Back to Kapcal

Kapcal Privacy Policy

Effective October 30, 2026. Version 2026-10-30.

This policy explains what personal information Kapcal collects, why, where it is kept, for how long, and the choices and rights you have. Kapcal is a scheduling and workflow service at kapcal.com.

1. Who we are

Kapcal is operated by Studio Hanneman, a sole proprietorship registered in Québec (NEQ 2246561288), 4775 Sherbrooke St. W., #12, Westmount, Québec H3Z 1G5, Canada ("Kapcal", "we", "us").

The person in charge of the protection of personal information is Francis Hanneman, privacy@kapcal.com.

2. Our role

  • Accounts, security and billing: we decide how this information is used. Under the GDPR we are its controller.
  • What organizations put on their boards (items, dates, notes, names of people they assign, categories): the organization decides. We process it on its behalf, under our Data Processing Agreement. Under the GDPR the organization is the controller and we are its processor. Questions about that content go first to the organization that runs the board.

3. What we collect and why

Information Where it comes from Why we use it GDPR legal basis
Name, email, password (stored only as a secure one-way hash) You, when you create an account or accept an invitation To create and secure your account and sign you in Contract
Language, time zone, picture colour, optional photo, "never sign out" setting You, in Account To show Kapcal, times and your account the way you chose Contract
Organization name, boards, roles, invitations (the invitee's email and name) Organization owners and administrators To give each person the right access Contract; legitimate interests
Board content The organization's members To provide the service to the organization On the organization's behalf
Sign-in records (when a sign-in started and was last used) Your use of Kapcal To keep you signed in and let you sign out everywhere Contract
Failed sign-in and password-reset attempts, sign-ups, contact form sends, and views of public share links, with the IP address Your browser To stop password guessing and abuse Legitimate interests (security)
Contact form messages: name, email, topic, message (and your account, if you are signed in) You To answer you Legitimate interests
Agreement to these terms: version, language, time and IP address You, when you agree To show what you agreed to and when Legal obligation; legitimate interests
IP address, when you open the legal pages or join Your browser To show the Terms and Privacy Policy in French first to people in Québec. It is looked up in a location database kept on our own server, and not stored Legal obligation (Québec's Charter of the French language)
Kapcal staff visits to an organization's boards Our staff's use of Kapcal To account for every staff visit; the organization can see these Legitimate interests (accountability)
Plan, subscription status and renewal dates, Paddle customer and subscription numbers Paddle To apply the organization's plan Contract
Connected services, only when an administrator turns them on: Asana access token, Microsoft Outlook and Google Calendar sign-in tokens (all encrypted), the email address of the connected account, calendar events (titles, dates, times, notes), addresses of subscribed calendars The administrator and the connected service To keep the board in sync with that service Contract; on the organization's behalf
Private calendar links You, in Tools To let your calendar app subscribe to a board Contract
Notification settings (per board: how often, what about, owner names that are you, reminders) and the items you follow; a record of what changed on boards where someone has notifications on (each item before and after, and who changed it); reminders already sent You, in User account → Notifications and Details; your organization's boards To email you the changes, reminders and summaries you asked for, once each. Nothing is sent until you turn notifications on Contract
Keys and sign-in connections for AI assistants and the API (stored only as one-way hashes), with their name, board, when they were last used and the assistant that used them; imports made with them (what each added and changed) You, in Account → AI & API, and the assistants you connect To let the assistants and software you choose reach your boards, and to undo their changes Contract
Web server logs (IP address, browser, pages requested) Your browser, kept by our host Security and troubleshooting Legitimate interests (security)

We send only service emails: sign-up confirmations, invitations, password resets, email-change confirmations and notices about your organization. We don't send marketing emails without your consent.

Google Calendar. When an administrator connects a board to Google Calendar, Kapcal asks Google for two permissions: to see the list of their calendars, and to see and edit events in their calendars. Kapcal only reads and changes the one calendar chosen for the board, and only to show its events on the board and send the board's changes back to it. Information from Google is not used for advertising, not sold, not used to train artificial intelligence models, and not read by people except with the organization's permission, for security, or when the law requires it. Kapcal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. An administrator can disconnect in Tools at any time, and anyone can remove Kapcal's access in their Google Account (myaccount.google.com/permissions).

