Appearance
Privacy Policy
Last updated: 2 September 2026
Back to code B.V. ("we", "us", "our") operates the Kendo project management platform at kendo.dev. This privacy policy explains what personal data we collect, why we collect it, and what rights you have.
1. Who we are
| Company | Back to code B.V. |
| Address | Europaweg 31, 9723 AS Groningen, The Netherlands |
| KvK | 85421340 |
| [email protected] |
For your account and billing data we are the controller. For the project data you and your workspace members create, your workspace is the controller and we act as processor on its behalf, within the meaning of the General Data Protection Regulation (GDPR).
2. What data we collect
2.1 Account data
| Data | Purpose | Legal basis |
|---|---|---|
| First name, last name | Display in the app, team collaboration | Contract performance (Art. 6(1)(b)) |
| Email address, or the identifier from Google/GitHub sign-in | Authentication, notifications, invitations | Contract performance (Art. 6(1)(b)) |
| Password | Authentication (stored hashed, never in plain text) | Contract performance (Art. 6(1)(b)) |
| Profile picture | Display in the app | Contract performance (Art. 6(1)(b)) |
| Two-factor authentication secret and recovery codes | Account security (stored encrypted) | Legitimate interest (Art. 6(1)(f)) |
| Notification preferences | Email notification settings | Contract performance (Art. 6(1)(b)) |
Profile pictures and project logos are served from a public content delivery network. Anyone who has the image URL can view it; do not upload a picture you would not want to be publicly visible.
2.2 Project data
When you use Kendo, you create and store project-related data including issues, comments, time entries, sprints, epics, reports, and attachments. This data belongs to your workspace and is processed solely to provide the service. Free-text fields may contain personal data of third parties (for example a customer name in an issue); your workspace is responsible for what it enters. Error events sent by applications you connect are kept per error group and deleted after 90 days without recurrence.
Legal basis: Contract performance (Art. 6(1)(b) GDPR).
2.3 Billing data
If your workspace subscribes to a paid plan, payments are handled by Stripe. We store your billing contact's name and email address, the seat count, and opaque Stripe identifiers together with the card brand and last four digits of the card. Full card details, invoices, and billing addresses are held by Stripe, not by us.
Legal basis: Contract performance (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c), Dutch tax record-keeping).
2.4 GitHub integration
If you connect your GitHub account, we store an OAuth token to sync repositories and issues. We do not access your GitHub data beyond what is required for the integration. You can disconnect GitHub at any time from your settings.
Legal basis: Consent (Art. 6(1)(a) GDPR).
2.5 AI features (bring your own key)
AI features are off until a workspace or project administrator adds their own API key for an AI provider (currently Anthropic or OpenAI). Content you then choose to send (issue text, comments, attachments) goes directly to that provider under your agreement with them; they are not our processor. Your key is stored encrypted, every request carrying your content is written to your workspace audit trail, and removing all keys disables these features.
Our account is also used if we operate the AI features for your workspace instead of on your key. Anthropic then processes that content on our behalf (see section 4).
Legal basis: Consent of the workspace administrator (Art. 6(1)(a)).
2.6 Technical data
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, user agent | Security, audit trail | Legitimate interest (Art. 6(1)(f)) |
| Session identifier | Maintain your login session | Contract performance (Art. 6(1)(b)) |
| Error and performance telemetry | A sample of requests is sent to our monitoring provider (Laravel Nightwatch, EU region) to diagnose errors and slow requests; can include the request path, the acting user's identifier, and error context | Legitimate interest (Art. 6(1)(f)) |
| Audit trail entries (your name, email address, role, IP address, user agent, old and new values) | Tamper-evident change history for your workspace | Legitimate interest (Art. 6(1)(f)) |
We do not use analytics services, tracking pixels, or advertising cookies.
