Privacy Policy

Version: 2026-10-01

This policy explains how we process personal data when you visit our website or use Kanroo Cloud, the hosted Kanroo service.

1. Controller

TECHPOINT
Seestraße 3
82211 Herrsching am Ammersee
Bavaria, Germany
Email: hi@kanroo.app

We are not required to appoint a data protection officer. For all privacy questions, use our contact form with the label Privacy, or write to hi@kanroo.app.

2. Our two roles

Controller. We decide how to process the data needed to run our website, your account, sign-in, security, and email delivery. This policy describes that processing.
Processor. The content that organizations store in Kanroo Cloud, such as tasks, comments, files, forms, and wiki pages, belongs to the customer. We process it only on the customer’s behalf under our data processing agreement at https://kanroo.app/legal/dpa/. For questions about that content, contact the organization that uses Kanroo Cloud.

3. Website

3.1 Hosting and server logs

Our website runs on servers of netcup GmbH in Germany. When you open a page, the server processes your IP address, the requested page, the time, the referrer, and your browser type, to deliver the page and to protect the server against attacks. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and working website. Server logs are deleted after 30 days.

3.2 Rybbit analytics

We use Rybbit to measure how our website is used, for example which pages are visited and from which websites visitors come. Rybbit runs on our own servers at netcup in Germany; no data goes to a third party. Rybbit sets no cookies and stores nothing on your device. It processes your IP address and browser information only to create aggregated statistics. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in improving our website. Statistics are kept for 365 days.

3.3 Contact by form or email

Our contact, feedback, and report forms run on Kanroo Cloud. To send a form, you sign in with your email address (section 4.1), and your message becomes a task on our own board. When you use a form or write to us by email, we process your email address, your name if you give it, and your message to answer you. Legal basis: Art. 6 (1) (b) GDPR if your message concerns a contract, otherwise Art. 6 (1) (f) GDPR. We delete the correspondence when it is no longer needed, unless a legal retention period applies.

3.4 Preferences on your device

When you choose a color theme or a language on our website, your browser keeps this choice in its local storage, under the keys theme and lang. Nothing is stored before you choose. These preferences stay on your device; we receive nothing. Legal basis: § 25 (2) No. 2 TDDDG, because storing them is strictly necessary for the function you request, and Art. 6 (1) (f) GDPR, our legitimate interest in showing the website the way you chose.

3.5 Update check for self-hosted installations

A self-hosted Kanroo installation asks kanroo.app every 24 hours whether a new version is available, so its operator learns about updates and security fixes in time. It sends a random installation ID, its version, and its edition. We keep these with the server’s IP address and country to know which versions still need support and to prevent misuse. Legal basis: Art. 6 (1) (f) GDPR. We delete the IP address after 30 days and the rest after 365 days. The operator can turn the check off with UPDATE_CHECK_ENABLED=false.

4. Kanroo Cloud

To create and use an account, we process your email address and, if you add them, your name and avatar. You sign in with a one-time code that we send to your email address. We store the code only as a hash, and it expires after 10 minutes. We also record which version of our terms you accepted and when. Legal basis: Art. 6 (1) (b) GDPR.

If your organization uses single sign-on (SSO), your identity provider confirms your identity to us.

After sign-in, we set one cookie, __Secure-kanroo-session. It keeps you signed in and is strictly necessary for the service. During company login, a second cookie, kanroo-oidc-attempt, carries the sign-in attempt for 10 minutes. With each session, we store your IP address and browser information to protect your account; they are deleted when you sign out. A session expires after 7 days without use and is deleted when your browser next presents it. Your browser also keeps display preferences, such as the color theme, in its local storage. These preferences stay on your device. Legal basis: § 25 (2) No. 2 TDDDG and Art. 6 (1) (b) and (f) GDPR.

We do not use analytics or tracking in Kanroo Cloud.

4.3 Security activity and audit logs

When you sign in, we record the time, your IP address, and your browser information in the security activity of your account. You can see these records. We keep them for 90 days.

Organizations can keep an audit log of actions in their workspace. The organization sets the retention, from 30 to 365 days depending on its plan.

To protect the service against abuse, we limit the number of requests per IP address. We store the address only as a hash, for up to one hour.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure service.

4.4 Emails from Kanroo Cloud

We send sign-in codes, invitations, and notifications by email. Notification emails contain a link to unsubscribe and to change your preferences. We send these emails through Scaleway’s Transactional Email service in France. Legal basis: Art. 6 (1) (b) GDPR.

