Privacy policy

This policy describes how Karussell Labs OÜ (“we”) processes personal data when you use Kauri at https://kauri.karusselllabs.com. It is written under the General Data Protection Regulation (GDPR).

Controller

Karussell Labs OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, Registry code 17536456. Contact: contact@karusselllabs.com.

For the content your organisation puts into Kauri — findings about your systems, requests, commit messages, attachments — your organisation is the controller and we are its processor under the data processing agreement. This policy covers the data we process as controller: your account and your use of the site.

What we process, and why

• Account: your email address and sign-in events, to authenticate you and to send sign-in links. Legal basis: performance of the contract (Art. 6(1)(b)).
• Membership: which organisations you belong to and your role, to enforce access. Art. 6(1)(b).
• Server logs: IP address, requested path, time and status, to operate and secure the service. Kept up to 30 days. Legal basis: legitimate interest in security (Art. 6(1)(f)).
• Email: sign-in links are sent from no-reply@karusselllabs.com through our mail host. Art. 6(1)(b).

We do not use cookies for tracking or advertising. The only cookies are the session cookies that keep you signed in.

Recipients

Our sub-processors are the hosting provider of the platform and its mail (Hetzner Online GmbH, Germany) and the hosting provider of the database and authentication service (Supabase Inc., with data stored in AWS eu-central-1, Frankfurt). The full list, with roles and locations, is in the data processing agreement. Data is not transferred outside the European Union for storage; Supabase Inc. is a United States company operating the Frankfurt region under its data processing terms and the EU Standard Contractual Clauses.

Retention

Account data is kept while your account exists. Organisation data is kept while the organisation exists and is deleted immediately and completely when an owner deletes the organisation. Drift reports older than two years are deleted by a scheduled job. Server logs are kept up to 30 days.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection under Articles 15 to 21 GDPR, and the right to lodge a complaint with a supervisory authority; ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). Owners can export their organisation’s data from the settings page and delete the organisation from the same page. For everything else, write to contact@karusselllabs.com.

Changes

We will announce material changes to this policy on the site before they take effect. The version date is at the top.