Privacy Policy

Cana, a product of Colate Ltd (“Cana”, “we”, “us”), provides an agentic workspace for teams — chat, walkie-talkie channels, AI-assisted runs, and file sharing. This policy explains what we collect, why, and your choices.

Who we are

Colate Ltd is the data controller for personal data processed to run your Cana account and our websites. Colate Ltd is a company registered in England and Wales (company number 14882886), registered office 1 Mountbatten View, Houlton, Rugby, CV23 1BJ, United Kingdom.

When an organization uses Cana for its team, the organization decides what its members put into Cana, and for that workspace content Colate Ltd acts as the organization’s processor. If you use Cana through your employer, contact them first about their data; we will help them answer your request.

Information we collect

• Account information — your email address and profile details, to create and secure your account.
• Content you create — messages, walkie-talkie posts, files and images you upload or share into Cana, AI prompts and the responses to them, and related metadata. This is the content needed to provide the service.
• Data from apps you connect — when you connect another app (for example Jira, Slack or Google), the access it grants and the data a task needs from it, such as an issue, a message or a contact.
• Meetings you record — if you use meeting recording, the transcript, summary, action items and decisions. Meeting audio is transcribed and not stored on our servers.
• Support — what you send us when you ask for help, including recordings of a support call if you start one.
• Billing — your plan and billing history. Card details are collected and held by our payment provider, not by us.
• Identifiers and technical data — a user ID, sign-in session data, IP address and device and browser information used to keep the service secure, and on mobile a device token used solely to deliver push notifications you’ve enabled.

How we use your information

We use your information to operate and provide Cana: to authenticate you, deliver and store your messages and files, run AI features and connected apps you invoke, send push notifications you’ve enabled, take payment, answer support requests, and keep the service secure and reliable, including detecting abuse and fixing faults. We do not use your data for advertising.

We review samples of AI requests and responses to keep Cana’s AI features working well (quality, reliability and safety). We do not use your content to train shared or generalized AI models, and we do not sell it.

Legal bases (UK and EU)

• Contract — to provide the service you signed up for: your account, content, AI features, connected apps, notifications, billing and support.
• Legitimate interests — to keep Cana secure, prevent abuse, fix faults and improve the quality of the service, and to understand how visitors use our marketing website. You can object to this processing (see “Your rights”).
• Legal obligation — to keep financial records and respond to lawful requests.
• Consent — for optional cookies and similar technologies on our website, where the law requires consent. You can withdraw consent at any time.

Cookies and similar technologies

• Strictly necessary — a sign-in session cookie that keeps you signed in, and a short-lived cookie used to show previews you open. Cana does not work without these.
• Website analytics — on our marketing website we use first-party analytics and, where enabled, Google Analytics, which set cookies or browser storage to count visits and see which pages are used. They are not loaded in the Cana mobile app or on publicly shared artifacts.

You can block or delete cookies in your browser settings; blocking strictly necessary cookies will stop sign-in from working.

What we do NOT do

• We do not use advertising SDKs or sell data to advertisers.
• We do not track you across other companies’ apps or websites, and we do not use analytics inside the Cana app itself.
• We do not sell your personal information.

Sharing

We share data only with service providers that run parts of the service on our behalf, under agreements that limit their use to providing those services:

• Cloud hosting — stores and runs Cana, including your account and content.
• AI model providers — receive the prompts and context needed to fulfil the requests you make.
• Integration providers — when you connect another app (for example Jira, Slack, HubSpot or Google), an integration provider stores the access tokens for that connection and carries Cana’s requests to the app and the app’s responses back. The data involved is whatever the task needs from that app, such as an issue, a message or a contact.
• Speech-to-text provider — receives meeting audio you record, only to transcribe it.
• Payment provider — processes payments and holds your card details.
• Email delivery — sends the service emails Cana sends you.
• Website analytics providers — receive visit data from our marketing website as described under “Cookies”.