AI assistants. If you connect an AI assistant (such as Claude or ChatGPT) or other software, by signing in to Kapcal from it or with a key, it reads and changes your boards through Kapcal on your instructions. What you share with that assistant, including the documents you give it and the board information it reads, is handled by its provider under that provider's terms and privacy policy, not ours. Kapcal never sends your information to an AI service by itself.

Payments. Paddle.com sells Kapcal subscriptions as merchant of record. Paddle collects card details, billing address and tax information under its own privacy policy (paddle.com/legal/privacy). We never receive card numbers.

What we don't do. We don't sell or rent personal information. We show no advertising, use no analytics or tracking tools, build no profiles, and make no decisions about people based solely on automated processing.

4. Cookies and browser storage

Kapcal uses only cookies it needs to work, so it doesn't ask for cookie consent.

Name What it does How long it lasts
kapcal_auth Keeps you signed in 7 days after your last visit, or 400 days with "never sign out"
kapcal_anon Protects the sign-in, sign-up, join and contact forms from forged requests 30 days

Your browser also stores display preferences, such as the open board and your filters. They stay on your device and are never sent to us.

The page loads nothing from other companies, except Paddle's checkout window when an owner chooses to upgrade.

5. Who we share it with

We share personal information only with the service providers below, only as much as each needs, and under contracts that protect it.

Provider What for Where
Namecheap, Inc. Hosting, database, backups and sending email United States
Paddle.com Market Ltd Selling and billing subscriptions (merchant of record) United Kingdom, with processing in other countries
Asana, Microsoft, Google, Apple or another calendar provider Only when an organization connects that service to a board Set by that provider
The AI assistant or software you connect, by signing in or with a key (for example Anthropic's Claude or OpenAI's ChatGPT) Only when you connect it, and only what it asks for on your behalf Set by that provider

We may also disclose information when the law requires it, to protect people's safety or our rights, or to a buyer of the business, who would be bound by this policy.

6. Where your information is kept

Kapcal's servers are in the United States today. We may move them to the European Union or the United Kingdom, and will update this policy if we do.

Before we send personal information outside Québec, we assess whether it will be adequately protected, as Québec law requires. For information from the European Economic Area or the United Kingdom, we rely on adequacy decisions where they apply, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum).

7. How long we keep it

Information Kept for
Your account Until you delete it (Account → Delete my account)
Board content Until the organization deletes it. Deleted items stay in the board's Trash for 30 days
A deleted organization and all its boards 14 days, so an owner can cancel, then removed for good
Sign-ins Until they expire (see section 4), then removed within a day
Password reset links 60 minutes
Email change links 24 hours
Sign-up links never opened, with the details given 24 hours
Contact form messages In our mailbox, as long as needed to answer you
Invitations 7 days, plus 30 days before the expired invitation is removed
Failed sign-in attempts, sign-ups, contact form sends and share-link views, with IP address 1 day
Record of Kapcal staff visits 24 months
Agreements to these terms As long as the account exists
Keys and connections for AI assistants and the API Until you revoke or disconnect them or delete your account; a connection also ends after 90 days without use
Records of imports by AI assistants (what they added and changed) 90 days (they can be undone for 30)
Notification settings and followed items Until you change them, leave the board or delete your account
Records of what changed on boards, and of reminders sent, for notifications 30 days
Subscription records As long as the organization exists. Paddle keeps payment records as tax law requires
Backups Up to 30 days after the information is deleted

8. How we protect it

  • Every connection is encrypted (HTTPS).
  • Passwords are stored only as a one-way hash.
  • Tokens for connected services are encrypted.
  • Sign-in cookies can't be read by scripts.
  • Repeated wrong passwords are blocked.
  • Every time Kapcal staff open an organization's board, it's recorded and shown to that organization's owners and administrators.

