Privacy Policy

Krane Inc Privacy Policy

Effective: July 10th, 2026 · Last reviewed: July 10th, 2026 · Version 2.0

At a glance

Your data is yours. Krane holds it as custodian and never claims ownership. We do not train AI models on identifiable data. We do not sell or share personal information, and we do not use it for advertising. Access is scoped to the project you are added to. We maintain a SOC 2 Type II examination, and the report is available under NDA.

Scope and Our Two Roles
This Policy covers our websites (the “Site”), our web and mobile applications (the “Platform”), and our sales, support, and recruiting activity. Together, the “Services.”
It is a notice, not a contract. Where a customer agreement or Data Processing Addendum covers the same subject, that agreement governs.
Your data belongs to you
You retain full ownership of what you load into Krane, including calculated, derived, and transformed data linked to you or your projects, and the configurations and assumptions your team creates. We act as custodian and processor on your behalf, and never claim ownership.
Krane as a processor
Customers upload and generate project information on the Platform: shipment origins and destinations, delivery instructions, orders, schedules, submittals, documents, photos, drawings, and the details of the people involved. This is Customer Content, and we handle it only on the controlling customer’s instructions. That customer decides what is collected, who sees it, and when it goes.
If you work for, or with, one of our customers and want to access, correct, or delete information held in their account, contact them. We support them in responding. See Section 7.5.
Krane as a controller
We decide how we handle information collected for our own purposes: account administration, Site visitors, sales and support, security, billing, and recruiting. That is what the rest of this Policy describes.
What We Collect
We collect personal information that is reasonably necessary and proportionate for the purposes described in this Policy. Data enters the Platform through your team’s input, your file uploads, and integrations you authorize.
From you: name, business contact details, employer, and job title; account credentials and authentication data; company and billing details; roles and permissions set by your administrator; the content of support and sales enquiries; marketing preferences; and, if you apply for a job, your application materials and professional history.
Automatically: device and browser details, IP address, pages and features used, actions and timestamps, referring URLs, and error diagnostics. We derive approximate, city-level location from IP address for security and analytics. We use cookies and similar technologies as described in Section 5.
Sensitive information
Your project data routinely contains confidential business information, including client relationships, supplier details, locations, and pricing. The Platform is built for that, and we protect it under your agreement with us.
Sensitive personal information as California law defines it is different. We collect a limited amount of it, specifically the credentials that let you into your account, and we use it only to authenticate you and keep the Services secure. We do not use sensitive personal information to infer characteristics about anyone, which is the use the right to limit covers. Please do not upload government identification numbers, financial account numbers, or health information.
How We Use It
To operate, secure, and support the Services; to authenticate users; to deliver the AI features in Section 4; to respond to enquiries; to send service messages and, unless you opt out, marketing; to detect and prevent fraud and security incidents; to meet legal, tax, and audit obligations; to evaluate job candidates; and to analyze usage and improve the Services.
Improvement uses aggregated, de-identified data and operational metadata such as error rates and feature usage. We do not use identifiable Customer Content to build or improve features for any other customer.
We use Customer Content only as the controlling customer instructs, to deliver and secure the Services, and as law requires.
AI Features
Krane does not train on identifiable data. We do not use your identifiable data to train or fine-tune AI models, whether managed by Krane or operated by our AI subprocessors. There is no consent flow and no setting that changes it.
Prompts and outputs are Customer Content. They stay in your account, subject to the permissions your administrator sets.
Model providers. Our AI subprocessors are OpenAI and Google (Gemini). They act on our instructions under agreements that prevent them from using your data to train their foundation models and that limit how long they retain it.
Scoped processing. Only the data needed for a specific task is sent for processing. We do not transmit bulk customer data for AI processing.
Human review. Access to Customer Content by Krane personnel, prompts and outputs included, is limited to a defined set of operations staff with a genuine business need, and every access is logged.
De-identified analytics. Data used to improve the product and provide benchmarking is aggregated and de-identified so it cannot reasonably be linked back to you, your clients, or your projects. See Section 10.
Cookies and Your Choices