Business customers can ask us for the current list of these providers, by name, at the address below. We may also disclose information if required by law, to protect our rights or the safety of others, or to a buyer as part of a merger or acquisition, under the same protections described here.

International transfers

Cana is hosted in the United States, and some of our providers process data in other countries. When personal data leaves the UK or the European Economic Area, we protect it with recognized safeguards: an adequacy decision (such as the UK–US Data Bridge or the EU–US Data Privacy Framework) where the provider is certified, or the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses. Contact us for a copy of the safeguards that apply.

Data retention & deletion

We retain your account and content while your account is active. You can delete chats, relays and connected apps yourself, and request deletion of your account and associated content by contacting us (see below). We act on deletion requests within one month, and data in backups is removed as those backups expire. We keep billing records for as long as tax law requires (in the UK, six years), and may keep limited records longer where the law requires or to resolve disputes. Samples of AI requests and responses kept for quality review are deleted when you ask us to delete your data.

Security

We protect your data with encryption in transit and at rest, access controls, and standard operational safeguards. If a breach is likely to put your rights at risk, we will tell you and the regulator as the law requires.

Your rights

Depending on where you live (including under UK and EU data protection law), you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or send it to you or another provider in a portable format. Where we rely on consent, you can withdraw it at any time. Email us at connect@colate.io; we reply within one month. We may need to confirm your identity first.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live. We’d appreciate the chance to put it right first.

California residents: we do not sell or share your personal information for cross-context behavioral advertising. You can ask to know, correct or delete the personal information we hold about you, and we will not treat you differently for doing so.

Google user data

When you connect a Google account to Cana, you choose which Google services Cana may use for you. Cana only asks Google for access to the services you connect.

What Cana accesses

• Your basic profile — your name, email address and profile picture, to show which Google account is connected.
• Gmail — sending email for you. Cana’s own Google app does not read, search or change your mailbox.
• Google Calendar and Google Tasks — reading and changing your events and tasks.
• Google Sheets, Docs, Slides and Forms — reading and editing the files and forms you choose or that Cana creates for you, and reading form responses. Cana does not get access to the rest of your Google Drive.
• Google Contacts and your organization’s directory — looking up and updating contacts, for example to find someone’s email address.
• Google Meet — creating meeting spaces and managing their settings.
• Google Analytics and Search Console — reading and managing reports and settings for properties and sites you have access to.

How Cana uses it

Cana uses Google user data only to carry out the tasks you ask for in Cana — in a chat, a relay or an app you set up — and to show you the results. For example: send an email you approved, add a meeting to your calendar, or update a sheet.

Cana’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not use Google user data for advertising.
• We do not sell Google user data.
• We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
• People at Colate do not read your Google data, except with your permission for support, when needed for security, or when the law requires it.

Sharing

To carry out a task you asked for, Cana may send the relevant Google data to the AI model provider handling that task, and only for that task. Access tokens for your connected Google account are held by an integration provider that stores and uses them only on Cana’s behalf, and Cana’s requests to Google and Google’s responses pass through that provider to reach Cana. We do not share Google user data with anyone else, except where the law requires it.

Storage, protection and deletion

Google data is encrypted in transit. Access tokens are stored encrypted and are used only to make the requests your tasks need. Results Cana shows you are kept with your chats and relays until you delete them or your account. You can disconnect a Google account at any time in Cana under Settings → Integrations, which deletes its access tokens; you can also remove Cana from your Google account at myaccount.google.com/permissions. To delete everything else, contact us (see below).

Cana Companion (Chrome extension)

Cana Companion is a Chrome extension that connects tabs you authorize to Cana Desktop running on your own computer. It is covered by this policy; the specifics below describe what the extension itself handles.

