if a different account presents the same address; which platforms you use and how you signed up; when your account was created and when you last used Kerna on each platform; and whether you have agreed to marketing emails and have been sent our welcome email. This data identifies your account and links it to your plan.

2.2 Subscription and Billing DataAll financial transactions are processed by Stripe, Inc. Kerna does not collect, transmit, or store credit card numbers, billing addresses, or security codes (CVC/CVV). We retain only references to your Stripe customer and subscription, your subscription status (e.g., active, cancelled), plan tier, and billing cycle dates. This data is stored in Google Cloud Firestore. When you subscribe on our website, we also record which version of our Data Processing Agreement was accepted, and when.

2.3 Usage MetricsWe count the tokens (AI processing units) each user and team uses, to enforce plan limits and show usage in the add-on and on our website. We also keep monthly counts of how often you use each feature, how many tokens it used and in which app (Gmail or Outlook), with an estimate of the time saved, stored with your email address so that we can show them to you, and we record usage events as described in 2.6. Error and performance reports are described under Sentry in Section 6. None of this contains email content.

2.4 Settings and Content You Create in KernaWe store your settings (interface and reply language, tone, summary length, extraction options and the AI-disclosure setting) and the content you write in Kerna: your custom prompts (and, for team leaders and admins, prompts shared with the team), the description of your company that you save under About your company in Settings (Compose adds it when you write an email), your Smart Focus list, and triage categories with their descriptions, including category choices for a shared mailbox, which are stored with that mailbox's address. We also store the language Kerna last detected in an email you translated. In the Gmail add-on, the sender addresses you mark VIP, Mute or Low priority in Inbox Triage are stored with your account until you remove them, and so are the identifiers of messages you mark Done, which stop applying after 30 days and are then removed the next time you open Inbox Triage; no subject or content is stored with them. In the Outlook add-in, these stay on your device (see 9.3).

2.5 Welcome, Early Access and Contact RecordsWhen you first use the Kerna add-on, or submit your email address through an early access or contact form on our website, we store your email address, the time and where it came from (Gmail, Outlook or our website). We use it to send your welcome email, to contact you about product availability, or to respond to your inquiry.

2.6 Analytics and Hashed IdentifierTo analyse usage and improve our Services, we record a usage event each time you use a feature, and the Outlook add-in also records which of its screens and buttons you use. An event records what was used and in which app (Gmail or Outlook), your plan, your interface language and the languages involved, the options chosen for it (such as the tone of a reply or the scope of a summary) and counts such as the number of messages, files or rows processed, the length of the input, the tokens used, the processing time and the time. It contains no email content. Each event is stored under a keyed hash of your email address (HMAC-SHA-256 with a secret key held only on our servers), not your email address itself. Because the hash still identifies you indirectly, we treat it as personal data. Events are deleted after 90 days, and when you exercise your right to erasure we delete all events linked to you.

2.7 Emails We Send YouWe send you emails through Brevo (see Section 6). To do this, Brevo holds your email address and the account details listed for Brevo in Section 6. For each email it sends, Brevo records whether it was delivered and opened and which links were clicked. We use this only to see which of our emails are useful.

2.8 Team Status for Outlook Shared Mailboxes (Team Plans)When your team uses Kerna in an Outlook shared mailbox, we store which team member a conversation is assigned to, its status (for example assigned, waiting or done), who started a reply in Kerna and, when Kerna changes the status itself, why (for example, because the customer replied), with the time of the latest change. Kerna checks for such changes, by reading the newest message of the conversation, when a team member opens the conversation, a triage result or a team list in Kerna; it does not check in the background. Each of these records is identified by the shared mailbox address and Outlook's conversation identifier; no email content, subject or sender is stored. We also store which team members have opened that shared mailbox with Kerna, and when they last did, so that they can be offered when a conversation is assigned. When a team member opens Team overview in Kerna, we also store, for each shared mailbox they use, Outlook's conversation identifiers of the newest emails that nobody on the team has handled yet, with the time each arrived, so that the team's dashboard on our website can count them; this list is replaced each time it is counted and deleted 30 days after the last count. Kerna also shows the status and the assigned team member as Outlook categories on the conversation's messages in the shared mailbox, so that anyone who can open that mailbox in Outlook sees them: the status in the team leader's language and the team member's name, each followed by (Kerna), for example In progress (Kerna). When a conversation is marked done, these are replaced by the category Done (Kerna). Kerna updates the categories when the status or the assignment changes, and when it reads the conversation; they are part of the mailbox and stay there until Kerna changes them or someone removes them in Outlook. A team leader can also set assignment rules for a shared mailbox. Each rule names one or more conditions, all of which must be met (a triage category, the sender's email address or domain, words in the subject or in the text, part of a recipient's address, an attachment or high importance), and the team members who should get matching conversations. When a team member's Kerna reads a conversation nobody has assigned yet (in a triage result, when they open it, or, for the newest emails of the shared mailboxes they use, when they open Kerna's Home screen or the tab that lists their assigned conversations), Kerna checks the newest message against the rules, reading its text only when a rule looks for words in it, and, if a rule matches, assigns the conversation and records that a rule did so. The text is compared in memory and is not stored. Status records are deleted 90 days after a conversation is marked done, or a year after the last change; a team member's entry for a mailbox is deleted 180 days after they last opened it with Kerna, or when they leave the team. Assignment rules are kept until a leader changes them, and a team member is taken out of them when they leave the team. A team leader can also add custom statuses for the team; their names are stored with the team until a leader removes them. When a team member turns on Put emails assigned to me in Microsoft To Do (a setting stored with their account), the record also notes that its current assignment has been added to their To Do, so that it is added only once; the task itself is created in that member's own Microsoft To Do, with the conversation's subject and a link to it. The record also keeps the identifier of that task in the member's To Do, so that Kerna can tick it off when the conversation is marked done; the identifier is then removed.

