Skip to content

Privacy Policy

Last changed: 31 October 2026. This English version is a courtesy translation; only the German version is legally binding.

1. Overview

This privacy policy describes which personal data we process when you use this website (kanman.ai), the documentation (docs.kanman.ai) or the kanman application (app.kanman.ai), why we process it, and what rights you have. kanman is an AI teammate for engineering teams that works on the repositories and issue trackers a customer connects. Where we process data in those repositories, trackers and runs on behalf of a customer, we act as a processor under our Data Processing Agreement, and the customer is the controller. For the website, account data, billing and support, we are the controller ourselves.

2. Controller

Marco Kerwitz
kerwitz.dev
Birkenweg 21
31226 Peine, Germany
Phone: +49 5171 9078566
Email: [email protected]

We have not appointed a data protection officer because there is no legal obligation to do so. For questions about data protection, please use the contact details above.

3. Website and Documentation

3.1 Delivery and Server Logs

The website and the documentation are delivered through Cloudflare (Cloudflare, Inc., USA). When you open a page, Cloudflare processes technically necessary data: IP address, time, requested address, referrer, browser and operating system. Cloudflare also protects the pages against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in delivering the website securely and quickly).

Retention: according to Cloudflare's log retention; we do not analyse these logs in relation to individuals.

3.2 Audience Measurement

On the website and in the application we use Cloudflare Web Analytics. It records the page viewed, referrer, browser, device type, approximate country and load times. Cloudflare Web Analytics sets no cookies, uses no local storage and builds no cross-site profiles. On the website, the measurement script is served through kanman.ai and the measurements are forwarded to Cloudflare through kanman.ai. If your browser uses tracking protection that blocks the script, no measurement takes place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding which pages are used and how fast they load). You can object at any time, for example by email to [email protected].

3.3 Images from Unsplash

Some images in our blog posts and the background images you can choose for a team in the application are loaded directly from the servers of Unsplash (Unsplash Inc.). Your browser then sends your IP address and technical data to Unsplash. The image search in the application runs through our server; your search terms go to Unsplash without your account data. Unsplash's privacy policy: unsplash.com/privacy.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation).

3.4 Status Indicator

In the website footer, your browser requests the current service status from status.kanman.de. This transmits your IP address and technical connection data. The request contains no account data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in informing about outages).

3.5 Onboarding Request and Booking

The form on the onboarding page sends nothing to our servers: it opens your email program with a prepared email to [email protected]. Section 3.6 applies to that email. If you use the booking link instead, you go to Cal.com (Cal.com, Inc., USA), where Cal.com's privacy terms apply.

3.6 Contact by Email

Emails to addresses at kanman.ai (for example [email protected]) are received by Cloudflare Email Routing and forwarded to our mailbox at Google (Google Ireland Limited, Ireland). We process your details to answer your request.

Legal basis: Art. 6(1)(b) GDPR where the request concerns or prepares a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering).

Retention: until the request is resolved; longer only where statutory retention obligations apply (for example to business letters).

4. The kanman Application

4.1 Account and Workspace

When you sign up and use kanman, we process:

  • Email address and password (stored only as a hash)
  • Name and profile details, if you provide them
  • Workspaces, teams, roles and invitations
  • Settings, for example language, notifications and appearance
  • IP address at sign-up, to limit abuse (sign-ups per IP address and hour)

Legal basis: Art. 6(1)(b) GDPR (contract); for abuse prevention Art. 6(1)(f) GDPR.

Retention: until you delete your account or the workspace is deleted; deleted workspaces are erased for good after 30 days.

4.2 Content on Behalf of the Customer

When a customer connects repositories, trackers and channels, kanman processes on the customer's behalf:

  • Source code and repository metadata (branches, commits, pull or merge requests, author names and email addresses in commit history)
  • Tracker content (issues, stories, comments, assignees)
  • Messages to and from kanman, in the application, in Slack, Microsoft Teams or by email
  • CI logs, test results and run artifacts (reports, screenshots, browser traces)
  • Decisions, policies and audit log entries (who did what, on whose approval, at what cost)

This data may contain personal data, for example names in commit history or comments. The customer decides what is connected and can disconnect it at any time.

Legal basis: processing on behalf of the customer under Art. 28 GDPR; the customer is responsible for the legal basis.

Retention: see section 7.

4.3 Usage and Log Data

Using the application produces technical data: IP address, timestamps, browser and device, and your actions in the application where they are recorded in the workspace's activity log or audit log. We use this data to provide the service, find errors and prevent abuse.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in security and troubleshooting).

Retention: technical logs according to our hosting providers' log retention; activity log and audit log see section 7.

4.4 Emails

We send emails through Resend (Plus Five Five, Inc., USA; sent from the EU region in Ireland):

  • Necessary emails: sign-up confirmation, sign-in links, password resets, invitations and notices about your account and billing.
  • Digests: an email digest of what kanman left for you in the application (unread messages, open proposals), and team reports. Each of these emails contains a link to unsubscribe with one click, without signing in; you set frequency and time in the notification settings. We record whether a digest was delivered and whether you opened the application within 24 hours afterwards.
  • Replies by email: if you reply to such an email, Cloudflare Email Routing receives the reply and it appears as a message in the conversation of the team concerned.

Legal basis: Art. 6(1)(b) GDPR for necessary emails and replies; Art. 6(1)(f) GDPR for digests (legitimate interest in informing you about open items in your team). You can unsubscribe from digests at any time.

4.5 Push Notifications

You only receive push notifications if you allow them in the application and in your browser. For this we store the push address and keys your browser gives us. Notifications are delivered through your browser's push service (for example from Google, Apple, Mozilla or Microsoft); the content is end-to-end encrypted.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the application or in your browser settings.

4.6 Cookies and Local Storage

The application sets no cookies for advertising or tracking and uses no advertising or tracking tool. In your browser's local storage (localStorage and sessionStorage) it keeps only what is needed to use it or what you set yourself: your sign-in session, appearance and accessibility, the workspace you opened last, recently used repositories, and drafts while setting up a team. Cloudflare may set technically necessary cookies for security. A cookie banner is therefore not needed.

Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the service you requested) and Art. 6(1)(b) GDPR.

4.7 Payments

Paid plans are processed through Stripe (Stripe Payments Europe, Limited, Ireland). Stripe processes name, email address, billing address, payment data and transaction data. We do not receive full card details. Stripe's privacy policy: stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax retention obligations).

Retention: invoices and accounting records up to 10 years (Section 147 AO, Section 14b UStG).

4.8 Protection Against Automated Sign-ups

If we switch on a check against automated access on the sign-in pages, we use Cloudflare Turnstile. Turnstile processes technical data of your browser and your IP address for this.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

4.9 AI Models

To write stories, code and answers, kanman sends prompts and the code, tracker and conversation context they need to an AI model provider.

  • Own key (BYOK), AI gateway or own runners: the customer uses its own contract, for example with Anthropic, OpenAI, Microsoft (Azure OpenAI) or Amazon Web Services (Amazon Bedrock). The provider processes the data under the customer's contract; the customer is responsible for it.
  • Model access through kanman: if a team uses our model access instead, we engage Anthropic or OpenAI as sub-processors.

We do not use your content to train AI models.

4.10 Connected Services

When a customer connects services such as GitHub, GitLab, Jira, Slack or Microsoft Teams, kanman reads and writes there on the customer's behalf. The customer engages these services itself; their privacy terms apply.

4.11 Operations and Support

For operations, troubleshooting and support, the owner uses AI assistance from Anthropic (Anthropic, PBC, USA). Data from the application may be processed in individual cases where the task requires it.

Legal basis: Art. 6(1)(b) and (f) GDPR; for customer content Art. 28 GDPR.

5. Recipients

All service providers that process data on our behalf, with purpose, data categories, location and transfer mechanism, are listed on the sub-processor page. In short: Supabase (database, sign-in, files, server functions; data stored in Stockholm, Sweden), Fly.io (cloud runner in Frankfurt am Main), Cloudflare (delivery, DNS, protection, email forwarding, audience measurement), Resend (email sending from Ireland), Stripe (payments), Google (support mailbox) and Anthropic (AI assistance in operations; model access through kanman), plus OpenAI for model access through kanman. We do not sell personal data.

6. Transfers to Third Countries

Some service providers are based in the USA or process data there. For recipients certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 applies. In addition or otherwise, we base transfers on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Which mechanism applies to whom is shown on the sub-processor page. A copy of the safeguards is available on request.

7. Retention

Data Retention Basis
Account data Until the account or workspace is deleted, then at most 30 days Contract
Stories, runs, run artifacts, decisions, activity As long as the team exists, then 30 days (details in the documentation) Customer instruction
Conversations with kanman As long as the workspace exists, then 30 days Customer instruction
Audit log As configured for the workspace, by default 365 days; deleted with the workspace Customer instruction
Source code checked out for a run Only during the run; the machine is removed afterwards Customer instruction
Database backups Daily backups, overwritten in their regular cycle Legitimate interest (data security)
Support emails Until resolved, longer only where retention is required by law Contract, legitimate interest
Invoices and accounting records Up to 10 years Section 147 AO, Section 14b UStG
Technical logs According to the hosting providers' log retention Legitimate interest

8. Your Rights

Under the GDPR you have the following rights. Where we process data on behalf of a customer, please direct requests to that customer; we support the customer in answering them.

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR). You can delete your account yourself in the application.
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR). You can export your personal data and the audit log in the application.
  • Objection to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
  • Complaint to a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, lfd.niedersachsen.de.

We answer requests within one month. For complex requests the period may be extended by two months; we will tell you if so.

9. Obligation to Provide Data and Automated Decisions

For an account we need your email address and a password or sign-in link; without them we cannot create an account. Other details are voluntary. We make no automated decisions about persons within the meaning of Art. 22 GDPR. kanman decides about work on code and stories under the policies the customer sets.

10. Data Security

All connections are encrypted with TLS, and stored data is encrypted by the hosting providers. Customer data is separated by workspace in the database through row-level security. Each cloud run executes on its own machine, which is removed afterwards. Model keys are stored encrypted, and credentials are removed from logs before they are stored. The measures in detail are in Annex 1 of the Data Processing Agreement.

11. Contact

For questions about data protection and to exercise your rights: [email protected]

12. Changes

We update this privacy policy when our offer or the service providers we use change. The version published here applies; its date is at the top.