What the extension handles

Only for Chrome tabs you explicitly connect to Cana, and tabs Cana creates for you:

• Page URLs, titles, text, DOM structure, element attributes, computed styles, selectors, XPath, and element bounds.
• Screenshots requested by you or your Cana agent.
• Page console output.
• Network request details for managed tabs: URL, method, status, timing, errors, resource type, request and response headers, request bodies where Chrome exposes them, and limited WebSocket frame previews. Headers and request bodies can contain whatever the page sends, including cookies, authorization values and form data. They are held in memory and sent only to the paired Cana Desktop; the extension does not remove or mask any of it.
• Browser actions and form text entered through Cana.
• Messages and files you choose to send from the extension side panel, and Stop/interrupt commands.
• Watches and scheduled jobs you create, or your Cana agent creates at your request: a label, the instruction in your own words, the page URL when the job is tied to a page, the schedule, and a short history (at most 20 entries) of recent check results and notes.
• A random pairing credential used to authenticate the locally installed extension to Cana Desktop.

How the extension uses it

Only to connect tabs you authorized to Cana Desktop, carry out browser actions you request, return browser context to your active Cana session, show connection status in the extension’s own interface, and run the watches and scheduled jobs you created on their schedule, hand each due job to Cana Desktop, and show a Chrome notification when one comes true or is handed over (you can mute notifications per watch).

Where that data goes

The extension talks to Cana Desktop on the same computer over a loopback-only WebSocket (127.0.0.1, ports 47615–47634: 47615–47624 for the installed app, 47625–47634 for a development build). It contains no extension analytics, no advertising SDKs, and no separate remote backend. Cana Desktop may send context to AI or model providers you have configured; that processing is controlled by Cana Desktop and covered by the rest of this policy.

Storage and retention

• The pairing credential, the identifiers of tabs you authorized, and your saved watches and scheduled jobs (including their short result history) are stored in chrome.storage.local and are never synced through Chrome. Deleting a watch removes it; removing the extension clears all of it.
• Network, console, and activity buffers are kept in memory and are lost when the extension worker or browser session ends.
• The desktop-side pairing credential is stored in Cana’s private app-data directory with owner-only access.

Your control

• For the installed app, pairing begins only after you click Pair with Cana Desktop in the popup, and the request must then be approved in Cana Desktop. A development instance explicitly configured for auto-pairing may start pairing automatically; that behavior is not used by the installed app.
• Existing tabs are not connected until you click Use this tab. That grant covers the tab until you release or close it, including pages it later navigates to. Managed tabs are collected into a purple “Cana” tab group so the extent of the grant is visible at a glance.
• You can close managed tabs, stop browser work, unpair the extension in Cana Desktop, remove the extension, or clear its storage. Unpairing invalidates the credential and requires a new explicit desktop approval.

Extension security

After pairing, the credential is never transmitted again: each side proves possession of it with an HMAC challenge/response, so a process that answers on a loopback port can neither obtain the credential nor issue commands. The desktop accepts connections only from a valid Chrome extension origin and binds the credential to that extension ID. Commands are allowlisted, URLs are limited to HTTP and HTTPS, and automation code is injected only into tabs you authorized. The extension attaches the Chrome DevTools Protocol (chrome.debugger) only to managed tabs, for trusted mouse and keyboard input, console and network capture, JavaScript evaluation requested by your Cana agent, and screenshots. A session is held for 30 seconds after the last agent call and then detached, and is detached when the tab is released or closed. The optional nativeMessaging permission is requested only if you enable “Start Cana for scheduled jobs”, and is used only to ask the Cana Desktop native host to launch the app. The extension loads and executes no remotely hosted code. JavaScript that your own paired Cana Desktop asks it to evaluate runs through the Chrome Debugger API on the managed tab; if the debugger cannot attach, a fallback runs the same expression inside the managed page.

The extension does not sell your data, use it for personalized advertising, or share it with data brokers.

Children

Cana is not directed to children under 13 (or the relevant age in your jurisdiction) and we do not knowingly collect their data.

Changes

We’ll post any changes here and update the “Last updated” date. If a change materially affects how we use your personal data, we will tell you by email or in Cana before it takes effect.

Contact

Questions or requests? Email us at connect@colate.io, or write to Colate Ltd, 1 Mountbatten View, Houlton, Rugby, CV23 1BJ, United Kingdom — see also our Support page.