2.9 Sending Email Data to Other Systems (Send to…)If your team leader (or you, when you are not on a team) sets up a destination under Send to other systems in the Outlook add-in, we store its name, the kind of data it receives (for example orders or complaints), its web address, its field list when the fields are custom, whether attached files are read, the language its values are translated into, if any, a signing secret, who created it and when, and the time and result of its last send. When a user chooses Send to… on an email, Kerna reads that email and, if the destination is set to read them, up to three attached PDF, Word, Excel or CSV files, and our AI inference provider extracts the destination's fields after the redaction described in 4.4 and, if a language is chosen, translates their descriptive text into it. The user reviews the values and can change them before anything is sent. Kerna then sends those values, with the email's subject, the sender's name and address (unless the destination is set to leave them out), the time it was received, its message identifier, the mailbox it is in, a link to open it in Outlook and the email address of the user who sent them, to that web address only. The receiving service is chosen and controlled by your team, not by Kerna; it is not one of our sub-processors, and its own terms and privacy policy apply to what it receives. Kerna does not keep the extracted values or the email content once the request is complete. For each send we keep a log entry: the destination, who sent it, when, whether it was delivered and the receiving service's response code. The log holds no email content, subject or values, and each entry is deleted after 90 days.

2.10 TeamsIf you create or join a team, we store the team and its owner, the email addresses of its members and of the people invited to it (with who invited them and when), each member's role, token limit and usage, the team's settings, the prompts shared with the team and the team's triage categories. Invited people see the invitation in Kerna, and we do not email them. An invitation is kept until it is accepted, declined or withdrawn.

2.11 Partner Programme: Partners and the People Who Act for ThemIf you apply to the Kerna Partner Programme, take part in it as a partner, or act for a partner (for example as its owner, its contact person or a user of its partner dashboard), we process: the details given in the application (company name, country, tax or VAT number, website, type of business, the description of its clients, any message, and the email address the application was sent from); the partner's code, level and status, the email addresses of the people who use its partner dashboard, its email address for statements, its VAT status and the language of our emails; a record of who accepted the Partner Programme Terms (their email address, name and position, and their confirmation that they may act for the partner), when, and which version, with a fingerprint (hash) of the text accepted; the clients attributed to the partner, its deal registrations, commission entries, statements, invoice numbers and payments; and, for a partner established outside Poland, the information and documents needed to apply withholding tax correctly, such as a certificate of tax residence. We send programme emails (applications, new clients, statements, payments) through Brevo. Payouts go through Stripe: Stripe collects the identity and bank details it needs for the partner's payout account as a separate controller, under its own privacy policy, and tells us only whether the account can receive payments. We do not store bank details, except the account we pay into when we pay by bank transfer. We use this data to review applications, run the programme, calculate, settle and pay commission, and keep the accounting and tax records the law requires. The legal bases are the partner agreement where the partner is an individual (Article 6(1)(b) GDPR), our legitimate interest in running the programme with the people who act for a partner (Article 6(1)(f)), and our obligations under accounting and tax law (Article 6(1)(c)).

2.12 Clients Referred by a PartnerIf you subscribe to Kerna through a partner's link, or your company's email domain was registered by a partner (2.13), we record the partner your subscription is attributed to, with your company name as it appears on your Stripe customer record, your email domain, your Stripe customer and subscription references and the partner's commission rate. So that the partner can check its commission, we show it your company name or domain, your plan, your subscription status, the dates and amounts of your payments and the commission on each. We never show a partner your email address or anyone else's, the content of your mailbox, or how you use Kerna's features. If your business is a sole trader, this information may identify you. The legal basis is our legitimate interest, and the partner's, in paying the commission the partner has earned by introducing you (Article 6(1)(f) GDPR); you may object (Section 13). The attribution record and the commission entries contain no email address. They are part of our accounting records and are kept for the period in Section 12, also after Delete my data.

