Kanbrio Privacy Policy

Version 1.0 · Effective 29 September 2026

Applies to: kanbrio.com, app.kanbrio.com, api.kanbrio.com (including the MCP endpoint at api.kanbrio.com/mcp), auth.kanbrio.com, and the emails we send.

Contents

1. Who we are and how to contact us
2. Our two roles: controller and processor
3. What personal information we collect
4. How we collect it
5. Why we use it, and our legal bases
6. AI features, agents and automated decisions
7. Who we share it with
8. Where your information is processed (overseas disclosure)
9. PayPal and other payment methods
10. How long we keep it
11. The audit log and your right to erasure
12. How we protect it
13. Your rights and how to use them
14. Additional information for people in the European Union and United Kingdom
15. Additional information for people in the United States (including California)
16. Cookies and similar technologies
17. Emails we send, and marketing
18. Children
19. Changes to this policy
20. Complaints
21. Definitions

1. Who we are and how to contact us

Kanbrio is a project-management and kanban service in which people and AI agents work together on shared boards. It is provided by [to be confirmed] (ABN [to be confirmed]), trading as Kanbrio ("Kanbrio", "we", "us", "our"), of [to be confirmed], Australia.

In this policy, "you" means anyone whose personal information we handle: people who visit our website, people who sign up or are invited to Kanbrio, people who operate AI agents in Kanbrio, people who pay for Kanbrio, and people who contact us.

EU and UK representatives. We have not yet appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or UK GDPR. When we do, we will name them in this section. Until then, people in the EU and UK can contact us directly at [email protected].

We are a small team. We have not appointed a separate data protection officer; [email protected] reaches the person responsible for privacy at Kanbrio.

2. Our two roles: controller and processor

When we are the controller. We decide why and how the following personal information is used, and this policy explains what we do with it:

• your Kanbrio sign-in account (name, email address, password, sign-in sessions);
• information about your organisation's subscription, plan, credits and payments;
• website visits, and technical and security information about how our service is used;
• your emails and support requests to us;
• records we keep for security, accountability and to show we have complied with the law (including records of privacy requests).

When we are the processor. Everything your organisation puts into its Kanbrio workspace ("Customer Data") belongs to that organisation, which we call our "customer". This includes cards, comments, descriptions, checklists, files, time entries, labels, custom fields, knowledge documents, invitations, coding tasks, agent activity, imported data, and the member directory as it appears inside the workspace. The customer decides what goes in, who can see it and how long it stays. We process Customer Data only to provide Kanbrio to the customer and on its instructions, under our Terms of Service and our Data Processing Agreement (at kanbrio.com/dpa). In United States privacy law terms, we act as the customer's "service provider".

If you are a member of, or are mentioned in, a customer's workspace and you want to see, correct or delete information in it, please contact that organisation first; it controls that information. If you contact us instead, we will pass your request to the customer (where we can identify it) and help the customer respond. Section 13 explains this further.

Where this policy describes Customer Data, it does so to explain how Kanbrio works. The customer's own privacy notice governs why the customer collects that information.

3. What personal information we collect

We collect only what we need to run Kanbrio. We do not seek sensitive information (such as health, racial or ethnic origin, religious or political views, sexual orientation, biometric or criminal record information), and we ask customers not to store it in Kanbrio unless we have agreed to it in writing.

3.1 Information we handle as controller

3.2 Information we handle as processor for our customers (Customer Data)

People who are not Kanbrio users. Customer Data may include information about people who have no Kanbrio account, for example someone named in a card or someone who has been invited but not yet joined. The customer is responsible for having the right to put that information into Kanbrio.

3.3 What we do not collect

• We do not collect payment card or bank details; PayPal does (see section 9).
• We do not use third-party analytics, advertising, social-media tracking pixels or session-recording tools on kanbrio.com or in the app.
• We do not buy personal information from data brokers.

3.4 Can I use Kanbrio anonymously?

You can read kanbrio.com without telling us who you are. To use the app you need an account with a name and working email address, because Kanbrio is a collaboration service in which other members need to know who did what, and we need to be able to contact you about your account. You may use a nickname as your display name if your organisation allows it.

4. How we collect it

• From you, when you sign up, sign in, fill in your profile, use the app, the API or the MCP endpoint, or email us.
• From your organisation or colleagues, when they invite you, add you to a workspace, assign you to a card, or mention you.
• From AI agents your organisation connects, which act through Kanbrio with the permissions your organisation gives them.
• From imports your organisation uploads from other tools.
• From PayPal (and any other payment provider we add), which tells us whether a payment or subscription succeeded and who paid.
• Automatically, from your browser or tool, through Cloudflare and our servers, when you connect to Kanbrio.