We use strictly necessary cookies for authentication, sessions, and security; functional cookies for preferences; and analytics cookies and SDKs to understand usage and diagnose problems. We do not use advertising cookies, and we do not sell or share personal information for cross-context behavioral advertising.
Use our cookie settings to choose which categories this site may use, or manage cookies through your browser settings. Strictly necessary cookies cannot be disabled without breaking the Services.
Because we do not sell or share personal information for cross-context behavioral advertising, we do not currently carry out processing that an opt-out would apply to. We recognize opt-out preference signals such as Global Privacy Control where applicable law requires.
You can unsubscribe from marketing in any marketing email, or by writing to privacy@krane.tech. We will still send service messages about your account. Mobile app permissions are controlled through your device settings. Declining an optional permission may limit a feature, but never affects your price or the quality of service you receive.
Who We Disclose To
Project participants. The Platform coordinates work across companies. When your organization connects a general contractor, subcontractor, or supplier to a project, information in that project becomes visible to the people your administrator authorizes, including your name, business contact details, your activity, and what you contribute. Those companies are independent of Krane, and their own privacy practices govern what they do with it.
Service providers, acting on our instructions under written contracts restricting them to that purpose: cloud infrastructure (Amazon Web Services), AI model providers (Section 4), monitoring, error tracking and analytics, support tooling, email delivery, identity management, billing, and compliance automation. We host and process Customer Content in the United States, and our vendors are US-based. Those vendors’ own subprocessors may process limited personal information in other jurisdictions, under contractual safeguards. A current list of subprocessors is available on request.
Legal, where law or enforceable legal process requires, to enforce our agreements, to investigate fraud or security incidents, and to establish or defend legal claims. Where we are permitted to, we notify the affected customer of demands for their Customer Content.
Integrations you authorize. When your administrator connects the Platform to another system, data is exchanged with that system as described at the point of connection. Those systems are controlled by their providers rather than by Krane, and their own privacy policies govern what they do with the data.
Business transactions, in a merger, acquisition, financing, or sale of assets, subject to the acquirer maintaining protections no less protective than this Policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Your Privacy Rights
Residents of California and other states with comprehensive privacy laws have the rights below. We extend them to everyone who asks.
1. Rights
  Know and access what we hold, with categories, sources, purposes, and recipients. Correct inaccurate information. Delete your information, subject to legal exceptions, which we may do by erasing it or by de-identifying it. Receive a portable copy. Opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects, none of which we do. Limit the use of sensitive personal information, which we do not use to infer characteristics. Withdraw consent where we relied on it.
  And exercise any of these without penalty. We will not deny service, change your price, or lower your service quality because you did.
2. Making a request
  Email privacy@krane.tech. We verify your identity using information we already hold before acting, and will ask for more only where the request warrants it. An authorized agent may act for you with your signed permission or a power of attorney, and we may contact you to confirm.
  We respond within 45 days, and will tell you if we need up to 45 more. If we decline, we explain why, and you may appeal by replying with “Appeal” in the subject line. We answer appeals in writing within 60 days and will tell you how to contact your state attorney general.
3. California disclosures
  In the preceding 12 months we collected the categories in Section 2: identifiers, customer records, commercial information, internet and network activity, approximate geolocation, professional and employment information, and audio, electronic and visual information contained in project documents, photos, and videos. We collected them from the sources and for the purposes in Sections 2 and 3, and disclosed them to the recipients in Section 6. We did not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
4. Complaints
  Write to privacy@krane.tech. We log every privacy complaint, investigate it, and respond in writing. You may also complain to your state attorney general.
5. Requests about Customer Content
  Most information on the Platform belongs to the customer who controls the account, and we act only on their instructions. A request to remove or correct that information has to be approved by them, so we will refer you to them, or act once they instruct us.
  Requests about information Krane controls, such as your marketing preferences, a support enquiry, or a job application, we handle ourselves. If you are unsure which company controls an account, ask us and we will point you in the right direction.