2.13 Deal RegistrationsBefore a company subscribes, a partner may register it with us, giving only its company name and email domain, never the names or email addresses of people. We use the registration to attribute the first subscription from that domain to the partner for 30 days, which the partner can renew once. Where a company name or domain identifies a person, for example a sole trader, the registration is personal data we receive from the partner; the legal basis is our legitimate interest in attributing clients correctly (Article 6(1)(f) GDPR).

3. Information We Do Not Collect

Kerna does not write any of the following to its databases, logs or backups. Where some of it is held briefly so that the add-on works, Section 4 says where and for how long:

Email message bodies, subjects, or headers
Sender or recipient email addresses from processed emails, except the sender addresses you choose to put in Gmail triage rules and the shared mailbox addresses described in 2.4 and 2.8
Attachment content, file names or other attachment metadata
AI-generated summaries, replies, translations, or drafts
Calendar event content, contact details, or spreadsheet data accessed during user-initiated actions
Account passwords, or Google or Microsoft access or refresh tokens (tokens Kerna obtains to act on your behalf in Outlook are held only in server memory, see 4.1)

4. How We Handle Email Content

Kerna does not store the content of your emails. It is read only when you use a feature, used only to produce your result, and never written to our databases, logs or backups. This is a core architectural principle, not a configurable setting.

4.1 Processing in MemoryWhen you trigger an AI action, for example Summarize, Reply, Translate, Compose, Extract, Inbox Triage, attachment analysis or Send to…, the text that action needs is sent to our AI inference provider over an encrypted connection (Section 6 lists what this can include). So that you can move between screens and return to a result, Kerna keeps working copies in server memory for a short time: in the Gmail add-on, results, drafts, the compose form and the messages listed by Inbox Triage (sender, subject and preview), for about 30 minutes after they were last updated; in a team's shared mailbox, the subject and sender of a conversation's newest message, for a few minutes. Microsoft access and refresh tokens obtained to act on your behalf are also held only in server memory. Nothing held in memory is written to disk, and it is discarded when these periods end or the server restarts. The Outlook add-in keeps some results on your own device instead (see 9.3).

4.2 No Background ProcessingKerna acts only when you use it. It does not scan, index, monitor, or archive your inbox, calendar, contacts, or any other mailbox data in the background, and no scheduled job reads your mailbox. The one exception is a setting you choose: in the Outlook add-in, if you turn on Scan automatically in Triage, Kerna repeats the triage scan you set up at the interval you choose (every 5, 15, 30 or 60 minutes) while Kerna is open in Outlook, and stops when Outlook or the Kerna pane is closed. In the Outlook add-in, the email you select is loaded into the Kerna panel on your device so that it is ready when you press a button; it is sent to Kerna only when you use a feature. In a team's shared mailbox, opening an email, a triage result or a team list in Kerna also checks the newest message of the conversations shown, to keep their team status current, and opening Kerna's Home screen or a team list also checks the newest emails of the shared mailboxes you use against your team's assignment rules (see 2.8).

4.3 No Model TrainingYour data is never used to train, fine-tune, retrain, or improve any artificial intelligence or machine learning model — whether operated by Kerna, OpenAI, Google, or any other party. Your inputs remain private to your specific request session.

4.4 Redaction Before InferenceBefore email text is sent to our AI inference provider, Kerna replaces payment-card numbers, IBANs and Polish bank account numbers, Polish PESEL numbers and US Social Security numbers, in the formats it recognises, with placeholders. This happens within Kerna's own processing, so these numbers do not reach the provider, and it cannot be switched off. It covers the email or conversation you act on, the subjects and previews read by Inbox Triage, and attachments used by Send to… or Reply with attachments. Other personal data, such as names, email addresses, phone numbers and postal addresses, is not removed and is sent as it appears. Redaction is not applied to files read with the Attachments feature, so that details such as account numbers can be extracted from them, or to text you write yourself, such as instructions, prompts and drafts you ask Kerna to improve or translate.

5. How We Use Your Information

We use the information described in Section 2 for the following purposes:

To authenticate your identity and maintain your session
To provide, operate, and improve the Services
To manage your subscription, process billing events, and enforce plan limits
To display your usage statistics and preferences within the add-on and dashboard
To send transactional communications (e.g., subscription confirmations, billing receipts)
To send service emails that help you use Kerna: a welcome email when you sign up, short guides to individual features, and an occasional reminder if you have not used Kerna for a while. Which of these you receive depends only on when you signed up, the platform you use and when you last used Kerna
To respond to your support or contact inquiries
To detect, prevent, and address technical issues, abuse, or security incidents
To send marketing communications about new features, product updates, and tips — only if you have provided explicit consent, which you may withdraw at any time with the unsubscribe link in any of these emails
To run the Kerna Partner Programme: review applications, attribute clients to partners, and calculate, settle and pay commission (see 2.11 to 2.13)
To comply with applicable legal obligations

We do not sell, rent, or lease your personal information to any third party. We do not use your data for advertising, profiling, or automated decision-making. The service emails described above are sent on the basis of our legitimate interest in helping you use the service you signed up for (Article 6(1)(f) GDPR). Every one of them has an unsubscribe link. Unsubscribing is your right to object: we stop sending them, and your account is not affected.

6. Third-Party Sub-Processors

We use the following third-party services to operate Kerna. Each sub-processor receives only the minimum data necessary to perform its function.

Provider	Purpose	Data Shared
OpenAI	AI inference (GPT model families, including GPT-6)	Only when you trigger an AI feature, the text that feature needs: the email or conversation you act on, including the names and addresses of the people in it and its dates; attachments you choose and their file names; the senders, subjects and previews of the messages in an Inbox Triage scan; drafts you ask Kerna to improve or translate; and your instructions and prompts, including, when you write an email in Compose, the description of your company that you saved in Settings. Financial identifiers are replaced first (see 4.4); other personal data is sent as it appears. Sent over an encrypted connection, processed in memory to produce your result, not retained under our Zero Data Retention terms (see below), and not used to train any model. No account identifier or billing data is attached to requests; your own name and address are included only where they appear in the email content.
Stripe	Payment processing	Email address for customer identification. All payment details are handled directly by Stripe.
Google Cloud and Firebase	Hosting of the add-on servers (Cloud Run, Belgium), database (Firestore, Warsaw), website hosting and sign-in, and protection of the website against automated abuse (App Check with reCAPTCHA Enterprise)	The account data, settings and other records described in Section 2. Our add-on servers process email content in memory as described in 4.1; server logs contain no email content. Once you are signed in to the website, reCAPTCHA Enterprise receives information about your browser and device and how the page is used, including your IP address, to confirm that requests come from our website and not from an automated script (see 9.2). It is a global Google Cloud service, so this information may be processed outside the EEA under the Standard Contractual Clauses in Google Cloud's data processing terms.
Google Analytics	Website analytics	Anonymous, aggregated website usage data. Subject to consent (see Section 9).
Sentry (Functional Software, Inc.)	Error tracking and performance monitoring	A keyed hash identifying the user, error messages and stack traces, and performance data (routes, timings, AI model names and token counts) from our servers, and error reports from the Outlook add-in. Request bodies, query strings, identifying request headers and email addresses in web addresses are removed before sending. No email content, recipients or subject lines. Stored in the EU.
Brevo (Sendinblue SAS, France)	Sending our emails to you (welcome, feature guides, reminders); Partner Programme emails (2.11)	Your email address, the platform you signed up with (Google or Microsoft) and whether you signed up on our website or in Gmail or Outlook, interface language, plan, account creation date, date of last use, and whether you have agreed to marketing emails. Delivery, open and click records for the emails it sends (see Section 2.7). No name, no email content and nothing from your mailbox. Stored in the EU. For Partner Programme emails, the partner's email address and the email itself, which can include a client's company name and commission amounts.

Our agreement with OpenAI additionally includes Zero Data Retention terms: content Kerna transmits for AI inference is excluded from OpenAI's abuse-monitoring logs and is not retained once your request has been served, consistent with OpenAI's default data-usage policies by endpoint.

7. API Services Compliance

Kerna's use and transfer of information received from Google APIs and Microsoft APIs to any other app will adhere to the Google API Services User Data Policy (including the Limited Use requirements) and the Microsoft APIs Terms of Use.

In accordance with the Limited Use requirements, we affirm the following:

Limited Purpose: We only use data obtained through Google APIs to provide and improve the user-facing features that are prominent in the application's interface: reading, summarizing, translating, replying to, composing, rewriting and extracting from emails and attachments; inbox triage and follow-up tracking; checking your calendar for clashes, and for free time when you ask Kerna to propose another meeting time, and searching your contacts when you add recipients; and, when you ask, creating calendar events (with a Google Meet link and the guests you tick, if you choose), tasks, contacts and Google Drive files from that content, filling in what is missing from a contact you already have, and answering a calendar invitation you received with Accept, Maybe or Decline. We do not use Google API data for any other purpose.
Prohibited Transfer: We do not sell, rent, or transfer Google API data to third parties. We do not use Google API data for serving advertisements. Email content obtained through Google APIs is only transmitted to our AI inference provider (OpenAI) to fulfil the specific, user-initiated feature request, and only the text that feature needs is sent. Your account email address is shared only with the sub-processors listed in Section 6, for the purposes stated there.
Prohibited Personnel Access: We do not allow humans to read user data obtained through Google APIs, except (a) with the user's affirmative agreement for specific messages (e.g., for technical support at the user's request), (b) where necessary for security purposes such as investigating abuse, or (c) to comply with applicable law.
Data Minimization: We request access only for the features described in Section 8, and Section 8 explains how each permission is used.
Microsoft APIs: Information accessed through Microsoft Graph and Microsoft sign-in (messages, attachments, calendar, contacts, people, tasks and categories in your mailbox and in shared mailboxes you can open, and your basic account profile) is used solely to deliver Kerna's features. Email content is sent to our AI inference provider for the action you trigger and is not written to our databases; we store only the identifiers described in 2.4, 2.8 and 2.9. It is never sold or used for advertising or model training, and it is not transferred to other third parties, except to a destination your team has set up when you choose Send to… on an email (see 2.9). Our use complies with the Microsoft APIs Terms of Use and the Microsoft 365 app certification requirements.

