Privacy Policy

Last updated: October 2026

1. Overview

This privacy policy explains what personal data we collect when you use our website and the kanman application, how we use it, and what rights you have regarding your data. kanman is an AI teammate for engineering teams that works on the repositories and issue trackers a customer connects. Where we process data in those repositories and trackers on behalf of a customer, we act as a processor under our Data Processing Agreement, and the customer is the controller.

2. Controller

The controller responsible for data processing on this website and for account data is:

Marco Kerwitz
kerwitz.dev
Birkenweg 21
31226 Peine, Germany
Phone: +49 5171 9078566
Email: support@kanman.ai

3. Data Processing Overview

3.1 Account Data

When you register for kanman, we collect:

Email address
Name (if provided)
Company name and business details (if provided)
Password (stored encrypted)

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Retention: Duration of contract plus 3 years (limitation period)

3.2 Repository, Tracker and Run Data

When a customer connects repositories and issue trackers, kanman processes on the customer's behalf:

Source code and repository metadata (branches, commits, pull requests, author names and email addresses in commit history)
Tracker content (issues, stories, comments, assignees)
CI logs and test results
Run artifacts and evidence (acceptance test reports, screenshots, browser traces)
Decisions, policy settings and audit log entries (who did what, on whose approval, at what cost)

This data may contain personal data, for example names in commit history or comments. The customer decides which repositories and trackers are connected and can disconnect them at any time.

Legal basis: Processing on behalf of the customer under Art. 28 GDPR; the customer is responsible for the legal basis. For our own account and billing purposes Art. 6(1)(b) GDPR.

Retention: See section 7.

3.3 Usage Data

When you use kanman, we process:

Usage logs (actions, timestamps)
Technical data (IP address, browser type, device information)

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interests: security, service improvement)

Retention: 30-90 days.

3.4 Payment Data

For payment processing, we use Stripe (Stripe Payments Europe Ltd., Ireland). Stripe processes:

Payment method details
Transaction data
Billing address

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Retention: Tax documents: 10 years (Section 147 AO)

Stripe's privacy policy: https://stripe.com/privacy

4. Where Data Is Processed

Application data is hosted in the EU. Coding agents run in an isolated sandbox per run, either in our cloud environment in Frankfurt am Main, Germany, or on a self-hosted runner that the customer operates in its own network. With a self-hosted runner, source code is checked out and executed inside the customer's network; kanman receives the results, logs and evidence the runner reports back.

We do not use customer content to train AI models.

5. Service Providers and Recipients

5.1 Supabase (Database and Authentication)

We use Supabase (Supabase Inc., USA) for our database infrastructure and user authentication. Data processed: account data, application data, usage data.

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Data transfer: Data is hosted in the EU (Stockholm, Sweden; Supabase region eu-north-1). Transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

5.2 Fly.io (Cloud Runner)

We use Fly.io (Fly.io, Inc., USA) to run the sandbox in which coding agents work, in the region Frankfurt am Main, Germany. Data processed: source code checked out for a run, run logs and artifacts. Not used when the customer runs a self-hosted runner.

Legal basis: Art. 6(1)(b) GDPR (contract performance); processing on behalf of the customer under Art. 28 GDPR

Data transfer: Processing takes place in Germany. Transfer to the USA, where it occurs for support or administration, is based on EU Standard Contractual Clauses.

5.3 AI Model Providers

To write stories, code and reviews, kanman sends the prompts and the code and tracker context needed for a run to the AI model provider the customer has chosen. Depending on that choice, the recipient is Anthropic, OpenAI, Microsoft (Azure OpenAI Service) or Amazon Web Services (Amazon Bedrock).

Bring your own key (BYOK): the customer uses its own contract and API key. The model provider processes the data under the customer's contract with that provider.
Model access through us: we engage the model provider as a sub-processor. Providers are bound by contract not to use the data for training their models.