4.5 Reply by email and Email Intakes

You can answer notifications by email, and organizations can create tasks from incoming email. These emails arrive on our own mail server at netcup in Germany. We check them for spam and turn them into comments or tasks. We delete the original email once it is processed, normally within 24 hours; an email that cannot be processed is deleted within 14 days at the latest. A record without the message content stays to prevent duplicates and abuse: for replies 90 days, for an Email Intake as long as the intake exists. Legal basis: Art. 6 (1) (b) GDPR; the spam check is based on Art. 6 (1) (f) GDPR.

4.6 Push notifications

If you turn on push notifications, your browser gives us an address of its push service. We store it encrypted. A push message contains the task or page title and is encrypted so that the push service cannot read it. Your browser vendor chooses and operates the push service. You can turn push notifications off at any time. Legal basis: Art. 6 (1) (a) GDPR, your consent.

4.7 Webhooks, API keys, and integrations

Webhooks and integrations that you or your organization configure send data to the destinations you choose. You are responsible for that transfer.

4.8 Operation and error analysis

We operate our own monitoring system on our servers at netcup in Germany. It receives technical logs, traces, and metrics. These contain no IP addresses and no browser information. We keep logs and traces for 30 days and metrics for 3 months. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a stable and secure service.

4.9 Payments

Paid plans are sold by Polar Software, Inc., USA, as merchant of record. Polar has two roles. For the data we send it, listed below, Polar is our processor under its data processing addendum (Art. 28 GDPR). For the purchase, payment, invoice, and tax data that you enter directly at Polar’s checkout, Polar is a separate controller under its own privacy policy. We send Polar:

the email address and user ID of the organization owner;
the billing email address, if the owner enters one;
the name and ID of the organization;
the selected plan and the number of seats.

When the owner of an organization changes, we also send Polar the name of the new owner. We receive the status of the subscription. Legal basis: Art. 6 (1) (b) GDPR.

4.10 Backups

We back up our databases. Backups are deleted after 30 days.

5. Contributions to Kanroo Core

Kanroo Core is open source and developed in the public repository https://github.com/kanrooHQ/kanroo. When you contribute, we process the data that your contribution carries: your GitHub username, the name and email address in your Git commits, and the content of your pull requests, issues, and comments. This data is public in the repository, because every contribution stays attributed to its author. Legal basis: Art. 6 (1) (b) GDPR for the Contributor License Agreement and Art. 6 (1) (f) GDPR, our legitimate interest in an attributable and verifiable open-source history. GitHub, Inc., USA, processes this data as an independent controller under its own privacy statement.

Before your first pull request is merged, you sign the Contributor License Agreement through CLA Assistant at https://cla-assistant.io, a service of SAP SE, Walldorf, Germany, which acts as its own controller. CLA Assistant records your GitHub identity, your email address, and the date and version of the agreement you signed, and shows us this record. We keep it for as long as your contribution is part of Kanroo, because it proves the license you granted. Legal basis: Art. 6 (1) (b) GDPR.

6. Recipients

We use these service providers, bound by data processing agreements:

Provider	Purpose	Location
netcup GmbH, Germany	Servers for the website, the application, the database, the mail server, and monitoring	Nuremberg, Germany
Scaleway SAS, France	Object storage for files and backups	Amsterdam, Netherlands
Scaleway SAS, France	Transactional email	Paris, France

Polar Software, Inc. bills paid plans, see section 4.9. GitHub, Inc. and SAP SE process contributor data as independent controllers, see section 5.

7. Transfers to third countries

We process data in the European Union. Two transfers go to the USA. Polar Software, Inc. receives data for paid plans, based on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR, Commission Decision 2021/914/EU) that are part of Polar’s data processing addendum. GitHub, Inc. processes contributor data of the public repository under its own privacy statement and the safeguards it names there, including the EU Standard Contractual Clauses. If you turn on push notifications, the encrypted messages go to the push service of your browser vendor, which may be outside the EU and is not under our control (section 4.6).

8. Storage period

We delete personal data when it is no longer needed for the purpose, unless a legal retention period applies. The sections above name specific periods. When you delete your account, we delete your account data at once; audit log entries of organizations keep your name and email address until their retention ends (section 4.3), and Polar keeps billing records under its own rules. Content you wrote in organizations that continue to exist stays there without your name. Content that is deleted in Kanroo Cloud, such as tasks, comments, attachments, and pages, stays stored for 30 days after its deletion and is then deleted for good. Copies in backups expire after 30 days.

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future. To use your rights, use our contact form with the label Privacy, or write to hi@kanroo.app.

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

Right to object

Where we process data based on Art. 6 (1) (f) GDPR, you can object at any time for reasons that arise from your particular situation.

10. Required data and automated decisions

You need to give us your email address to use Kanroo Cloud. Without it, we cannot provide the service. We do not use automated decision-making or profiling.

11. Changes

We update this policy when our processing changes. The current version is always at https://kanroo.app/legal/privacy/.