8. Platform Permissions

Kerna requests the following permissions on each platform it supports. Each permission is used only while you are using Kerna: when you trigger a function or, in a team's shared mailbox, when you open an email, a list or the Home screen in Kerna (see 4.2). No permission is used by a background job.

Google Account — Sign-in (userinfo.email)—Confirm your identity and read the address you signed in with.

Gmail — Run add-on (gmail.addons.execute)—Run the Kerna panel inside Gmail. On its own it gives no access to mail.

Gmail — Current message action (gmail.addons.current.message.action)—Lets Gmail give Kerna the email you have open when you use the panel. Kerna does not read or change mail through it; it reads mail through the Read permission below.

Gmail — Current message read (gmail.addons.current.message.readonly)—Lets Gmail give Kerna the email you have open when you use the panel. Kerna does not read or change mail through it; it reads mail through the Read permission below.

Gmail — Read (gmail.readonly)—Read the open email, its conversation and its attachments for every Kerna function. When you run Inbox Triage, list the messages in the folders or labels you choose and read their sender, subject and preview, read your label names, and read your sent mail for Waiting on others.

Gmail — Compose (gmail.compose)—Create a draft in your compose window. Google’s own label for this permission is wider: “Manage drafts and send emails”. Kerna uses it to create the draft and never to send.

Gmail — Current compose action (gmail.addons.current.action.compose)—Put the text Kerna wrote, and its subject if you choose, into the email you are writing, when you open Kerna in its window and press Insert into email. Kerna does not read the draft and never sends it. Google’s own label for this permission is wider: “Manage drafts and send emails when you interact with the add-on”.

Google Calendar — Events (calendar.events)—Requested together with the Google Calendar Read/Write permission below, which is the one Kerna's event creation uses.

Google Calendar — Read/Write (calendar)—Read your calendar's time zone, check for events at the time of a date found by Extract so that Kerna can warn you of a clash, read when you are busy over the next two weeks when you ask Kerna to propose another time, and create the event when you choose to add it, unless Kerna has already added it. With Add with Google Meet, the event gets a Google Meet link, and the people you tick under Invite to the meeting are added as guests; Google Calendar sends them the invitation. When Extract finds that an email is a calendar invitation, Kerna looks that event up in your calendar to show your answer, and when you press Accept, Maybe or Decline it records your answer there; Google Calendar then sends your answer to the organiser.

Google Tasks — Read/Write (tasks)—Create a task from an action item, a Smart Focus result or an Inbox Triage message when you ask for one. A task made from an email carries the due date found in it and a link back to the email.

Google Contacts — Read/Write (contacts)—Save a contact found in an email, and search your saved contacts when you add recipients in Compose, when you ask. Save everyone on this thread saves every address on the conversation. When someone is already in your contacts, Kerna reads your contacts to find them and adds only what is missing from their entry (a phone number, company, job title or name), changing nothing else, instead of saving them twice.

Google Drive — App files (drive.file)—Write the Google Sheet or Google Doc an extraction exports to. It reaches only files Kerna itself creates, never the rest of your Drive.

Microsoft Outlook — Read (Mail.Read)—Read messages in your mailbox when you use a Kerna feature: the whole conversation and its attachments for Summarize, Reply, Extract, Attachments and Send to…; your Inbox and Sent Items (sender, subject and a short preview) when you run Triage or Waiting on others, including checking conversations for later replies; and, in Pick emails, your recent Inbox messages and the messages matching a search you type; and, when you answer a meeting request in Kerna, which calendar event the message belongs to; and, for Save everyone on this thread, the senders and recipients of the conversation's messages.

Microsoft Outlook — Read/Write (Mail.ReadWrite)—Mark messages read, move them to Archive, and add or remove Kerna's own categories on messages, when you do this in Triage. Replies and new emails are placed in Outlook's compose window through the add-in's item permission (see below), not through this permission.

