Privacy information

1. Controller

2. Account and sign-in

We process your business email address, a time-limited sign-in code and technical session and security data to provide and protect your account. Access tokens are stored in protected system storage on supported devices. Processing is based on Article 6(1)(b) GDPR and, for security measures, Article 6(1)(f) GDPR.

Sign-in codes, invitations and other transactional messages are sent through Resend. The recipient address, message data and delivery information are processed for this purpose.

3. Using the app

Depending on your role and use, we process contact, organisation and membership data, roles and permissions, locations and addresses, supplier, item, warehouse and container master data, orders, delivery and goods-receipt data, notes and audit events. These data are associated with the relevant account and organisation and are required to provide KanbanSignal and its replenishment workflows (Article 6(1)(b) GDPR).

Order and status emails are sent to suppliers and other recipients configured by your organisation. The order, contact and delivery data required for the transaction are disclosed to those recipients.

4. Camera and QR codes

The camera is used only with your permission to recognise QR codes and barcodes. KanbanSignal does not store or upload camera images. The code value is processed to identify the container. You can alternatively select a container in the app.

5. Service providers and international transfers

We use Convex for backend, database and authentication and Resend for transactional email. They process data on our behalf. Where processing occurs outside the EU or EEA, we rely on the safeguards provided by law, such as an adequacy decision or the EU Standard Contractual Clauses.

We do not use advertising or tracking services in the app or on the website and do not create personal usage profiles for advertising.

6. Website access and contact

When you access the website, technically necessary connection data such as IP address, access time, requested page, browser and operating-system information are processed to deliver the site securely and investigate errors (Article 6(1)(f) GDPR). The website uses no analytics or tracking services and no remotely loaded web fonts.

If you contact us by email, we process your address, message and other supplied information to handle your request (Article 6(1)(b) or (f) GDPR).

7. Retention and deletion

We retain personal data while the account or organisation exists and the data are required for the purposes described. We then delete or anonymise them unless legal retention duties, legitimate evidentiary interests or security reasons require longer retention. See the KanbanSignal account deletion page for the deletion process.

8. Your rights

Subject to the legal requirements, you have rights to access, rectification, erasure, restriction, portability and objection. Contact contact@kanbansignal.app to exercise your rights.

9. Complaints and updates

You may lodge a complaint with a data-protection authority. Our competent authority is generally the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). We update this notice when the app, website, infrastructure or legal requirements change.