Privacy Policy

1. Overview

At KanbanStack, we take your privacy and the confidentiality of your sales pipelines seriously. This Privacy Policy outlines our practices regarding the collection, storage, encryption, and handling of information when you use our website, applications, and APIs.

2. Information We Collect

• Account Information: When you register, we collect your name, email address, and authentication tokens via Clerk.
• Workspace & Pipeline Data: Prospect lists, CSV/Excel imports, contact names, company names, notes, custom tags, and board column configurations.
• Connected Email Inboxes: When connecting OAuth (Gmail / Microsoft) or custom SMTP credentials, we securely store authorization tokens and encrypted credentials. Custom SMTP passwords are encrypted using AES-256-GCM with unique initialization vectors.
• Outreach Logs & Metrics: Email delivery status, timestamp of dispatches, smart open-rate tracking pixels (excluding bot scans), reply events, and bounce notifications.
• Payment Information: Billing details, Razorpay customer IDs, subscription status, and payment transaction logs. We do not store full credit card numbers on our servers.

3. How We Use Your Information

We process your data strictly to provide and enhance the Service, including:

• Dispatching scheduled email campaigns across your connected rotation inboxes.
• Generating personalized email drafts using generative AI models (Google Gemini API).
• Detecting prospect replies and moving Kanban cards automatically across your pipeline stages.
• Providing analytics, delivery benchmarks, and team performance metrics.
• Preventing fraud, enforcing account rate limits, and ensuring anti-spam compliance.

4. Google API User Data Policy Compliance

KanbanStack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements:

• We only use Gmail access to send outbound sales messages on your explicit instruction and to read bounce/reply notifications to update your board in real-time.
• We do not sell your Google user data to third parties, data brokers, or advertising networks.
• We do not use or transfer your email content to train generalized AI models.

5. Data Sharing and Third-Party Sub-processors

We share data solely with trusted infrastructure providers required to deliver the Service:

• Clerk: User authentication and identity management.
• Razorpay: Payment processing and subscription management.
• MongoDB Atlas: Encrypted cloud database storage.
• Inngest: Serverless background queue processing.
• Pusher: Real-time WebSocket board synchronization.
• Upstash Redis: High-speed API rate limiting.

6. Data Retention & Deletion

We retain your data for as long as your workspace account is active. You may export your leads or request permanent deletion of your account and all associated data at any time by contacting our support team.

7. Security Measures

We employ enterprise-grade security practices including TLS/SSL encryption in transit, AES-256-GCM encryption for stored SMTP credentials, RBAC workspace permission barriers, and automated bot-filtering algorithms for open tracking.

8. Grievance Officer & Inquiries

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, if you have any questions or grievances regarding your data, please contact: