Skip to content

Legal

Privacy Policy

Last updated: July 14, 2026

Who we are

KanBit is a hosted project management service operated by the company that owns kanbit.pro. This page describes what data we collect, why, and what your rights are. For anything that is not clear, email us at [email protected].

Important: This is an honest scaffold, not a final legal document. Before going live, review with a qualified lawyer in your jurisdiction and replace this block with your company details and data protection officer contact.

What we collect

  • Account data. Your email, display name, password hash, optional avatar and timezone. You give us this when you sign up.
  • Workspace content. Everything you put into tasks, epics, comments, documents, attachments, sprints, CRM records (including the companies, contacts, and deals you track), and time entries. You own this; we store and serve it.
  • Usage telemetry. Anonymized page views on kanbit.pro via Plausible (no cookies, no cross-site tracking). Error reports via Sentry / GlitchTip to help us fix bugs. Neither set contains workspace content.
  • Billing data. Handled by Stripe. We store a Stripe customer ID only. We never see your card number, expiry, or CVC.
  • Contact form submissions. Name, email, optional company, message, IP, and user agent, so we can reply. Stored in an internal contact_submissions table and deleted after 365 days.
  • Integration tokens. If you connect GitHub or GitLab, the OAuth token is stored encrypted at rest and scoped to a single workspace.

Why we collect it

  • To run the service: authenticate you, route your requests to the right workspace, send transactional email.
  • To fix bugs: Sentry error reports include stack traces and request metadata.
  • To bill you: Stripe needs a customer record for subscriptions.
  • To respond to you: contact form data goes to our inbox.

Who we share it with

  • Stripe — payment processing.
  • Sentry / GlitchTip — error monitoring.
  • Resend — transactional email delivery (password resets, notifications, contact responses).
  • Plausible — aggregated analytics, no cookies, no PII.
  • Our infrastructure provider — hosts the service.

We do not sell your data. We do not use your workspace content to train any AI model.

Where your data lives

Our production database lives on EU-operated infrastructure. Stripe stores billing metadata in their own regions per their terms. If you need a signed data processing agreement, email [email protected].

Retention

  • Active subscription: your data stays for as long as your subscription is active.
  • Cancelled: we retain your workspace data for 30 days so you can export, then delete it.
  • Contact form submissions: deleted automatically after 365 days.
  • Error reports: rolling 90-day window in Sentry / GlitchTip.

Your rights

Under GDPR you can:

  • Access the data we hold about you.
  • Export your workspace content as CSV or JSON, any time, from the app.
  • Request deletion of your account and all associated data.
  • Object to processing or ask for it to be restricted.
  • Lodge a complaint with your local supervisory authority.

Email [email protected] for any of the above and we will respond within 30 days. Account deletion is self-serve from the settings page.

AI and training

We do not use your workspace content to train any machine learning model. The only AI features in the product are (1) pgvector embedding search over your own data, (2) duplicate detection on new tasks, (3) optional, explicit title / description suggestions, (4) Ask KanBit, which answers plain-language questions over your CRM data and is read-only by design, and (5) AI attributes, which generate a CRM field value only when you configure and trigger them. Each is scoped to the workspace you trigger it from and metered by monthly AI credits.

Cookies

See our Cookie Policy for details. Short version: we use the minimum cookies required for authentication and a few functional preferences (theme, locale). No advertising cookies. Plausible is cookieless.

Contact

Questions, requests, or concerns? Email [email protected]. For GDPR-specific requests, put GDPR in the subject line so we can route it quickly.

Changes to this policy

We will update the "Last updated" date at the top of this page when we make changes. Material changes will be emailed to account holders.