Privacy Policy

1. Controller

NETZSPINNEREI e.U., Daniel Letschka
Josef-Bichler-Straße 19, 3107 St. Pölten, Austria
Email: hello@kanbanti.app

The controller processes personal data in accordance with the GDPR, the Austrian Data Protection Act and the Austrian Telecommunications Act 2021 (TKG 2021).

2. Hosting, Cloudflare and access logs

KanbanTi is hosted by ALL-INKL.COM – Neue Medien Münnich in Germany. The service processes technical request data such as IP address, date and time, requested URL, referrer, browser, operating system and response status to deliver the website, maintain security and diagnose faults.

All traffic is routed through Cloudflare, Inc. Cloudflare provides DNS, reverse-proxy, CDN, TLS, DDoS protection, Web Application Firewall, rate limiting and bot protection. Cloudflare therefore processes IP addresses and technical request, device and security data. Depending on the route and threat assessment, processing may take place outside the EEA. Cloudflare uses contractual safeguards for international transfers.

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in securely and reliably providing KanbanTi. Where processing is necessary to provide the requested service, Art. 6(1)(b) GDPR also applies.

Further information: Cloudflare Privacy Policy and Cloudflare Cookies.

3. Accounts and use of KanbanTi

When you register and use KanbanTi, we process your name, email address, encrypted password, email-verification status, subscription and trial status, boards, columns, tasks, labels, descriptions, timer entries, notes and related timestamps. This data is required to create your account and provide the application.

The legal basis is Art. 6(1)(b) GDPR. Security-relevant events may additionally be processed under Art. 6(1)(f) GDPR.

4. Email delivery

Account verification, password-reset and operational emails are delivered through Brevo (Sendinblue GmbH). For this purpose, the recipient address, message content and delivery metadata are transmitted to Brevo. The legal basis is Art. 6(1)(b) GDPR and, for reliable and secure delivery, Art. 6(1)(f) GDPR.

Further information: Brevo Privacy Policy.

5. Payments through Paddle

Subscriptions and payments are handled by Paddle as Merchant of Record. When you open the checkout or purchase a subscription, Paddle processes identification, billing, payment, device, fraud-prevention and transaction data. Paddle may share the information required to activate and administer your subscription with us.

Processing required to purchase and provide the subscription is based on Art. 6(1)(b) GDPR; statutory accounting obligations are based on Art. 6(1)(c) GDPR. Paddle may process data outside the EEA using the safeguards described in its privacy notice.

Further information: Paddle Privacy Notice.

6. Cloudflare Turnstile

Registration and password-recovery forms use Cloudflare Turnstile to distinguish legitimate submissions from automated abuse. Turnstile processes technical device, browser, IP and interaction signals and returns a verification token. The legal basis is Art. 6(1)(f) GDPR: protection of accounts, forms and infrastructure.

Turnstile does not use advertising cookies. If Cloudflare pre-clearance or a security challenge is enabled, Cloudflare may set a necessary cf_clearance cookie.

Further information: Cloudflare Privacy Policy.

7. Cookies and browser storage

KanbanTi does not use analytics, advertising or cross-site tracking cookies. The following technically necessary storage is used without consent under § 165(3) TKG 2021:

The application also uses local storage for your light/dark theme and the currently active timer, and session storage for short-lived interface messages and the Pomodoro-finished indicator. These values remain on your device and are used only to provide the requested interface and keep timer state consistent across tabs.

Because only necessary storage is currently used, KanbanTi does not display a consent banner. If optional analytics or marketing technologies are introduced, they will not be activated before valid consent is obtained.

8. Timer notifications

For timed sessions, KanbanTi can play a local completion sound and, if you grant browser permission, display a system notification. Notification permission is controlled by your browser and can be withdrawn in its settings. KanbanTi does not send the content of these notifications to a push-notification provider.

9. Retention and deletion

Account and workspace data is stored while your account exists and as needed to provide the service. After account deletion or the end of the contractual relationship, data is deleted or anonymised unless statutory retention obligations, unresolved claims or security requirements require continued storage. Transaction and accounting records may be retained for the legally required period. Deleted data may remain temporarily in rotating security backups until those backups are overwritten.

Technical logs are retained only as long as reasonably necessary for security, availability and fault analysis. Retention by processors is governed by their respective contracts and policies.

10. Recipients and international transfers

Data is disclosed only where necessary to hosting, infrastructure, email and payment providers, professional advisers, public authorities where legally required, or a successor in a lawful business transfer. Where a recipient processes data outside the EEA, we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

To exercise your rights, email hello@kanbanti.app. KanbanTi does not use automated decision-making or profiling that produces legal or similarly significant effects.

12. Changes to this policy

We may update this policy when the service, providers or legal requirements change. The current version is always available on this page.