Microsoft Outlook — Calendar (Calendars.ReadWrite)—Check for a conflict and create an event from a date found in a message, when you choose to schedule it, and read when you are busy over the next two weeks when you ask Kerna to propose another time. Kerna invites nobody unless you tick people under Invite to the meeting when you use Add with Teams; Exchange then sends them the invitation from your calendar. With Add with Teams, the event gets an online meeting link from the service your calendar offers, Microsoft Teams for work or school accounts. When you press Accept, Maybe or Decline on a meeting request, Kerna records your answer in your calendar and Exchange sends it to the organiser.

Microsoft Outlook — Tasks (Tasks.ReadWrite)—Create a Microsoft To Do task from an action item, a Smart Focus result or a Triage message when you ask for one. A task made from an email carries the due date found in it and a link back to the email. In a shared mailbox, if you turn on Put emails assigned to me in Microsoft To Do, Kerna adds the conversations assigned to you to your own To Do list, with their subject and a link, when you open Kerna. When one of these conversations is marked done, Kerna ticks its task off.

Microsoft Outlook — Contacts (Contacts.ReadWrite)—Save a contact found in an email, and look up your contacts when you add recipients in Compose. Save everyone on this thread saves every address on the conversation. When someone is already in your contacts, Kerna looks them up by address and adds only what is missing from their entry (a phone number, company, job title or name), changing nothing else, instead of saving them twice.

Microsoft Outlook — People (People.Read)—Suggest people you work with when you search for recipients in Compose.

Microsoft Outlook — Mailbox settings (MailboxSettings.ReadWrite)—When you turn on Label messages in Outlook in Triage, Kerna adds its own coloured categories (named "Kerna: ...") to your Outlook category list, or corrects their colour, so that the labels appear in colour. Kerna does not read or change any other mailbox setting.

Microsoft Outlook — Shared mailbox read (Mail.Read.Shared)—Read messages in a shared or delegated mailbox your organisation has already granted you access to: the message you are working on, the mailbox's Inbox and Sent Items when you include it in Triage, and the newest message of conversations that have a team status, so that team lists can show their subject and sender. Kerna does not extend your access: it can only open what you can already open in Outlook.

Microsoft Outlook — Shared mailbox read/write (Mail.ReadWrite.Shared)—In a shared or delegated mailbox you already have access to: mark messages read, move them to Archive, and add or remove Kerna's categories, including the status and assigned team member categories and Done (Kerna) on conversations your team handles in a shared mailbox.

Microsoft Account — Sign-in (User.Read)—Standard Microsoft sign-in permission. Kerna reads your name and email address from your sign-in token.

Microsoft Account — Sign-in to Kerna (openid, profile, offline_access, access_as_user)—Standard Microsoft sign-in permissions. They confirm who you are and let Kerna renew its access while you use it, without asking you to sign in again. On our servers the resulting tokens are held only in memory; in Outlook, Microsoft's sign-in library keeps your session in the browser (see 9.3).

Microsoft Outlook — Add-in item access (ReadWriteItem)—Read the email open in Outlook and put a reply or a new email into the compose window, when you choose to.

Content read through these permissions is used only for the action you asked for. It is not written to our databases, logs or backups; working copies are held in memory or on your device as described in 4.1 and 9.3. In addition, Kerna stores the identifiers and settings described in Section 2: for Gmail Inbox Triage, the sender addresses you mark VIP, Mute or Low priority and the identifiers of messages you mark Done (2.4); team status for shared mailboxes (2.8); and Send to… records (2.9). You can also choose to send an email's details to a destination your team has set up (see 2.9). Kerna cannot reach any mailbox your organisation has not already granted you access to. Kerna does not send mail: on Outlook it requests no send permission at all, and on Gmail the two scopes that allow an add-on to write a draft into your compose window and to put text into the email you are writing are described by Google as allowing it to manage drafts and send emails; Kerna uses them only to create the draft and to insert text, never to send. When you answer a calendar invitation in Kerna with Accept, Maybe or Decline, your calendar sends your answer to the organiser, as it does when you use the buttons on the invitation itself. Likewise, when you add a meeting with Google Meet or Teams and leave people ticked under Invite to the meeting, your calendar sends them the invitation.

9. Cookies and Analytics

9.1 Website analytics (kerna.io)Our website uses Google Analytics 4 to count page views, sessions, and traffic sources. The legal basis is your consent under Article 6(1)(a) GDPR, together with Article 5(3) of the ePrivacy Directive. No Google script is loaded and no data, including your IP address, is sent to Google until you accept in the cookie banner. If you reject, or if you never answer the banner, no analytics request is made at all.

