Privacy Policy

Kanava is a professional communication platform for film and television productions. It gives a production a single, organised channel structure so that departments — camera, sound, grip, art, AD, production — can reach each other instantly using push-to-talk on the phones they already carry.

Kanava is operated by Smart Pulse Oy, a company registered in Helsinki, Finland. Smart Pulse Oy is the data controller for personal data processed through the Kanava website, mobile applications and production dashboard.

• Processed in accordance with the EU General Data Protection Regulation (GDPR).
• Hosted on infrastructure located within the European Union.
• Communication encrypted in transit between devices and our services.

This policy explains what we collect, why we collect it, how long we keep it, and the rights you have over it. It is written to be read — not to be skimmed past.

We collect only what is needed to run a production reliably and to bill correctly.

• Name — used to identify you to your crew.
• Email address — account creation, sign-in, invitations and service notices.
• Profile information — department, role and optional avatar.
• Production membership — which productions and channels you belong to, and your status in them.
• Organization information — company name, billing contact and workspace settings for production companies.
• Device information — device model, operating system version, app version and language, used for compatibility and diagnostics.
• Push notification token — to deliver call and production alerts to your device.
• Voice communication metadata — channel, participants, timestamps and connection quality. This is metadata about a transmission, not its content.
• Text chat — messages you send inside a production.
• Uploaded photos and files — call sheets, references and attachments you choose to share.
• Payment information — processed by Stripe. We receive only a customer reference, plan, billing status and invoice records.
• Analytics — aggregated, privacy-respecting usage statistics, where enabled.

Kanava never stores payment card numbers. Card data is entered directly into Stripe and is never held on Kanava systems.

Each use below has a legal basis under the GDPR: performance of a contract (running the service you signed up for), legitimate interests (security, fraud prevention, product reliability), consent (optional analytics and marketing) or legal obligation (accounting and tax).

• Authentication — creating your account and keeping your sessions secure.
• Production communication — routing messages, channels and production updates.
• Push-to-talk — establishing and maintaining live voice sessions between crew members.
• Crew management — invitations, department structure, roles and access.
• Billing — subscriptions, invoices, renewals and plan limits.
• Customer support — answering questions and investigating reported problems.
• Security — detecting abuse, unauthorised access and service disruption.
• Fraud prevention — protecting subscriptions and payment flows.
• Legal compliance — meeting Finnish accounting, tax and statutory obligations.

We do not sell personal data, and we do not use production content to build advertising profiles.

Voice is the core of Kanava, and it is treated with the highest care of any data we handle.

• Voice communications are encrypted in transit.
• Voice is transmitted only to the intended participants of that production channel.
• Voice is not recorded by default.

If a production ever enables an optional recording feature, recording is explicit, visible to participants in the channel and controlled by the production. Recordings created that way belong to the production company, which acts as controller for that content.

Subscription payments are securely processed through Stripe, a PCI-DSS Level 1 certified payment provider. You enter card details directly into Stripe's hosted payment interface.

• Kanava never stores or has access to your card number, CVC or full card details.
• We store a Stripe customer reference, your plan, subscription status and invoice history.
• Invoices and related accounting records may be retained to satisfy Finnish bookkeeping obligations.

Stripe processes payment data as an independent controller under its own privacy policy.

We keep cookies to a minimum and use them for two purposes only.

• Essential cookies — required to sign you in, keep your session active and protect against cross-site request forgery. These cannot be switched off without breaking the service.
• Analytics cookies — where enabled, used to understand aggregate usage so we can improve the product. These are optional and set only with your consent.

You can clear or block cookies in your browser settings at any time. Blocking essential cookies will prevent sign-in from working.

Kanava runs on managed cloud infrastructure with data stored inside the European Union.

• Hosted in secure, access-controlled infrastructure operated by reputable EU providers.
• All data is transmitted over encrypted connections (TLS) and encrypted at rest.
• Employee access is restricted to the minimum required for support and operations, and is logged.
• Regular security monitoring, backups and patching are performed.

Where a subprocessor requires a transfer outside the EEA, it is covered by the European Commission's Standard Contractual Clauses and appropriate supplementary safeguards.

If you are in the European Economic Area, you have the following rights over your personal data.

• Access — obtain a copy of the personal data we hold about you.
• Correction — have inaccurate or incomplete data corrected.
• Deletion — request erasure of your data where no legal obligation requires us to keep it.
• Restriction — ask us to limit processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Complaint — lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

To exercise any of these rights, write to privacy@kanava.app. We respond within one month, as required by the GDPR.

We keep data only for as long as it serves a clear purpose.

• Account and production data is retained while your account is active and for a short grace period afterwards.
• Financial records, including invoices, are retained for the period required by Finnish accounting legislation.
• Deleted accounts are removed or irreversibly anonymised where records must legally be retained.
• Diagnostic and security logs are kept for a limited period and then deleted automatically.

We work with a small number of carefully selected providers. Each is bound by a data processing agreement or acts as an independent controller under its own policy.

• Stripe — subscription billing and payment processing.
• Apple — App Store distribution and push notification delivery.
• Google — Google Play distribution and push notification delivery.
• Expo — mobile application build and update delivery.
• Agora — real-time voice transport for push-to-talk sessions.
• Cloud hosting provider — EU-based application hosting, database and file storage.

Security is a design constraint for Kanava, not a feature added later. Productions handle confidential schedules, locations and talent information, and the platform is built accordingly.

• Encryption of data in transit (TLS) and at rest.
• Authenticated access with secure session handling and password hashing.
• Role-based access controls and row-level authorisation on production data.
• Regular monitoring, logging and review of unusual activity.
• Industry best practices applied across development, deployment and dependency management.

No system can be guaranteed absolutely secure, but we notify affected users and the relevant authority without undue delay if a personal data breach occurs.

Kanava is a professional tool intended for use by film and television production crews. It is not directed at children and is not intended for anyone under the age of 16. We do not knowingly collect personal data from children. If we learn that a child under 16 has created an account, we delete the associated data promptly.

Questions about this policy or about your data are welcome.

• Privacy enquiries — privacy@kanava.app
• Product support — support@kanava.app
• Website — https://kanavaapp.fi
• Smart Pulse Oy, Helsinki, Finland