Retention and Exit

We keep personal information only as long as we need it, or as long as law requires.

Category	How long we keep it
Customer Content	Life of the account, then as described below
Account records	Life of the account, then a limited period to resolve disputes and meet legal obligations
Security and audit logs	As long as our security and audit controls require
Backups	Roll off automatically within 30 days
Support and sales correspondence	As long as needed to support you, then a limited period for reference and legal claims
Marketing contacts	Until you unsubscribe; a suppression record is kept indefinitely so we do not contact you again
Job applicants	At least four years, as California law requires
Billing and tax records	As tax and accounting law requires, generally seven years
Aggregated and de-identified data	Indefinitely, subject to Section 10

On termination we inactivate the account and stop active processing, except where security, legal, compliance, or operational needs require otherwise. On written request, we de-identify relational data, delete stored file assets, and confirm in writing, completing requested actions within 90 days. De-identification strips the identifiers linking records to individuals, customers, and projects, and is not reversible.

We may retain information longer where law, a legal hold, or the defense of a legal claim requires it.

Security
Data is encrypted in transit and at rest. The Platform is hosted on Amazon Web Services with logical tenant isolation at the application, database, and storage layers.
Access controls include single sign-on (SAML 2.0 and OIDC), multi-factor authentication, and role-based access control. Projects are designed as access boundaries: users and external partners are added explicitly and granted a role scoping what they can see and do, so an invited supplier or trade partner is not given access to your other projects or organization-wide data. Internal access by Krane personnel is restricted to staff with a business need, and administrative access is logged.
Application activity generates audit entries, and infrastructure events are captured through centralized log management.
Krane undergoes recurring SOC 2 Type II examinations by an independent auditor. The most recent examination concluded that our controls were appropriately designed and operating effectively during the review period. The report is available to customers and qualified prospects under NDA. Write to security@krane.tech.
We maintain a documented Incident Response Policy and response plan, tested annually. If a security incident affects your data, we notify your designated contact in accordance with that policy, and notify individuals and regulators where law requires.
No system is perfectly secure, and we cannot guarantee absolute security.
Aggregated and De-Identified Information
We create aggregated and de-identified information from data in the Services and use it for analytics, benchmarking, reporting, and improving the Services. Any model training uses de-identified data of this kind, never identifiable data.
We maintain and use this information in de-identified form, we do not attempt to re-identify it except to test that the de-identification works, and we contractually require the same of anyone we provide it to. We take reasonable measures to ensure it cannot be associated with any individual, household, or customer.
Children, Changes, and Contact
The Services are built for construction professionals and are not directed to anyone under 18. We do not knowingly collect their information, and we do not sell or share the personal information of anyone under 16. If we learn that we have collected personal information directly from a minor for our own purposes, we will delete it. Where that information sits in Customer Content, we will work with the controlling customer to address it. Write to privacy@krane.tech.
The Services also link to third-party websites, which are governed by their own privacy policies rather than this one.
We review this Policy at least every 12 months and update the “Last reviewed” date whether or not anything changes. We communicate material changes to affected customers before they take effect, and obtain consent where required. Prior versions are available on request.
Krane, Inc. – Privacy Officer1200 E Hillsdale Blvd, Foster City, CA 94404
Privacy: privacy@krane.tech
Security: security@krane.tech

Krane Inc Privacy Policy

Effective: July 10th, 2026 · Last reviewed: July 10th, 2026 · Version 2.0

At a glance

Scope and Our Two Roles

This Policy covers our websites (the “Site”), our web and mobile applications (the “Platform”), and our sales, support, and recruiting activity. Together, the “Services.”

It is a notice, not a contract. Where a customer agreement or Data Processing Addendum covers the same subject, that agreement governs.

Your data belongs to you

You retain full ownership of what you load into Krane, including calculated, derived, and transformed data linked to you or your projects, and the configurations and assumptions your team creates. We act as custodian and processor on your behalf, and never claim ownership.

Krane as a processor

Customers upload and generate project information on the Platform: shipment origins and destinations, delivery instructions, orders, schedules, submittals, documents, photos, drawings, and the details of the people involved. This is Customer Content, and we handle it only on the controlling customer’s instructions. That customer decides what is collected, who sees it, and when it goes.

If you work for, or with, one of our customers and want to access, correct, or delete information held in their account, contact them. We support them in responding. See Section 7.5.

Krane as a controller

We decide how we handle information collected for our own purposes: account administration, Site visitors, sales and support, security, billing, and recruiting. That is what the rest of this Policy describes.

What We Collect

We collect personal information that is reasonably necessary and proportionate for the purposes described in this Policy. Data enters the Platform through your team’s input, your file uploads, and integrations you authorize.

From you: name, business contact details, employer, and job title; account credentials and authentication data; company and billing details; roles and permissions set by your administrator; the content of support and sales enquiries; marketing preferences; and, if you apply for a job, your application materials and professional history.

Automatically: device and browser details, IP address, pages and features used, actions and timestamps, referring URLs, and error diagnostics. We derive approximate, city-level location from IP address for security and analytics. We use cookies and similar technologies as described in Section 5.

