DRAFT – legal review required
This document is a draft and has not yet been reviewed by a lawyer. The text may change before the paid service launches. The Polish version prevails.
KaiLedger Privacy Policy
Who processes personal data in KaiLedger, why, for how long, and what rights you have (Articles 13 and 14 GDPR).
- Version:
- 2026-10-16-draft
- Date:
1. Who is the controller
The controller of the personal data described in section 3 is [Operator: company name, registered address, NIP, KRS] (the “Operator”, “we”). Contact for personal data matters: [privacy email address], [postal address]. [If a data protection officer is appointed: DPO contact details.]
This Policy covers the KaiLedger service (public pages and the application) and contacting us.
2. Two roles: controller and processor
KaiLedger processes two kinds of personal data:
- Data we process as a controller — data of people using the service (Users), customers' contact and billing details, and technical data. This Policy is about this data.
- Data a customer enters into the application about its own business — e.g. staff names, working hours and pay, counterparties on invoices and bank statements. The customer (employer, buyer) is the controller of this data; we process it only on the customer's behalf under the Data Processing Agreement (/legal/dpa, Article 28 GDPR). Please contact the customer about this data — we pass any request we receive on to them.
3. What data, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, name, User role, the company the User can access | Creating and running the account, sign-in by email link, access management | Art. 6(1)(b) (contract) — for the person concluding the agreement; Art. 6(1)(f) (legitimate interest of the customer and ours: giving access to people the customer chooses) |
| Customer company and contact person details, invoicing details, payment history (no card data) | Billing, invoicing, debt collection | Art. 6(1)(b) and (c) (tax and accounting obligations); Art. 6(1)(f) (pursuing claims) |
| Versions of accepted documents (Terms, Policy, DPA), date and User | Proving the conclusion of the agreement and what was accepted | Art. 6(1)(f) (evidence of the agreement) |
| Technical logs: IP address, browser, time and type of operation, the application's change log (audit log) | Security, abuse detection, troubleshooting, accountability for changes | Art. 6(1)(f) (security and continuity of the service) |
| Support and complaint correspondence | Handling questions and complaints | Art. 6(1)(b) and (f) |
| Questions asked to the “Ask” assistant and its answers | Answering; troubleshooting the assistant | Art. 6(1)(b); customer data in questions — under the DPA |
| Email address of the customer's contact person | Information about changes to the service and documents; [marketing about KaiLedger — if the Operator decides, with opt-out] | Art. 6(1)(f); for marketing also the Polish Electronic Communications Law |
Providing data is voluntary, but without an email address you cannot create an account or sign in, and without company details the agreement cannot be concluded.
4. Where we get data from
You provide most data yourself. If the owner of a company account gave you access (e.g. as accountant or store manager), we received your email address, name and role from them. Technical data is generated when you use the service.
5. Who we share data with
We entrust data only to providers that help us run the service, under data processing agreements and only as far as necessary:
| Entity | Purpose | Data location | Transfer basis outside the EEA |
|---|---|---|---|
| Supabase, Inc. (USA) — [contracting entity to confirm] | Database, authentication, file storage, backups | EU — [region, e.g. Frankfurt (eu-central-1)] | Data stored in the EU; support access from the USA under Standard Contractual Clauses (SCC) / EU-US Data Privacy Framework |
| Vercel Inc. (USA) | Hosting of the web application, request processing | [function region, e.g. EU — Frankfurt (fra1)]; global CDN | SCC / EU-US Data Privacy Framework |
| Anthropic, PBC (USA) — [or Anthropic Ireland, Ltd., to confirm] | The “Ask” assistant (optional): the User's question and the figures needed to answer it | USA | SCC / EU-US Data Privacy Framework; under the commercial API terms data is not used to train models |
| Stripe Payments Europe, Ltd. (Ireland) | Subscription payments (card, BLIK) | EU; possible transfer to Stripe, Inc. (USA) | SCC / EU-US Data Privacy Framework |
| [Resend, Inc. (USA) or another email provider] | Sending sign-in link emails and notifications | [USA / EU — to confirm] | SCC / EU-US Data Privacy Framework |
Data may also be received by our accountants and advisers (legal, tax) as needed for billing and legal matters, and by public authorities where required by law. We do not sell data or share it for advertising.
6. Transfers outside the EEA
The application database is in the European Union. Some providers (listed above) are based in the USA or may access data from the USA. Such transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) where the provider is certified, or on Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to the address in section 1.
7. How long we keep data
- User account data — while the User has access to the company account; after access is removed or the account deleted we delete it, except entries in the change log (next point).
- Change log (audit log) and security logs — [up to 12 months] or until the company account is deleted, if earlier; hosting providers' technical logs — per their retention periods [up to 30 days].
- Billing data and invoices — 5 years from the end of the year in which the tax payment deadline passed (Article 86 of the Polish Tax Ordinance, Article 74 of the Accounting Act).
- Evidence of accepted documents and correspondence — until claims become time-barred (generally 6 years; 3 years for periodic and business-related claims, Article 118 of the Civil Code).
- Customer data processed under the DPA — until deleted at the customer's request after a 30-day grace period, or as set out in the Terms after the agreement ends; backups are overwritten within a further [30] days.
8. Your rights
You have the right to access your data and receive a copy (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interest (Article 21). To exercise them, write to the address in section 1. We reply within one month.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
If you are an employee or counterparty of one of our customers and your data is in the application (e.g. in working-hours records), the customer is the controller — please contact them. If you write to us, we pass the request on to the customer.
9. Automated decisions
We do not make decisions producing legal effects concerning you or similarly significantly affecting you based solely on automated processing, including profiling (Article 22 GDPR). Alerts and answers of the “Ask” assistant concern the company's financial results and are for information only.
10. Security
Each company's data is isolated in the database with Row Level Security rules; connections are encrypted (TLS) and data at rest is encrypted by the database provider; integration tokens (e.g. KSeF) are kept in a vault; sign-in uses a one-time email link, no passwords. Details: Annex 1 to the Data Processing Agreement (/legal/dpa).
12. Changes to this Policy
We announce material changes in the service and by email. Each version has a version label and date shown at the top of the page. The Polish version prevails.