Privacy Policy

Account data. Your email address, and a display name if you set one. A hashed password is held by our authentication provider; we never see it in plain text.

Workspace data. The workspaces you create or join, your role, control statuses and notes you record, invitations you send, and an audit log of changes (who changed what, and when).

Billing data. When a workspace subscribes, our payment provider Lemon Squeezy, LLC collects and processes payment details. We receive a subscription record — status, seat count, renewal date, and provider identifiers — but not your full card number.

Technical data. Standard server and security logs (IP address, browser type, timestamps, pages requested) generated by our hosting and infrastructure providers, used to operate and secure the Service.

We do not use third-party advertising or analytics trackers, and we do not sell personal data.

• to create your account and authenticate you;
• to provide the Service — store your compliance tracking data, render dashboards and reports, and sync mapped controls;
• to manage workspace membership and invitations;
• to take payment, prevent fraud, and send billing and service notices;
• to provide support you ask for;
• to keep the Service secure, investigate abuse, and meet legal obligations.

Our legal bases (where the GDPR or similar law applies) are: performance of a contract (providing the Service and billing), legitimate interests (securing and improving the Service, preventing abuse), and legal obligation (tax and accounting records).

We use only strictly necessary cookies: a session cookie to keep you signed in and a cookie to protect against cross-site request forgery. There are no advertising or analytics cookies, so there is no consent banner to click through.

We share personal data only with service providers that help us run the Service:

• Supabase — database, authentication and backups (hosting region configured for the project).
• Vercel — application hosting and content delivery.
• Lemon Squeezy — payment processing and Merchant-of-Record billing, including tax handling and invoicing.
• Email delivery — transactional email for sign-in links, invitations and billing notices.

Each processes data under its own terms and security commitments. We may also disclose data if required by law, to enforce our terms, or to protect the rights, safety or property of Kim, our users or the public. If the business is transferred, account data may pass to the successor under this policy.

Our providers may process data in countries other than yours, including the United States. Where personal data protected by the GDPR or UK GDPR is transferred outside the EEA or UK, it is covered by an appropriate safeguard such as the European Commission’s Standard Contractual Clauses.

We keep account and workspace data for as long as your account or workspace is active. After you delete a workspace or close your account, we remove the associated data within 30 days, except for records we must keep longer — billing and tax records (kept as required by law, typically up to 10 years) and minimal security logs. Backups are cycled out on a rolling schedule.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to processing based on legitimate interests. To exercise any of these, email kim_abdalian@yahoo.com. We will respond within the time your law requires (usually 30 days). You can also lodge a complaint with your local data protection authority.

Much of this you can do yourself: edit your profile in the app, export workspace data to CSV or PDF at any time, and ask a workspace owner to remove you from a workspace.

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect data from children.

Data is encrypted in transit (HTTPS). Workspaces are isolated from each other at the database level with row-level security, and access is limited to what each member’s role allows. Infrastructure is managed and backed up by our providers. No system is perfectly secure; if a breach affects your personal data we will notify you and any regulator as required by law.

We may update this policy. If a change is material we will notify you by email or in the app before it takes effect. The “last updated” date above always reflects the current version.

Kim, Kingdom of Bahrain — kim_abdalian@yahoo.com. See also our Terms of Service.