9.2 Cookies and storage on this websiteSet only with your consent: _ga (Google, up to 2 years), which distinguishes one visitor from another, and _ga_[measurement ID] (Google, up to 2 years), which holds the session state for this property. Neither is set if you reject. Always present, because the site does not work without them: locale (Kerna, 1 year), which remembers the language you selected, and a small record of your cookie choice (Kerna, 6 months), which is the only way we can honour a refusal. Firebase Authentication keeps its session store in your browser. The Firebase SDK starts on every page, so the store is created whether or not you sign in; it holds a session only once you do. Firebase also keeps a small diagnostic record of which Firebase services the page used. Once you are signed in, the site also loads reCAPTCHA Enterprise from Google, so that our functions can tell requests from this website apart from automated scripts (Firebase App Check). Google may set the _GRECAPTCHA cookie for this (up to 6 months), and Firebase keeps a short-lived App Check token in your browser's storage. Visitors who are not signed in do not load reCAPTCHA. These are strictly necessary and do not require consent under Article 5(3) of the ePrivacy Directive.

9.3 Email add-onThe Kerna add-ons set no cookies and load no third-party tracking or advertising scripts. The Outlook add-in loads Microsoft's Office library from Microsoft, and Microsoft's sign-in library and the React library from the jsDelivr content delivery network, which, like any server you load files from, receives your IP address. To work, the Outlook add-in keeps data in your browser's storage on your device: results for an email (for an hour), reply and compose drafts (24 hours), triage results (24 hours), unanswered triage items with their subject, sender, date and Kerna's short summary, and the identifiers of messages you mark Done (30 days), the identifiers of messages Kerna has labelled, your triage sender rules, saved extraction templates, recently used shared mailboxes and display preferences, and, for a few minutes while a reply window opens, the email you are replying to. Each item is removed once it expires, the next time Kerna opens on that device. Microsoft's sign-in library keeps your session in the browser. This storage is strictly necessary for the features you use, and Delete my data clears Kerna's part of it on the device where you use it. Both add-ons record usage events as described in 2.6, and errors in the Outlook add-in are reported to Sentry (see Section 6). If you dictate in Compose, your browser's own speech recognition turns speech into text; depending on the browser, this may be done by its maker (for example Google or Microsoft), and Kerna receives only the text.

9.4 Changing or withdrawing your choiceUse the “Cookie settings” link in the footer of any page. Withdrawing is one click, exactly as accepting is. Rejecting there also deletes the Google Analytics cookies already stored on your device, so withdrawal removes the identifier rather than only stopping new collection. Your choice is stored on your device and is requested again after six months, or sooner if the purposes described here change.

9.5 What Google receives, and where it goesWhere analytics are consented to, Google Analytics is provided by Google Ireland Limited, and data may be transferred to Google LLC in the United States under the Standard Contractual Clauses contained in Google's Data Processing Terms, which we have accepted. The property is configured without Google Signals and without advertising features: the advertising consent signals are set to denied in our tag and are never granted, so analytics data is not used for advertising personalisation or remarketing. Data is retained for 14 months.

10. Data Security

We implement industry-standard technical and organizational measures to protect your data:

All data in transit is encrypted using TLS 1.2 or higher.
All data at rest in Firestore is encrypted using AES-256 encryption managed by Google Cloud.
API keys and secrets are kept out of source code and provided to our services at deployment through Google Cloud Secret Manager and encrypted service configuration.
Access to production systems is restricted to authorized personnel using role-based access controls.
Firestore security rules block all writes from browsers and limit what a signed-in user can read to their own and their team's records. Requests from the add-ons read and write only the records of the user and team identified at your Google or Microsoft sign-in. A few administrator functions, protected by a secret key, let authorised staff look up or correct an account.
Once you are signed in, the website proves to our functions that each request comes from it, using Firebase App Check with reCAPTCHA Enterprise (see Sections 6 and 9.2); requests without that proof can be refused.
To protect the service from abuse, we count requests per minute under a keyed hash of your account identifier or IP address; each counter is deleted automatically, normally within a day.
We do not store email content in our databases, logs or backups, so the attack surface for sensitive data exposure is architecturally minimized.

While we implement robust security measures, no system is completely secure. In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Article 33.

11. International Data Transfers

Kerna is based in the European Union (Poland). Our add-on servers run on Google Cloud in Belgium, and your account data is stored in Google Cloud Firestore in Warsaw, Poland.

Certain sub-processors — including OpenAI and Stripe — may process data in the United States. All such international transfers comply with GDPR Chapter V requirements. We ensure adequate safeguards through Standard Contractual Clauses (SCCs) incorporated into our Data Processing Agreements with each sub-processor. Sentry (Functional Software, Inc.) is a US company: the error reports we send it are stored in its EU data region, and Sentry may access them from the United States under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as the alternative safeguard.

Email content sent for AI processing is not retained by OpenAI under our Zero Data Retention terms, and Kerna does not write it to its databases or logs. This significantly reduces the risk profile of any international data transfer involving communication content.