3. Cookies
We use only strictly necessary cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you logged in | 7 days |
| CSRF token | Protects against cross-site request forgery | 7 days |
| Remember token | "Remember me" functionality | Until you log out (maximum 400 days) |
These cookies are essential for the application to function and do not require consent under the ePrivacy Directive. We do not place any tracking, analytics, or marketing cookies.
For more details, see our Cookie Policy.
4. Where your data is stored and who processes it
Your workspace data is stored in the European Union. These providers process data on our behalf under a Data Processing Agreement and do not use it for their own purposes:
| Provider | What | Location |
|---|---|---|
| Fly.io | Application servers | Amsterdam, Netherlands |
| DigitalOcean | Databases (MySQL, one per workspace), sessions and cache (Redis) | Amsterdam, Netherlands |
| Amazon Web Services (S3) | File attachments | Frankfurt, Germany |
| Cloudflare | DNS, CDN, profile pictures and logos, marketing site | EU storage, global CDN |
| Laravel Nightwatch | Error and performance monitoring | EU |
| Mandrill (Mailchimp Transactional, Intuit Inc.) | Transactional email | US, under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payment processing | Ireland; Stripe global infrastructure under Stripe's Data Processing Agreement |
| Anthropic, PBC | AI features we run on our account instead of on your key (section 2.5) | US, under Anthropic's Data Processing Agreement and Standard Contractual Clauses |
Integrations you switch on yourself (GitHub, an AI provider via your own key) fall under your agreement with that provider, not this list. A data processing agreement covering our role as your processor is available on request.
5. Who has access to your data
- You and your workspace members, according to the permissions your workspace administrator sets.
- Back to code B.V., for support, debugging, or legal compliance. Limited to what is necessary.
- The processors in section 4.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
6. How long we keep your data
| Data | Retention |
|---|---|
| Account data | For the duration of your account, plus 30 days after deletion |
| Project data and attachments | For the duration of your workspace; deleted 30 days after the workspace is removed |
| Error events | Deleted after 90 days without recurrence |
| Audit trail | For the lifetime of the workspace |
| Billing records | 7 years after the invoice date (Dutch tax law) |
| Server logs | Kept by our hosting provider as part of its platform; we keep no separate copy |
| Backups | Maximum 30 days, then permanently deleted |
When you delete your account, your profile is soft-deleted for 30 days (to allow recovery), after which your personal data is removed. Comments and time entries you authored remain in the workspace as workspace records, attributed to a deactivated user, because they belong to the workspace rather than to you personally.
7. Your rights
Under the GDPR, you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate data |
| Erasure | Ask us to delete your data ("right to be forgotten") |
| Restriction | Ask us to restrict processing of your data |
| Portability | Receive your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interest |
| Withdraw consent | Withdraw consent at any time (e.g., GitHub integration, AI features) |
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If your request concerns project data controlled by your workspace, we will forward it to your workspace administrator.
8. Data security
We take appropriate technical and organisational measures to protect your data:
- Passwords are hashed (bcrypt)
- Two-factor secrets, recovery codes, and AI provider keys are encrypted at rest
- Sessions are encrypted and stored server-side (Redis)
- Each workspace has its own database; no data is shared between workspaces
- The audit trail is hash-chained so that tampering is detectable
- All connections use HTTPS/TLS
- Cookies are HTTP-only and Secure-flagged
- CSRF protection on all state-changing requests
Data breach notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of discovery, as required by Article 33 GDPR. If the breach is likely to result in a high risk to you, we will also inform you directly without undue delay. Where your workspace is the controller, we will inform your workspace administrator without undue delay so they can meet their own obligations.
9. Children
Kendo is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.
10. Changes to this policy
We may update this privacy policy from time to time. When we make significant changes, we will notify you by email or through the application. The "last updated" date at the top of this page reflects when the policy was last revised.
11. Complaints
If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
- Website: https://autoriteitpersoonsgegevens.nl
- Phone: 088 - 1805 250
12. Contact
For any questions about this privacy policy or your personal data:
Back to code B.V. Europaweg 31, 9723 AS Groningen, The Netherlands [email protected]