Legal
Privacy notice
This is an informed draft privacy notice for the Kintry public beta, written to reflect the GDPR. Please review it with counsel before you rely on it for compliance.
Who we are
The service is operated by Kintry s.r.o., a limited liability company incorporated in the Czech Republic.
- Company name: Kintry s.r.o.
- IČO (company ID): [to be completed]
- Registered office: [to be completed], Czech Republic
- Privacy contact: [email protected]
We are the controller for account data, marketing communications, and analytics about how the site and product are used. For the workspace content that our customers create and manage inside Kintry, we act as a processor and process it on the customer’s instructions. Those arrangements are described in our Data processing terms.
What we process and why
The tables below summarise the personal data we process, the purpose, and the lawful basis under Article 6 of the GDPR.
Account data
Your email, name, and authentication and session data, so we can create your account, sign you in, and provide the service. Lawful basis: performance of a contract, Article 6(1)(b).
Workspace content
Insights, features, work items, wiki pages, attachments, and any personal data our customers choose to include. We process this to provide the service and only on the customer’s instructions as their processor. Lawful basis: performance of a contract with the customer, Article 6(1)(b), with the customer as controller.
Security logs and authenticated product events
Security and operational logs, and product events that record authenticated workspace actions, so we can keep the service secure, prevent abuse, and understand how features are used. Lawful basis: our legitimate interests in a secure and improving product, Article 6(1)(f).
Client behavioral analytics and session replay
If you opt in through our cookie banner, we collect behavioral analytics and session replay to understand usage and improve Kintry. Session replay masks form inputs, and we do not capture the content you type. Lawful basis: your consent, Article 6(1)(a), which you can withdraw at any time.
Cookies
We use a small number of cookies and similar technologies. Analytics cookies are set only after you opt in. See our Cookie policy for the full list, purposes, and durations, and to change your choice.
Recipients and subprocessors
We share personal data with service providers who process it on our behalf under written agreements. Our current subprocessors are:
- Hetzner Online GmbH: server hosting and backups (Germany).
- Cloudflare: DNS, TLS, and content delivery.
- PostHog: product analytics (EU).
- Sentry: error monitoring (EU).
- Resend: transactional email.
- OpenRouter: AI inference, when a workspace enables AI features.
- Lovable AI Gateway: embeddings for search and cited answers.
- Firecrawl: web search, when that feature is enabled.
- GitHub and GitLab: only when a customer connects a repository.
Where a subprocessor processes data outside the EU, that transfer relies on Standard Contractual Clauses under the relevant provider’s data processing agreement. See International transfers below.
Retention
- Account data: for the life of the account, plus a short wind-down period.
- Workspace content: until the customer deletes it or deletes the workspace, after which it is removed following a short wind-down period.
- Security logs and analytics: for limited periods appropriate to their purpose.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data rectified;
- have your data erased;
- restrict processing;
- data portability;
- object to processing based on our legitimate interests; and
- withdraw your consent to analytics at any time using the Cookie settings link in the footer.
To exercise a right, email [email protected]. You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.gov.cz.
International transfers
Our core stack is EU-hosted. Where a subprocessor processes personal data outside the European Economic Area, we rely on the Standard Contractual Clauses adopted by the European Commission, incorporated in the relevant provider’s data processing agreement, as the transfer mechanism.
Changes
We may update this notice as the product and our processing evolve. We will communicate material changes by a reasonable means and update the notice on this page.
Contact
Questions about this notice or your personal data? Email [email protected].