GDPR Rights & Data Requests

The data controller for personal data processed through Kashboard is Omnaxis LLC, operator of Kashboard. You can contact us at contact@kashboard.app. We do not currently have a statutory obligation to appoint a Data Protection Officer or an EU/UK Article 27 representative; the same contact address handles all privacy enquiries.

This notice applies to individuals in the European Economic Area (EEA), the United Kingdom, and Switzerland whose personal data Kashboard processes as a controller — typically account holders, users invited to an account, and website visitors.

Where you upload documents about third parties (e.g. supplier invoices, customer receipts) into your Kashboard workspace, you are the controller of that data and Kashboard is a processor acting on your instructions. We handle it in line with our Data Processing Addendum (available on request).

• Account data — name, email, hashed password, workspace membership.
• Billing data — subscription tier, billing name, country, VAT ID, Stripe customer ID. Payment card data itself is handled by Stripe, our merchant of record; Kashboard never sees or stores it.
• User-uploaded content — receipts, invoices, bills, statements, notes, tags, and any personal data those documents contain.
• Usage and diagnostic data — pages visited, feature interactions, error logs, IP address, browser and OS.
• Support correspondence — anything you send us by email or in-app chat.

• Contract (Art. 6(1)(b)) — to create your account, deliver the Service, process payments, and provide support.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and anti-fraud laws.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, debug errors, and improve the product. We balance these against your rights and you can object at any time (see § 8).
• Consent (Art. 6(1)(a)) — for non-essential cookies and any optional marketing communications. You can withdraw consent at any time.

We do not use your data for automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR).

We keep personal data only as long as we need it:

• Account and workspace data — for as long as your account is active, then deleted within 30 days of account closure unless a longer period is required by law.
• Billing records — retained for up to 7 years to comply with tax and accounting obligations.
• Support correspondence — up to 24 months.
• Server logs — up to 90 days, then rotated or anonymised.
• Backups — encrypted backups may retain data for up to 35 days after deletion before they roll off.

We use the following subprocessors to run Kashboard. All are bound by written contracts requiring GDPR-compliant safeguards.

A signed Data Processing Addendum (DPA) is available on request from contact@kashboard.app.

Personal data may be transferred to and processed in countries outside the EEA or UK, including the United States. Where we do so, we rely on appropriate safeguards under Chapter V GDPR, including:

• The European Commission's Standard Contractual Clauses (2021 SCCs) and the UK ICO's International Data Transfer Addendum, and
• Additional technical measures such as encryption in transit and at rest.

A copy of the safeguards applicable to a specific transfer can be requested from contact@kashboard.app.

Subject to the conditions in the GDPR, you have the right to:

• Access (Art. 15) — get a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17, "right to be forgotten") — have your data deleted where the legal grounds allow.
• Restriction (Art. 18) — restrict how we use your data while a dispute is resolved.
• Data portability (Art. 20) — receive a machine-readable copy of the data you provided and transmit it to another controller.
• Object (Art. 21) — object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time (this does not affect processing before withdrawal).
• Lodge a complaint with a supervisory authority (see § 11).

You can exercise your rights in either of two ways:

1. In-app — signed-in users can export or delete their account and workspace data from Settings → Privacy & data. Export returns a JSON/CSV bundle of your data; delete removes your account and all workspaces you own, subject to the retention rules in § 5.
2. Email contact@kashboard.app with the subject "GDPR Data Request". Tell us which right you are exercising (access, rectification, erasure, restriction, portability, objection, withdraw consent) and the email address associated with your Kashboard account.

Verification. To protect your data we verify that the requester is the account holder — normally by confirming the request from the email on file and, where needed, a signed-in confirmation or one-time code. We only use verification information for that purpose.

Timing. We acknowledge requests within 10 business days and respond substantively within one month (Art. 12(3) GDPR). Where a request is complex or numerous we may extend by up to two further months and will tell you why.

Fees. Requests are free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive (Art. 12(5)).

Kashboard uses a granular consent banner to collect and record your choices for non-essential cookies and local storage. You can review the full inventory in our Cookie Policy and change your choices at any time:

Your choices are stored in kashboard.consent.v1 on your device. Withdrawing consent does not affect processing carried out before withdrawal.

We would prefer to resolve any concerns directly — please email us first at contact@kashboard.app. You also have the right to lodge a complaint with the supervisory authority in your EU/EEA Member State, or with the UK Information Commissioner's Office (ICO):

• List of EEA supervisory authorities (EDPB)
• UK ICO — Make a complaint
• Swiss FDPIC

• Email: contact@kashboard.app
• Entity: Omnaxis LLC (operator of Kashboard)