Iru makes the agent your IT department installs on your work laptop, so the interesting question isn't what they collect from website visitors. It's what the thing on your machine sees, and who you can complain to about it. Our read: the collection is granular and tied to your legal name, the complaint channel routes back to the employer who installed it, and the document contradicts itself on whether your data goes to marketing partners — not once, but across a narrative section, a table, and a legal denial that no two of which agree. There's also a promised opt-out with no visible mechanism to exercise it, and open-ended retention with no ceiling. And the sentence defining who "we" even means still names three Kandji subsidiaries. The company rebranded; the policy didn't. Someone opened this file in October 2025, edited it, saved it, and walked straight past the old company name in paragraph one. Keep that in mind when you reach the part about reasonable technical and organizational measures. If you're an employee: ask IT what Iru configuration is on your device and what it transmits — Iru won't tell you, by their own rules. Turn on GPC in every browser, individually. If you're signing the contract: put a number of days on retention in the MSA, and demand notice of policy changes instead of silent posting. This is our opinion on the text as published, read against the revision last modified October 22, 2025. Not legal advice — a contract that matters deserves a real lawyer.
In relation to our services, we collected information such as time since last device boot, app store download activity for each device, activity history of each device such as when our services initiated a change on the device (i.e., installing an application, logging if the device is missing), applications installed on device including the date such application was last modified.
"App store download activity for each device" doesn't mean IT knows you have apps. It means there's a timestamped record of every download and exactly when you did it. They know you pulled that game onto the work laptop at 2:47 on a Tuesday. They know you did it again Wednesday. The "I'm evaluating it for research" defense is available to you; the timestamps are available to them. Stack it with time since last boot, activity history, and every installed app with its last-modified date, and what you have is a log of your working day.
Identifiers. We collect unique identifier for authorized devices, device name, device model and operating system, enrollment dates, serial number of device, username, asset tag, file paths, file names, photographic headshots, Internet Protocol address, email address, real name, postal address, and other similar identifiers.
This is the clause that makes the previous one bite. The activity log isn't attached to an anonymous device ID — it's joined to your serial number, your username, your real name, and your headshot. File paths and file names are in there too. Nothing here is aggregate.
If you are using the Iru service through a corporate account, please contact the company in question with any request associated with the following rights. Any submission to us will be forwarded to the company associated with your account.
Now try complaining about it. You can't make Iru show you what it holds or delete it. You ask the people who chose to install it, and nothing in this document says they have to answer. The rights listed immediately below this paragraph are, for most of the people this software watches, a description of someone else's rights.
In addition to the categories listed above, the customer, rather than Iru, determines which additional categories of personal information exist and will be disclosed to and processed by Iru Companies in the provisioning of our services
The policy admits its own list isn't the list. The honest answer to "what does Iru have on me" is: whatever your employer configured it to collect. This document won't tell you, and to its credit it doesn't pretend otherwise — which is precisely why reading it carefully still leaves you in the dark.
We will retain and use your information for as long as we need it to provide you services or products, or as long as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
No number, no schedule, no ceiling. "Resolve disputes" and "enforce our agreements" have no end date, so neither does the file.
We have not “shared” and do not “share” (as those terms are defined in the CCPA) personal information.
Flat denial, stated in the California section. Hold onto it while you read the next clause.
Marketing/Analytics/Advertising Partners: We may share personal information with third party marketing, analytics or advertising partners, including social media platforms and networks, for commercial purposes such as sending you marketing emails.
Two sections above the denial. And the business-purpose disclosure table sitting directly beneath the denial lists only service providers and corporate customers as recipients — marketing partners aren't in it at all. That's not one contradiction, it's three documents in a trenchcoat: a narrative section, a table, and a legal denial, no two agreeing. The CCPA definition of "share" is narrow enough that all three might survive a lawyer's reading. A reader trying to find out where their data goes is not so lucky.
We will provide an individual opt-out or opt-in choice before we share your data with third parties other than our service providers, or before we use it for a purpose other than which it was originally collected or subsequently authorized.
Go find it. Not in the cookie section. Not in the rights section, which offers a webform, an email address, and a phone number answered by people who — if you're on a corporate account — will forward your request to your boss. The choice is promised in the same document that provides no way to make it. Elsewhere: do-not-track signals are ignored outright, and GPC covers only online sharing, one browser at a time.
This Privacy Policy describes how Iru Companies (“we”, “us”, Iru, Inc., Kandji UK Limited, Kandji Singapore Pty Ltd., Kandji Australia Pty Ltd. and its Affiliates)
A privacy policy is the document a company is supposed to be most careful with. It's the one the lawyers sign. So it's worth noticing that the very first sentence — the one establishing which legal entities this policy even binds — still names three Kandji subsidiaries. The company rebranded; the policy didn't. Someone opened this file in October 2025, edited it, saved it, and walked straight past the old company name in paragraph one. Now re-read the part about reasonable technical and organizational measures and decide how much confidence you're bringing to it.