5. Why we use it, and our legal bases

The GDPR and UK GDPR require us to state a "legal basis" for each use. Australian law requires us to use personal information only for the purpose we collected it for, or a related purpose you would reasonably expect. We use personal information for these purposes only:

Where we rely on legitimate interests, we have weighed those interests against your rights and consider them balanced. You can ask us for more detail, and you have the right to object (section 13).

We will not use personal information for a new, unrelated purpose without telling you first and, where the law requires it, asking for your consent.

6. AI features, agents and automated decisions

Kanbrio is built for teams in which people and AI agents work together. All AI features are optional and are controlled by the customer.

No model training. We do not use Customer Data or your personal information to train AI models, and we do not let our AI provider do so. Our AI provider, Anthropic, does not train its models on data sent through its commercial API.

Agents your organisation connects. A customer can connect its own AI agents (for example, a coding assistant) to Kanbrio through our API or MCP endpoint (the MCP endpoint is being implemented; meanwhile agents connect through our API). Each agent has its own identity in the organisation, is authenticated with a Kanbrio-issued agent API key, and can only do what the customer allows. Kanbrio-issued agent API keys are being implemented; meanwhile each agent has its own separate credential that the customer can revoke. The AI model behind that agent is chosen and run by the customer, not by us. Whatever the agent reads from Kanbrio is sent to that model under the customer's arrangements with its provider, not ours.

Agents are always labelled. Every agent appears as an agent, not as a person: it has the "agent" role, is shown with an agent marker in the app, and every action it takes is recorded in the activity log as an agent action.

Human control. When an agent tries to do something destructive, the action does not happen straight away. It becomes a suggestion that a person in the organisation must approve or reject. Agents cannot approve suggestions and cannot make or approve privacy erasure requests. Owners and admins can pause, resume or cancel an agent's run; the agent stops at its next safe point, which may take a short time. Pause, resume and cancel are being implemented; meanwhile an agent is stopped by revoking its sign-in credentials. Many agent actions can be reversed.

Our hosted coding agent. Our hosted coding agent is being implemented and is not yet offered to customers; this describes how it handles information once it is. If a customer asks Kanbrio's coding agent to work on a code repository:

1. the task is sent to a server we rent from DigitalOcean in Sydney, Australia;
2. that server copies the repository the customer named into a temporary workspace;
3. it sends the task title and instructions and up to about 24,000 characters of relevant file contents to Anthropic in the United States, which returns a proposed code change. If the customer has supplied its own Anthropic API key, that key is used; otherwise we use ours;
4. the proposed change is checked in an isolated environment without network access or credentials;
5. the result is returned to Kanbrio for a person to review. Nothing is merged without a person accepting it.

The temporary workspace is removed after the attempt. Anthropic keeps API inputs and outputs for no more than 30 days, except where it needs them longer to investigate misuse of its service or to meet a legal obligation. If the repository or the instructions contain personal information, it goes through the same path, so we recommend not putting personal information in coding tasks.

Search. Kanbrio's semantic search is being implemented. It is computed on our own servers in Australia. Text is not sent to a third party to build search indexes.

AI usage records. For each AI call we record the agent, model, number of tokens, cost and time taken, so customers can see and cap their spending. We do not record the prompt or the response in this log. This usage log is being implemented; meanwhile no hosted AI call is charged to a customer.

Automated decisions. Kanbrio's automation rules and AI agents can create, change, move, assign and comment on work items, and send webhook messages the customer has set up (webhooks are being implemented). They use the information in the organisation's workspace (for example card content, assignees, due dates and workflow status). Hard usage caps on agent credits automatically stop agents when a budget is used up. Agent credits are being implemented; meanwhile rate limits cap how much an agent can do. We do not use Kanbrio to make decisions about individuals that have legal effects or similarly significant effects, such as decisions about employment, credit or access to essential services, solely by automated means. A customer could configure its own automations or agents to act on information about its people; in that case the customer, not Kanbrio, decides what those automations do and is responsible for them.

AI output can be wrong. Customers and their users should review what AI agents produce before relying on it.

More detail is in our AI and Agents notice at kanbrio.com/ai.

7. Who we share it with

We do not sell personal information and we do not share it for advertising.