Sensitive information

Your project data routinely contains confidential business information, including client relationships, supplier details, locations, and pricing. The Platform is built for that, and we protect it under your agreement with us.

Sensitive personal information as California law defines it is different. We collect a limited amount of it, specifically the credentials that let you into your account, and we use it only to authenticate you and keep the Services secure. We do not use sensitive personal information to infer characteristics about anyone, which is the use the right to limit covers. Please do not upload government identification numbers, financial account numbers, or health information.

How We Use It

To operate, secure, and support the Services; to authenticate users; to deliver the AI features in Section 4; to respond to enquiries; to send service messages and, unless you opt out, marketing; to detect and prevent fraud and security incidents; to meet legal, tax, and audit obligations; to evaluate job candidates; and to analyze usage and improve the Services.

Improvement uses aggregated, de-identified data and operational metadata such as error rates and feature usage. We do not use identifiable Customer Content to build or improve features for any other customer.

We use Customer Content only as the controlling customer instructs, to deliver and secure the Services, and as law requires.

AI Features

Krane does not train on identifiable data. We do not use your identifiable data to train or fine-tune AI models, whether managed by Krane or operated by our AI subprocessors. There is no consent flow and no setting that changes it.

Prompts and outputs are Customer Content. They stay in your account, subject to the permissions your administrator sets.

Model providers. Our AI subprocessors are OpenAI and Google (Gemini). They act on our instructions under agreements that prevent them from using your data to train their foundation models and that limit how long they retain it.

Scoped processing. Only the data needed for a specific task is sent for processing. We do not transmit bulk customer data for AI processing.

Human review. Access to Customer Content by Krane personnel, prompts and outputs included, is limited to a defined set of operations staff with a genuine business need, and every access is logged.

De-identified analytics. Data used to improve the product and provide benchmarking is aggregated and de-identified so it cannot reasonably be linked back to you, your clients, or your projects. See Section 10.

Cookies and Your Choices

We use strictly necessary cookies for authentication, sessions, and security; functional cookies for preferences; and analytics cookies and SDKs to understand usage and diagnose problems. We do not use advertising cookies, and we do not sell or share personal information for cross-context behavioral advertising.

Use our cookie settings to choose which categories this site may use, or manage cookies through your browser settings. Strictly necessary cookies cannot be disabled without breaking the Services.

Because we do not sell or share personal information for cross-context behavioral advertising, we do not currently carry out processing that an opt-out would apply to. We recognize opt-out preference signals such as Global Privacy Control where applicable law requires.

You can unsubscribe from marketing in any marketing email, or by writing to privacy@krane.tech. We will still send service messages about your account. Mobile app permissions are controlled through your device settings. Declining an optional permission may limit a feature, but never affects your price or the quality of service you receive.

Who We Disclose To

Project participants. The Platform coordinates work across companies. When your organization connects a general contractor, subcontractor, or supplier to a project, information in that project becomes visible to the people your administrator authorizes, including your name, business contact details, your activity, and what you contribute. Those companies are independent of Krane, and their own privacy practices govern what they do with it.

Service providers, acting on our instructions under written contracts restricting them to that purpose: cloud infrastructure (Amazon Web Services), AI model providers (Section 4), monitoring, error tracking and analytics, support tooling, email delivery, identity management, billing, and compliance automation. We host and process Customer Content in the United States, and our vendors are US-based. Those vendors’ own subprocessors may process limited personal information in other jurisdictions, under contractual safeguards. A current list of subprocessors is available on request.

Legal, where law or enforceable legal process requires, to enforce our agreements, to investigate fraud or security incidents, and to establish or defend legal claims. Where we are permitted to, we notify the affected customer of demands for their Customer Content.

Integrations you authorize. When your administrator connects the Platform to another system, data is exchanged with that system as described at the point of connection. Those systems are controlled by their providers rather than by Krane, and their own privacy policies govern what they do with the data.

Business transactions, in a merger, acquisition, financing, or sale of assets, subject to the acquirer maintaining protections no less protective than this Policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Your Privacy Rights

Residents of California and other states with comprehensive privacy laws have the rights below. We extend them to everyone who asks.

