Privacy Policy
This Privacy Policy describes how Kavanah Media, a Tennessee nonprofit corporation and Section 501(c)(3) tax-exempt organization ("Kavanah Media," "we," "us," or "our"), collects, uses, and shares information when you use the Kavanah Analytics application and related services (the "Service"). Kavanah Analytics provides marketing analytics, campaign reporting, and Page performance dashboards for mission organizations and their teams. By using the Service, you agree to the practices described here.
1. Who we are
The Service is operated by Kavanah Media, a Tennessee nonprofit corporation headquartered in Maryville, Tennessee, USA, and recognized as a 501(c)(3) tax-exempt organization. For privacy questions, our point of contact is the Kavanah Media Privacy Team, reachable at privacy@kavanahanalytics.com. Kavanah Media acts as the data controller for personal information collected through Kavanah Analytics, except where we process information on behalf of a customer organization, in which case we act as a data processor for that organization.
2. Information we collect
2.1 Information you provide
- Account information. Name, email address, organization, role, and password (stored hashed) when you register or are invited to a workspace.
- Workspace and profile content. Team and organization assignments, profile preferences, and any content you submit through the Service.
- Communications. Messages you send to support, feedback, and any information you choose to share with us.
2.2 Information collected automatically
- Device and browser data. IP address, user agent, browser type, operating system, language, and time zone.
- Server and request logs. Timestamps, request paths, response codes, and error traces, retained for security and reliability.
- Usage data. Pages visited, features used, dashboards opened, and interaction events. We use first-party analytics for product improvement.
- Cookies and similar technologies. Strictly necessary cookies for authentication and session state, plus optional analytics cookies that you can disable.
2.3 Information from third parties
If you sign in with a third-party identity provider (for example, Google or Meta) we receive your name, email address, and a unique identifier from that provider. We may also receive information from your organization's administrator when they invite you or assign you to a team.
3. Information from Meta platforms
When you connect a Facebook Page, Instagram Account, Ad Account, or Business Manager asset to Kavanah Analytics, we use the Meta Graph API to retrieve data on your behalf. The specific data we read depends on the permissions you grant. Categories may include:
| Category | Examples | Permissions used |
|---|---|---|
| Page insights and engagement | Page name, follower count, post reach, engagement, video views, post-level metrics | pages_show_list, pages_read_engagement |
| Instagram insights | Instagram Business or Creator account profile, post and story metrics, audience insights tied to the connected Page | instagram_basic, instagram_manage_insights |
| Ad account and ad performance | Ad accounts you manage, campaigns, ad sets, ads, spend, impressions, clicks, results (read-only) | ads_read |
| Business Manager | Business name, business ID, list of Pages/Ad Accounts assigned to the business, asset metadata | business_management |
| Authentication | Your Meta user ID and name used to sign in or link your account | public_profile |
We store an OAuth access token (and refresh token, where applicable) so that we can refresh dashboards on a schedule. We do not request, store, or process your Meta password. You may revoke our access at any time from your Meta account settings, which will sever our ability to refresh data.
Our use of information received from Meta is restricted by the Meta Platform Terms and Developer Policies. We do not use data obtained through Meta to make eligibility decisions about users, to sell or license to data brokers, or for advertising purposes.
4. How we use information
We use the information described above for the following purposes:
- Provide the Service. Authenticate you, render dashboards, generate reports, and surface insights on the Meta assets you have connected.
- Operate and secure the Service. Detect abuse, prevent fraud, debug errors, monitor performance, and maintain audit logs.
- Improve the Service. Aggregate, anonymized usage patterns to improve features and reliability.
- Communicate with you. Respond to support requests and send service-related notices (for example, security alerts or material changes to terms).
- Comply with law. Meet legal, regulatory, and contractual obligations, and respond to lawful requests.
5. How we share information
We do not sell your personal information. We share information only as described below:
- Within your workspace. Information you submit, and Meta data you have connected, is visible to other authorized members of your team or organization based on the permissions assigned to them.
- Service providers. Vetted vendors who help us host, secure, monitor, and support the Service, including cloud hosting, error tracking, email delivery, and customer support tools. These providers are bound by contracts that restrict their use of information to providing services to us.
- Legal and safety. When required by applicable law, regulation, legal process, or governmental request; to enforce our Terms; or to protect the rights, safety, and security of users and the public.
- Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality safeguards.
6. Data retention
We retain personal information only as long as necessary to provide the Service or as required by law:
- Account information — retained while your account is active and for up to 90 days after deletion to allow recovery and meet legal obligations.
- Meta access tokens — retained while the connection is active. Revoked or expired tokens are deleted within 30 days.
- Cached Meta insights — retained for the time window needed to render historical reports, configurable by your organization administrator. Default retention is 25 months, mirroring the Meta Insights API window.
- Server and security logs — retained for up to 13 months for incident response and audit, then automatically purged.
When retention expires, data is deleted or anonymized so it can no longer be associated with you.
7. Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Request deletion of your information.
- Object to or restrict certain processing.
- Receive a portable copy of your information.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with a supervisory authority.
To exercise any of these rights, email privacy@kavanahanalytics.com. We will respond within the timeframes required by applicable law (generally within 30 days). We may need to verify your identity before fulfilling a request.
8. Deleting your data
You can request deletion of your data at any time in two ways:
- From your Meta account. Visit Settings & Privacy → Settings → Apps and Websites, locate "Kavanah Analytics," and click Remove. Meta will send us a Data Deletion Request, and we will delete your associated data within 30 days.
- By contacting us. Email privacy@kavanahanalytics.com with the subject line "Data Deletion Request" and we will process your request.
Step-by-step instructions, the data deletion callback URL used by Meta, and a confirmation tracking flow are available at kavanahanalytics.com/legal/data-deletion.
9. Security
We protect information using a defense-in-depth approach: encryption in transit (TLS 1.2+) and at rest, least-privilege access controls, audit logging, environment isolation, automated dependency scanning, and routine security review. No method of transmission or storage is 100% secure, but we work hard to protect your information and to notify you if a breach affects you, in line with applicable law.
10. Children's privacy
The Service is intended for use by adults working in or with mission and ministry organizations. It is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect information from children. If you believe a child has provided us with information, please contact us so we can delete it.
11. International data transfers
Kavanah Analytics is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, processed in, and stored in the United States. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) to provide an adequate level of protection for personal information transferred internationally.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where required, provide additional notice (for example, an in-app banner or email). Continued use of the Service after the update constitutes acceptance of the revised policy.
13. Contact us
Questions, requests, and complaints about this policy or our privacy practices can be sent to:
Kavanah Media — Privacy Team
Email: privacy@kavanahanalytics.com
Web: kavanahanalytics.com/legal/privacy