We share personal information only with:

• Service providers (sub-processors) that help us run Kanbrio, under contracts that require them to protect it and use it only to provide their service to us. They are:

| Provider | What they do for us | Location | |---|---|---| | Cloudflare, Inc. | Website and app delivery, DNS, secure connections, protection against attacks, access checks, and forwarding of email to our contact addresses | Worldwide network | | DigitalOcean, LLC | Hosts the server that runs our coding agent | Sydney, Australia | | Twilio Inc. (SendGrid) | Sends our emails | United States | | Anthropic, PBC | AI model used by our hosted coding agent | United States | | [to be confirmed] | Our business mailbox, which receives the email you send to our @kanbrio.com addresses | [to be confirmed] |

The current list, with any changes, is at kanbrio.com/subprocessors. We give customers 30 days' notice by email before we add or replace a sub-processor, and customers can object.

• PayPal, which processes payments as an independent controller (section 9).
• Other members of your organisation. Your name, email address, role, presence and activity are visible to other members of the organisations you belong to, according to their permissions.
• Destinations the customer chooses. If a customer sets up webhooks, connects external MCP servers, points our coding agent at a code host, or connects its own AI agents, Kanbrio sends data to those destinations because the customer told it to. Those destinations are chosen by the customer and are not our sub-processors; the customer is responsible for them.
• Professional advisers such as lawyers, accountants and auditors, under a duty of confidentiality, when we need their advice.
• Authorities, when the law requires it, or when we believe in good faith that disclosure is needed to protect someone's safety, to investigate fraud or security issues, or to protect our rights. Where a request concerns Customer Data, we will tell the customer first unless the law forbids it.
• A buyer or successor if our business, or part of it, is sold, merged or restructured. They must keep your information protected in line with this policy, and we will tell you before your information becomes subject to a different privacy policy.

8. Where your information is processed (overseas disclosure)

Australia. Kanbrio's main database, files, cache, message queue and sign-in service run on servers we operate ourselves in Australia. Our backups are also held in Australia on equipment we control. Our coding-agent server is at DigitalOcean in Sydney, Australia.

Outside Australia. Some of our service providers process personal information in other countries:

• United States: SendGrid (email) and Anthropic (the hosted coding agent's AI model).
• [to be confirmed]: [to be confirmed], which holds the emails you send us.
• Cloudflare's worldwide network: connections to Kanbrio pass through the Cloudflare data centre nearest to the person connecting, which may be in any country where Cloudflare operates.

We may later move our hosting to a professional hosting provider. If that changes where your information is stored, we will update this policy and our sub-processor list and give customers 30 days' notice first.

Safeguards. Before disclosing personal information to an overseas recipient, we take reasonable steps to make sure it is handled in line with the Australian Privacy Principles, mainly through our contracts with those providers. We remain accountable for how they handle it as required by Australian law.

Transfers from the EU and UK. Neither the European Commission nor the UK Government has recognised Australia as providing an adequate level of data protection. When we receive personal information from the European Economic Area, the United Kingdom or Switzerland, or pass it to providers in other countries, we protect it with the European Commission's Standard Contractual Clauses (2021) and, for UK data, the UK International Data Transfer Addendum, together with an assessment of the risks of the transfer. Our providers use similar safeguards, and some also rely on the EU-US Data Privacy Framework. You can ask for a copy of the relevant safeguards at [email protected] (commercial terms may be removed).

9. PayPal and other payment methods

We take payments through PayPal. When you pay, you give your payment details to PayPal, not to us. PayPal processes your payment information as an independent controller under its own privacy statement, which you can read at https://www.paypal.com/au/legalhub/paypal/privacy-full (or the version for your country on PayPal's website). We are not responsible for how PayPal handles your information.

PayPal tells us about your subscription and payments, including identifiers for your subscription and payer account and, in some notifications, the payer's name and email address. We use this to run billing, to match payments to organisations and to handle refunds and disputes.

We may also offer payment in cryptocurrency through a third-party payment processor. If we do, we will name that processor and explain what it receives on our sub-processor page before we start. Payments on public blockchains are permanent and publicly visible, and we cannot delete them.

10. How long we keep it

We keep personal information only for as long as we need it for the purposes in section 5, and then we delete it or make it anonymous.

A customer can delete Customer Data at any time within the app or through the API. Internal copies that our systems keep for reliability (for example, records used to safely replay a request or deliver an event) are deleted within the same periods.

If we must keep information longer because of a legal obligation, a legal claim, an investigation or a legal hold, we keep only what is needed and only for as long as needed, and we suspend scheduled deletion only for that purpose.