Legal basis: Processing on behalf of the customer under Art. 28 GDPR

Data transfer: Some model providers are based in the USA. Transfers are based on the EU-US Data Privacy Framework where the provider is certified and on EU Standard Contractual Clauses. Where a provider offers EU data processing, it can be selected.

5.4 Integrations Chosen by the Customer

When the customer connects services such as GitHub, GitLab, Jira or Slack, kanman reads from and writes to these services on the customer's behalf. These services are contracted directly by the customer, and their own privacy terms apply.

5.5 Cloudflare (CDN and Security)

We use Cloudflare (Cloudflare Inc., USA) as our Content Delivery Network and for security measures. Data processed: IP addresses, technical connection data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interests: IT security, performance)

Data transfer: Cloudflare is certified under the EU-US Data Privacy Framework. EU Standard Contractual Clauses also apply.

5.6 Stripe (Payment Processing)

Payment processing is handled by Stripe Payments Europe Ltd., Ireland. Stripe processes payment data, transaction data, name, email, and billing address.

Legal basis: Art. 6(1)(b) GDPR (contract performance)

6. Data Transfers to Third Countries

Some of our service providers are based in the USA. For transfers to companies certified under the EU-US Data Privacy Framework, an adequacy decision by the EU Commission dated July 10, 2023 applies. Additionally or alternatively, we have concluded EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR with our service providers. Copies can be provided upon request.

7. Data Retention

Data Type	Retention Period	Legal Basis
Tax documents/invoices	10 years	Section 147 AO, Section 14b UStG
Contract data	Duration + 3 years	BGB limitation period
Audit log	Retention configured for the workspace, by default 365 days; deleted at the latest 30 days after the contract ends	Customer instruction
Evidence artifacts (test reports, screenshots, traces) and run logs	Retention configured for the workspace, by default as stated in the documentation; deleted at the latest 30 days after the contract ends	Customer instruction
Source code in the sandbox	Discarded when the run's sandbox is removed	Customer instruction
Usage logs	30-90 days	Legitimate interest
Account data	Until deletion request	Contract performance

8. Cookies

8.1 Essential Cookies

We use essential cookies required for the functioning of our service:

Authentication cookies (Supabase session)
Security cookies (Cloudflare)
Cookie consent storage

Legal basis: Art. 6(1)(f) GDPR (legitimate interests: necessary for service operation)

8.2 Analytics

We use Cloudflare Web Analytics for privacy-friendly, cookieless analytics that does not track individual users or store personal data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interests: service improvement)

9. Your Rights

Under the GDPR, you have the following rights. Where we process data on behalf of a customer, please direct requests to that customer; we support the customer in answering them.

9.1 Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether personal data concerning you is being processed and to access that data.

9.2 Right to Rectification (Art. 16 GDPR)

You have the right to obtain rectification of inaccurate personal data concerning you.

9.3 Right to Erasure (Art. 17 GDPR)

You have the right to obtain erasure of personal data concerning you under certain conditions.

9.4 Right to Restriction (Art. 18 GDPR)

You have the right to obtain restriction of processing under certain conditions.

9.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Customers can export their data, including the audit log, through the kanman application.

9.6 Right to Object (Art. 21 GDPR)

You have the right to object to the processing of your personal data based on legitimate interests at any time, for reasons arising from your particular situation.

9.7 Right to Withdraw Consent (Art. 7 GDPR)

Where processing is based on consent, you have the right to withdraw that consent at any time. The lawfulness of processing based on consent before its withdrawal is not affected.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement.

10. Data Security

We use TLS encryption for all data transmission and encrypt stored data at rest. Each run executes in its own isolated sandbox that is removed after the run. Secrets such as API keys and tokens are stored encrypted and are only made available to the run that needs them. Our service providers implement appropriate technical and organizational measures to protect your data.

11. Contact

For questions about data protection or to exercise your rights, please contact:

Email: support@kanman.ai

We will respond to your request within one month. This period may be extended by two months for complex requests.