9. Your rights

You can ask to see, correct, download or delete your personal information. You can also withdraw a consent, object to a use, or ask us to restrict a use. Many of these you can do yourself:

  • Download my data and Delete my account: Account, in the menu under your initials.
  • Download all data and Delete organization (owners): Organization, in the same menu.

For anything else, write to privacy@kapcal.com. We answer within 30 days and may ask you to confirm your identity first.

If you're unhappy with our answer, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, in the EU or UK, your data protection authority.

10. Children

Kapcal is not meant for anyone under 14, or under the higher age set by the law where they live. We don't knowingly collect their information. If you think a child has an account, tell us and we will delete it.

11. Privacy incidents

We keep a register of privacy incidents. If an incident creates a risk of serious injury, we notify the Commission d'accès à l'information and the people affected, and any other authority the law requires. We tell organizations about incidents affecting their boards within 72 hours of learning of them.

12. Changes to this policy

When we make an important change, we update the date and version at the top and let you know in Kapcal or by email.

13. Contact

Francis Hanneman, person in charge of the protection of personal information
Studio Hanneman, 4775 Sherbrooke St. W., #12, Westmount, Québec H3Z 1G5, Canada
privacy@kapcal.com

Kapcal Refund Policy

Effective October 30, 2026.

Kapcal's paid plans come with a 14-day money-back guarantee.

  • First 14 days. If you're not satisfied, ask within 14 days of an organization's first subscription payment and you'll get a full refund. No reason needed.
  • After 14 days. You can cancel anytime in Organization → Manage billing. The plan stays active until the end of the period already paid for, and you won't be charged again. Payments already made are not refunded, in whole or in part.
  • Exceptions. We refund where the law requires it, and when you were charged by mistake (for example, twice for the same period).
  • How to ask. Reply to your Paddle receipt, use paddle.net, or write to hello@kapcal.com. Paddle, our reseller and merchant of record, issues the refund to the card or account you paid with, usually within 5 to 10 business days.
  • After a refund, the subscription ends at once and the organization goes back to the Free plan. If it then has more boards or people than the Free plan allows, its boards become read-only. Nothing is deleted.

Kapcal Data Processing Agreement

Effective October 30, 2026. Version 2026-10-30.

This agreement is part of the Kapcal Terms of Service. It applies when Studio Hanneman ("Kapcal", the processor) handles personal information on behalf of an organization that uses Kapcal (the "Customer", the controller). It meets the requirements of article 28 of the GDPR and the UK GDPR, and of section 18.3 of Québec's Act respecting the protection of personal information in the private sector. It applies to every Customer automatically, without a signature. A Customer that needs a signed copy can ask at privacy@kapcal.com.

1. Definitions

  • Customer Personal Data: personal information that the Customer or its users put on Kapcal boards, or that reaches the boards from services the Customer connects.
  • Terms such as controller, processor, processing, data subject and personal data breach have the meaning given to them in the GDPR.

2. Instructions

  • Kapcal processes Customer Personal Data only to provide Kapcal under the Terms, as the Customer's users configure it, and on other written instructions from the Customer.
  • If the law requires other processing, Kapcal will tell the Customer first, unless the law forbids it.
  • Kapcal will tell the Customer if it believes an instruction breaks data protection law.
  • Annex 1 describes the processing.

3. Confidentiality

Anyone Kapcal authorizes to process Customer Personal Data is bound to keep it confidential. Kapcal staff open a Customer's board only to provide support or keep the service running. Each such visit is recorded and shown to the Customer's owners and administrators.

4. Security

Kapcal maintains the technical and organizational measures in Annex 2. It may improve them, but never lower the overall level of protection.

5. Subprocessors

  • The Customer authorizes Kapcal to use the subprocessors listed in Annex 3.
  • Kapcal will give at least 30 days' notice before adding or replacing a subprocessor, on its legal page and by email to the Customer's owners.
  • The Customer may object on reasonable data protection grounds. If no solution is found, the Customer may end its subscription and receive a refund of any prepaid period it hasn't used.
  • Kapcal binds each subprocessor to data protection obligations at least as protective as this agreement, and remains responsible for its subprocessors.