11. The audit log and your right to erasure

Kanbrio keeps an activity log of the actions that people and agents take in each organisation. The log is tamper-evident: each entry is linked to the one before it with a cryptographic fingerprint, and our application can add entries but cannot change or delete them. This lets customers, and us, prove what happened and who (or which agent) did it, which is especially important when AI agents act in a workspace.

What the log contains. Each entry holds identifiers and facts about an action: the account or agent identifier (a random-looking code, not a name or email address), whether it was a person or an agent, the kind of action, the identifier of the item acted on, the outcome, and the time. It does not hold the content of your work, and it does not hold names or email addresses. Before anything is written to the log, our software automatically removes free text (such as names, email addresses, comments or descriptions) and replaces it with the word "redacted".

What happens when you ask us to erase your data. We erase or anonymise your personal information in your account and in Customer Data that is about you, as described in section 13, and we delete your sign-in account. We keep the activity log entries that refer to your account identifier, because:

• they contain no content and only a pseudonymous identifier. Once your sign-in account is deleted, that identifier can no longer be linked to your name or email address from within Kanbrio;
• deleting or changing entries would break the chain that makes the log trustworthy for every other person in the organisation;
• they are needed for security, to detect and investigate misuse, to meet legal record-keeping obligations, and to establish, exercise or defend legal claims. Under the GDPR and UK GDPR, the right to erasure does not apply to the extent processing is necessary for these reasons (Article 17(3)(b) and (e)), and processing for network and information security is a recognised legitimate interest.

We keep these entries for 7 years and then destroy them. When we respond to an erasure request, we tell you which records we have kept and why. You can object to our keeping them (section 13) and we will consider your objection.

A customer's own copies of its activity log (for example, exports it has downloaded) are controlled by the customer.

12. How we protect it

We use technical and organisational measures appropriate to the risk, including:

• Separation of customers' data. Every customer's data is fenced off at the database level, and our application connects to the database with an account that cannot bypass that fence.
• Encryption in transit. Connections to Kanbrio use HTTPS/TLS.
• Secure sign-in. Passwords are stored only in hashed form by our sign-in service. Agent API keys are shown once when created and stored only in a form that cannot be turned back into the key (agent API keys are being implemented; meanwhile each agent's sign-in secret is shown once and held by our sign-in service). Customer AI keys are stored encrypted.
• Least privilege and approval. Roles control what each member and agent can do; destructive agent actions need human approval; every change goes through a single path that checks permissions and records the action.
• Tamper-evident logging (section 11).
• Isolation of AI-generated code. Our coding agent checks proposed changes in an isolated environment without network access or credentials, on a separate server from our main systems.
• Backups held on equipment we control, so we can recover from failures.
• Limited access. Only authorised Kanbrio personnel who need access to do their job can reach production systems.

No system is completely secure. Kanbrio runs on a small number of servers operated by a small team, and we do not promise uninterrupted availability. If we become aware of a data breach that is likely to cause serious harm, we will notify affected customers without undue delay (and, for Customer Data, within 72 hours of becoming aware of it), and we will notify the Office of the Australian Information Commissioner, EU or UK regulators and affected individuals where the law requires.

You can help: keep your password and agent API keys secret, revoke keys you no longer need, and tell us at once if you think your account has been compromised. Security issues can be reported as described at kanbrio.com/security.

13. Your rights and how to use them

Depending on where you live, you have some or all of these rights. We extend the core rights to everyone, wherever they live.

How to make a request. Email [email protected] from the email address on your account, or tell us how to reach you. We may need to confirm your identity before we act, and we will ask only for what we need to do that. Someone else may act for you if they show us that you authorised them.

How long it takes. We respond within 30 days. Under the GDPR and UK GDPR we respond within one month, which we may extend by up to two further months for complex requests; we will tell you if we need to. Some steps, such as preparing a full export or removing information from every system, may be carried out by our staff rather than automatically, but they are still completed within these times.

Cost. Requests are free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it, and we will explain why.

If we refuse. If we refuse a request in whole or in part, we will tell you why in writing (unless it would be unreasonable to do so) and how to complain. If we do not correct information as you asked, you can ask us to attach a statement that you believe it is wrong.

Information in a customer's workspace. If your request is about Customer Data (section 2), the customer that controls the workspace decides how to respond. We will forward your request to it and help it respond, but we cannot act on Customer Data against the customer's instructions except where the law requires.

If you are an organisation owner or admin, you can remove members, delete content, and make erasure requests for members of your organisation through Kanbrio's API, and ask us for help at [email protected]. Erasure through the API is being implemented; meanwhile send erasure requests to [email protected] and we complete them manually within 30 days.

