Privacy Policy

1. Who controls your data

Kanban, a service operated from the United Kingdom, is the controller for account and board data processed by this service. Contact us at support@tofukanban.uk.

2. Data we collect

• Account data: your name, email address, account identifier, and authentication records.
• Board data: titles, columns, cards, optional assignees, dates, tags, source links, and other content you choose to save.
• Connection data: OAuth client and consent records needed to connect ChatGPT or another authorised MCP client.
• Technical data: essential session cookies, request metadata, security events, and error logs needed to operate and protect the service.

Do not place passwords, payment-card data, government identifiers, health data, or other highly sensitive information in a board.

3. How and why we use data

• Provide sign-in, private board storage, synchronisation, editing, and MCP tool access under our contract with you.
• Protect accounts, prevent abuse, diagnose failures, and maintain service reliability based on our legitimate interests in running a secure service.
• Meet legal obligations and respond to valid legal requests where required.

We do not sell personal data, run behavioural advertising, or use saved board content to train our own AI models.

4. ChatGPT and connected services

When you use Kanban through ChatGPT, OpenAI processes your conversation and tool activity under OpenAI's own terms and privacy policy. Kanban receives the authenticated tool inputs needed to create, read, save, update, or render your boards and returns the requested result. Only connect the plugin if you want this exchange to occur.

5. Service providers and transfers

We use service providers to run Kanban, including Vercel for application hosting, Neon for PostgreSQL data storage, Cloudflare for domain and network services, and Google only if you choose Google sign-in. These providers process data under their own contractual and security commitments and may process it outside the United Kingdom. Where required, transfers rely on recognised adequacy arrangements or contractual safeguards.

6. Cookies and security

Kanban uses essential, HTTP-only authentication cookies. They are required to keep you signed in and protect your session; we do not currently use advertising or analytics cookies. We use encrypted HTTPS connections, scoped OAuth permissions, and per-user database checks. No online service can guarantee absolute security.

7. Retention

We retain account and saved board data while your account is active or as needed to provide the service. OAuth access tokens are short-lived and refresh access is time-limited. When you request deletion, we remove active account and board records unless retention is required by law; limited backups and security logs may remain for the relevant provider's normal retention period before being overwritten.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, object to certain processing, or withdraw consent where consent applies. Email support@tofukanban.uk to make a request. UK users may also complain to the Information Commissioner's Office.

9. Children and changes

Kanban is not directed to children under 13. We may update this policy as the service changes. Material updates will be posted here with a revised effective date.