6. Helping the Customer

  • Requests from data subjects. Organization owners can download and delete all of the Customer's data themselves. Kapcal will help with any other request, and will forward to the Customer any request it receives about Customer Personal Data.
  • Assessments. Kapcal will give reasonable help with privacy impact assessments and consultations with authorities.

7. Personal data breaches

Kapcal will notify the Customer's owners without undue delay, and within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice will say what happened, the data and people likely affected, the likely consequences, and the steps taken. Kapcal records every incident in its register of privacy incidents.

8. Transfers outside Québec, Canada, the EEA or the UK

  • Customer Personal Data is stored in the United States, at Namecheap. Kapcal may move it to the European Union or the United Kingdom, with notice under section 5.
  • Kapcal has assessed this transfer as Québec law requires (see its transfer assessment).
  • For Customers in the EEA, Switzerland or the UK, any transfer not covered by an adequacy decision takes place under the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 for onward transfers to subprocessors), with the UK Addendum and Swiss amendments as needed. They are included in this agreement by reference. Annexes 1 to 3 give the information the Clauses require. The Clauses prevail if they conflict with this agreement.

9. Audits

On request, Kapcal will provide the information needed to show that it complies with this agreement, such as answers to a reasonable security questionnaire. If that isn't enough, the Customer may carry out or commission an audit once a year, with 30 days' notice, at its own cost, and without access to other customers' data.

10. Deletion at the end

Owners can download all of the Customer's data at any time (Organization → Download all data). When an owner deletes the organization, Kapcal deletes Customer Personal Data after 14 days, and from backups within a further 30 days, unless the law requires it to be kept.

11. Liability and precedence

The liability limits in the Terms of Service apply to this agreement. Where this agreement and the Terms disagree on personal information, this agreement prevails.

Annex 1: Description of the processing

Item Description
Subject matter Hosting and running Kapcal, a scheduling and workflow service
Duration As long as the Customer uses Kapcal, plus the deletion periods in section 10
Nature and purpose Storing, displaying, organizing, syncing with services the Customer connects, backing up, and deleting schedule data
Data subjects The Customer's users, and people named on its boards (staff, contractors, clients)
Types of personal data Names, email addresses, roles, the schedule items they're linked to (titles, dates, times, owners, notes), and calendar events from connected services
Sensitive data Not intended. The Customer is asked not to put sensitive information on boards unless its work needs it
Frequency Continuous

Annex 2: Security measures

  • Encrypted connections (HTTPS) for all access.
  • Passwords stored only as one-way hashes. Access tokens for connected services encrypted at rest.
  • Sign-in cookies that scripts can't read. Protection against forged requests. Repeated failed sign-ins blocked.
  • Strict separation of each organization's data, enforced on every request and covered by automated tests.
  • Role-based access within each organization (owner, administrator, editor, viewer).
  • Staff access limited to support and operations, recorded, and shown to the Customer.
  • Expired sign-ins, links and logs removed automatically every day.
  • Regular backups held by the hosting provider.
  • Software updates tested before release.

Annex 3: Subprocessors

Subprocessor What it does Data Location
Namecheap, Inc. Hosting, database, backups, sending email All Customer Personal Data United States
Paddle.com Market Ltd Selling and billing subscriptions (merchant of record) Billing contact's name and email, billing details; no board content United Kingdom

Services that a Customer chooses to connect (Asana, Microsoft, Google, Apple and other calendar providers) are not Kapcal's subprocessors. The Customer engages them directly, under their own terms.

Contact

Studio Hanneman (Kapcal, formerly Flexboard), a sole proprietorship registered in Québec, NEQ 2246561288
4775 Sherbrooke St. W., #12, Westmount, Québec H3Z 1G5, Canada

Questions, support and billing: hello@kapcal.com
Privacy: privacy@kapcal.com
Or use the contact form
Person in charge of the protection of personal information: Francis Hanneman

Version 2026-10-30 · IP Geolocation by DB-IP (CC BY 4.0)