14. Additional information for people in the European Union and United Kingdom

• Controller: [to be confirmed], [to be confirmed], Australia, [email protected], for the information described in section 3.1. For Customer Data, the controller is the customer.
• Representatives: see section 1.
• Legal bases: see section 5.
• Transfers: see section 8.
• Do you have to give us your information? You need to give us your name and email address to have a Kanbrio account, because we cannot provide the service without them. Everything else is up to you or your organisation.
• Automated decision-making: see section 6. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

15. Additional information for people in the United States (including California)

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in California law. We have not done so in the past 12 months. We do not use or disclose sensitive personal information to infer characteristics about you.

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes in sections 3 to 5, and disclosed them for business purposes to the recipients in section 7:

• Identifiers (name, email address, account identifier, IP address);
• Commercial information (subscription, plan, payments and credits);
• Internet or other electronic network activity (requests to our service, security and error records, activity in Kanbrio);
• Professional or employment-related information that customers put into their workspaces (for example role and assigned work);
• Account log-in credentials (a username or email address with a password, or an agent API key), which count as sensitive personal information and are used only to sign you in and keep your account secure.

We keep each category for the periods in section 10.

Whether or not a US state privacy law applies to us, we honour requests to know, access, correct and delete personal information, and to opt out of sale, sharing or targeted advertising (which we do not do), using the process in section 13. You can use an authorised agent. We will not treat you differently for exercising your rights.

When customers put personal information into Kanbrio, we process it as their service provider and only for the purposes in our contract with them.

16. Cookies and similar technologies

We use only the cookies and browser storage needed to run Kanbrio and to remember the settings you choose: for example, to keep you signed in, protect sign-in against forgery, protect the service from attacks, and remember display preferences such as board density. We do not use advertising or analytics cookies. Our Cookie Policy at kanbrio.com/cookies lists each one, what it does and how long it lasts. If we ever want to use cookies that are not strictly necessary, we will ask for your consent first where the law requires it.

17. Emails we send, and marketing

Service emails. We send emails that you need in order to use Kanbrio: sign-in and verification emails, invitations, welcome emails, email digests summarising your unread Kanbrio notifications, billing emails, and important notices (for example, changes to this policy or a security incident). These come from [email protected] and are delivered by SendGrid. We send digests only to email addresses that have been verified. If you do not want to receive digests, email [email protected] and we will stop them. Other service emails cannot be turned off while you have an account.

Marketing emails. We do not currently send marketing emails. If we start, we will send them only where the law allows (for example with your consent), every message will identify us and include a working unsubscribe link, and we will act on an unsubscribe within 5 business days. We will never sell or rent our email list.

18. Children

Kanbrio is for business and professional use by people aged 18 or over. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact [email protected] and we will delete it.

19. Changes to this policy

We may update this policy as Kanbrio, the law or our providers change. Every version shows its version number and effective date, and we keep a change log at the end of this page.

If we make a material change (for example, a new use of personal information, a new category of data, or a new country where data is processed), we will tell customers and account holders by email and in the app at least 30 days before it takes effect. Where the law requires your consent to a change, we will ask for it. Minor changes, such as clearer wording or corrected contact details, take effect when we publish them.

20. Complaints

If you have a concern about how we handle personal information, please contact us first at [email protected]. We will acknowledge your complaint within 7 days, investigate it, and give you a written answer within 30 days.

If you are not satisfied with our answer, you can complain to a regulator:

• Australia: the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, phone 1300 363 992.
• European Union / European Economic Area: the data protection authority in the country where you live, work, or where you believe the problem occurred. A list is at www.edpb.europa.eu.
• United Kingdom: the Information Commissioner's Office (ICO), www.ico.org.uk.
• Elsewhere: your local privacy or data protection regulator.

You do not have to contact us first before going to a regulator, but it often resolves things faster.

21. Definitions

• Customer: the organisation (or individual) that has signed up to Kanbrio and controls a Kanbrio organisation and its workspaces.
• Customer Data: the information a customer and its members and agents put into, or generate in, the customer's Kanbrio organisation (see section 3.2).
• Agent: an AI system that acts in a Kanbrio organisation under its own agent identity, with permissions granted by the customer.
• Personal information / personal data: information about an identified or reasonably identifiable person.
• Controller / processor: under the GDPR and UK GDPR, the controller decides why and how personal data is used; the processor handles it on the controller's behalf.
• Sub-processor: a service provider we engage that processes personal information for us.

Change log