GDPR statement

1. Where your data lives

• Account data and Customer Data of European customers are stored in the European Union, on Amazon Web Services (AWS) servers, in a PostgreSQL database managed by Supabase.
• Backups stay in the same region.
• Klayno is established in the United States. When our team accesses data from there to run the Service or answer a support request, that access is covered by the European Commission's Standard Contractual Clauses.
• Some providers that send email, take payments or supply integrations are in the United States. Data reaches them only for the purpose listed on the sub-processors page, under Standard Contractual Clauses or the EU-US Data Privacy Framework.

2. Controller or processor

• For your account, your billing details, your messages to us and your visits to this website, Klayno is the controller. The privacy policy explains what we do.
• For the data our customers put into their workspace, Klayno is the processor and the customer is the controller. The data processing agreement governs that relationship.

3. What we commit to

• We collect only what the Service needs, for the purposes stated, and we say which legal basis applies to each one.
• We keep data no longer than the retention periods in the privacy policy, then delete it.
• We protect it with the measures on the security page, and we review them as the product changes.
• We keep a record of processing activities and run impact assessments for new features that carry a higher risk.
• We do not sell personal data and we do not use Customer Data for anything other than running the Service for that customer.

4. Your rights

You can ask to access, correct, delete, restrict or receive your personal data, object to processing based on legitimate interest, and withdraw a consent. The privacy policy lists each right in detail.

5. How to exercise them

• Email privacy@klayno.com from the address on your account, or with enough detail for us to find your data. We may ask for proof of identity if we cannot match the request to an account.
• We answer within one month. If a request is complex we can take up to two more months, and we tell you why.
• It is free. We only charge, or refuse, when a request is clearly unfounded or repeated, and we explain the reason.
• If you are a contact in a Klayno customer's workspace, send your request to that customer: they are the controller and we help them respond within their deadline. If you do not know who they are, write to us and we will forward it where we can.
• If you disagree with our answer, you can complain to the data protection authority of the country where you live or work.

6. If something goes wrong

If a personal data breach affects you, we tell you without undue delay when the risk to you is high, and we notify the competent data protection authority within 72 hours when the law requires it. For Customer Data, we notify the workspace owner as set out in the DPA so they can meet their own obligations.

7. Who to contact

Privacy questions and requests: privacy@klayno.com. Security reports: security@klayno.com.

8. Related documents

• Privacy policy
• Data processing agreement
• Sub-processors
• Cookie policy
• Security & trust