Rights
Know and access what we hold, with categories, sources, purposes, and recipients. Correct inaccurate information. Delete your information, subject to legal exceptions, which we may do by erasing it or by de-identifying it. Receive a portable copy. Opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects, none of which we do. Limit the use of sensitive personal information, which we do not use to infer characteristics. Withdraw consent where we relied on it.
And exercise any of these without penalty. We will not deny service, change your price, or lower your service quality because you did.
Making a request
Email privacy@krane.tech. We verify your identity using information we already hold before acting, and will ask for more only where the request warrants it. An authorized agent may act for you with your signed permission or a power of attorney, and we may contact you to confirm.
We respond within 45 days, and will tell you if we need up to 45 more. If we decline, we explain why, and you may appeal by replying with “Appeal” in the subject line. We answer appeals in writing within 60 days and will tell you how to contact your state attorney general.
California disclosures
In the preceding 12 months we collected the categories in Section 2: identifiers, customer records, commercial information, internet and network activity, approximate geolocation, professional and employment information, and audio, electronic and visual information contained in project documents, photos, and videos. We collected them from the sources and for the purposes in Sections 2 and 3, and disclosed them to the recipients in Section 6. We did not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
Complaints
Write to privacy@krane.tech. We log every privacy complaint, investigate it, and respond in writing. You may also complain to your state attorney general.
Requests about Customer Content
Most information on the Platform belongs to the customer who controls the account, and we act only on their instructions. A request to remove or correct that information has to be approved by them, so we will refer you to them, or act once they instruct us.
Requests about information Krane controls, such as your marketing preferences, a support enquiry, or a job application, we handle ourselves. If you are unsure which company controls an account, ask us and we will point you in the right direction.

Retention and Exit

We keep personal information only as long as we need it, or as long as law requires.

Category	How long we keep it
Customer Content	Life of the account, then as described below
Account records	Life of the account, then a limited period to resolve disputes and meet legal obligations
Security and audit logs	As long as our security and audit controls require
Backups	Roll off automatically within 30 days
Support and sales correspondence	As long as needed to support you, then a limited period for reference and legal claims
Marketing contacts	Until you unsubscribe; a suppression record is kept indefinitely so we do not contact you again
Job applicants	At least four years, as California law requires
Billing and tax records	As tax and accounting law requires, generally seven years
Aggregated and de-identified data	Indefinitely, subject to Section 10

We may retain information longer where law, a legal hold, or the defense of a legal claim requires it.

Security

Data is encrypted in transit and at rest. The Platform is hosted on Amazon Web Services with logical tenant isolation at the application, database, and storage layers.

Access controls include single sign-on (SAML 2.0 and OIDC), multi-factor authentication, and role-based access control. Projects are designed as access boundaries: users and external partners are added explicitly and granted a role scoping what they can see and do, so an invited supplier or trade partner is not given access to your other projects or organization-wide data. Internal access by Krane personnel is restricted to staff with a business need, and administrative access is logged.

Application activity generates audit entries, and infrastructure events are captured through centralized log management.

Krane undergoes recurring SOC 2 Type II examinations by an independent auditor. The most recent examination concluded that our controls were appropriately designed and operating effectively during the review period. The report is available to customers and qualified prospects under NDA. Write to security@krane.tech.

We maintain a documented Incident Response Policy and response plan, tested annually. If a security incident affects your data, we notify your designated contact in accordance with that policy, and notify individuals and regulators where law requires.

No system is perfectly secure, and we cannot guarantee absolute security.

Aggregated and De-Identified Information

We create aggregated and de-identified information from data in the Services and use it for analytics, benchmarking, reporting, and improving the Services. Any model training uses de-identified data of this kind, never identifiable data.

We maintain and use this information in de-identified form, we do not attempt to re-identify it except to test that the de-identification works, and we contractually require the same of anyone we provide it to. We take reasonable measures to ensure it cannot be associated with any individual, household, or customer.

Children, Changes, and Contact

The Services are built for construction professionals and are not directed to anyone under 18. We do not knowingly collect their information, and we do not sell or share the personal information of anyone under 16. If we learn that we have collected personal information directly from a minor for our own purposes, we will delete it. Where that information sits in Customer Content, we will work with the controlling customer to address it. Write to privacy@krane.tech.

The Services also link to third-party websites, which are governed by their own privacy policies rather than this one.

We review this Policy at least every 12 months and update the “Last reviewed” date whether or not anything changes. We communicate material changes to affected customers before they take effect, and obtain consent where required. Prior versions are available on request.

Krane, Inc. – Privacy Officer1200 E Hillsdale Blvd, Foster City, CA 94404
Privacy: privacy@krane.tech
Security: security@krane.tech