Partner Programme: partners may be established outside the European Economic Area, in the United Kingdom, Switzerland, the United States or Canada. We show a partner information about the clients attributed to it (2.12) only where an adequacy decision of the European Commission covers that partner, or, for a partner in the United States that is not certified under the EU-U.S. Data Privacy Framework, under the European Commission's standard contractual clauses for transfers between controllers, signed before any data is shown.

12. Data Retention

Data Category	Retention Period
Email content (processed)	Not written to our databases, logs or backups. Working copies in server memory: about 30 minutes in the Gmail add-on, a few minutes for shared mailboxes. Outlook add-in: on your device, from a few minutes to 30 days depending on the item (see 9.3).
Account data (email, name)	Kept until you use Delete my data, which takes effect immediately, or ask us to delete it (within 30 days). Uninstalling the add-on does not delete it, and if you use Kerna again the same record is used. After Delete my data, using Kerna again creates a new record.
Subscription and billing data	Retained while your subscription is active. Billing records retained for 7 years for tax compliance.
Usage metrics (token counts)	Current-period token count: reset each billing cycle. Monthly usage counts: kept until you delete your data. On the free plan, Delete my data keeps the current month's token count until the end of that month, under a keyed hash of your email address rather than the address itself, so that deleting and re-creating an account does not reset the free allowance.
Settings and content you create in Kerna (2.4)	Kept until you change or remove them, or delete your data. Gmail Done list: each entry stops applying after 30 days and is then removed the next time you open Inbox Triage.
Analytics data (GA4)	Retained for 14 months per Google Analytics default configuration.
Add-on usage events (keyed hash, 2.6)	Deleted after 90 days.
Welcome, early access and contact records	Kept until you delete your data or ask us to delete it.
Email contact record (Brevo)	Retained while your account is active. Deleted from Brevo automatically when your account is deleted. If you unsubscribe, it is kept only so that we do not email you again.
Team status for Outlook shared mailboxes	Status of a conversation: deleted 90 days after it is marked done, otherwise one year after the last change. Record of who has opened a shared mailbox with Kerna: deleted 180 days after the last use, or when the person leaves the team. Assignment rules: kept until a leader changes them; a team member is taken out of them when they leave the team. Custom statuses: kept until a leader removes them. New emails nobody has handled yet, listed for the team's dashboard: replaced at each count, deleted 30 days after the last. All of it is deleted with the team owner's account.
Send to… destinations and send log	Destination settings: kept until the destination is deleted, and deleted with the account of the team owner (or of the user, when not on a team). Send log: each entry is deleted after 90 days, and a team member's entries are deleted sooner if they delete their data while on the team.
Team membership and invitations (2.10)	Kept while you are on the team or until an invitation is accepted, declined or withdrawn, and deleted with the team owner's account.
Partner Programme: applications, partners and their dashboard users (2.11)	An application that is not accepted is deleted 12 months after our decision. A partner's account and the details of the people with access to its dashboard are kept while the partner agreement lasts and then until claims under it are time-barred. Records needed for accounting and tax (commission entries, statements, invoice numbers, payments, the record of the terms accepted and the withholding tax documents) are kept for 7 years, as billing records are.
Partner Programme: client attribution and deal registrations (2.12, 2.13)	Attribution records and the commission entries that name a client's company or domain are accounting records, kept for 7 years, also after Delete my data. A deal registration is kept while it is open and then with the partner's records.

13. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation:

Right of Access: You may request a copy of the personal data we hold about you.

Right to Rectification: You may request correction of inaccurate or incomplete personal data.

Right to Erasure: You may request deletion of your personal data ("Right to be Forgotten"). You can do this yourself at any time with Delete my data in Kerna's settings in Gmail or Outlook, or on your account page on our website. It takes effect immediately and, in the Outlook add-in, also clears Kerna's storage on that device. If you have a paid subscription, use your account page on our website, which also cancels the subscription. You can also ask us at privacy@kerna.io, and we will delete your data within 30 days.

Right to Restrict Processing: You may request that we restrict the processing of your personal data under certain circumstances.

Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format.

Right to Object: You may object to the processing of your personal data for specific purposes.

Right to Withdraw Consent: Where processing is based on consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@kerna.io. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

14. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe we have collected data from a child, please contact us at privacy@kerna.io.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated Policy on this page and updating the "Effective Date" above. For significant changes affecting how we process your data, we will provide prominent notice via the add-on or email. We encourage you to review this page periodically. Continued use of the Services after changes constitutes acceptance of the updated Policy.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices:

Data Controller: Kerna

Location: Katowice, Poland

Privacy inquiries: privacy@kerna.io

General inquiries: contact@kerna.io

November 5, 2026

Read our Terms of Service