Privacy Policy

1. Introduction & Data Controller

Akievo ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our project management platform and related services (the "Service").

For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and other applicable data protection laws, Akievo is the data controller responsible for your personal data.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Full name (optional)
• Password (stored in encrypted/hashed form only)
• Profile picture (if provided)

2.2 Usage Data

We automatically collect certain information when you access our Service:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Date and time of access
• Referring website or source

2.3 Content Data

We store the content you create within the Service:

• Workspaces and boards
• Cards, tasks, and checklists
• Comments and descriptions
• File attachments
• Team member information and assignments

2.4 Payment Information

Payment processing is handled by Paddle.com Market Limited ("Paddle"), who acts as our Merchant of Record. This means Paddle is the seller of record for all transactions and is responsible for processing payments, issuing invoices, and handling tax collection.

Data collected by Paddle: When you make a purchase, Paddle collects and processes payment information directly. This may include:

• Full name and email address
• Billing address
• Payment method details (credit card, PayPal, etc.)
• Transaction history and invoices
• Tax identification information (where required)

Data we receive from Paddle: Akievo does not store your complete payment details. We receive limited information from Paddle, including:

• Subscription status and plan details
• Transaction confirmation and amounts
• Country of purchase (for analytics)
• Paddle customer ID (to link your subscription to your account)

For information on how Paddle handles your payment data, please refer to Paddle's Privacy Policy.

3. Legal Bases for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

3.1 Contract Performance (Article 6(1)(b))

Processing necessary to provide you with our Service, manage your account, and fulfill our contractual obligations to you.

3.2 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests, including:

• Improving and optimizing our Service
• Ensuring security and preventing fraud
• Analyzing usage patterns to enhance user experience
• Communicating important service updates

3.3 Consent (Article 6(1)(a))

Where you have given explicit consent, such as for:

• Marketing communications
• Optional analytics and tracking
• Third-party integrations

3.4 Legal Obligations (Article 6(1)(c))

Processing required to comply with legal obligations, including tax reporting, fraud prevention, and responding to legal requests.

4. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve our Service
• Process transactions and send related information
• Send transactional emails (account verification, password resets, etc.)
• Respond to your requests and provide customer support
• Monitor and analyze usage trends and preferences
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms
• Send marketing communications (only with your consent)

5. Data Sharing & Third Parties

We may share your data with:

5.1 Payment Processing (Paddle)

Paddle.com Market Limited acts as our Merchant of Record and payment processor. When you make a purchase, we share your email address with Paddle to link your subscription to your Akievo account. Paddle independently collects and processes your payment information as the seller of record.

Paddle's role as data controller: For payment and billing data, Paddle acts as an independent data controller under GDPR, meaning they determine the purposes and means of processing your payment information. Paddle is responsible for complying with data protection laws for the payment data they collect.

Data shared with Paddle:

• Email address (to identify your account)
• Selected subscription plan
• Country/region (for tax calculation)

Paddle processes this data in accordance with their Privacy Policy and is compliant with GDPR, UK GDPR, and other applicable data protection regulations. Paddle may transfer data internationally using appropriate safeguards such as Standard Contractual Clauses.

5.2 Other Service Providers

Third-party companies that help us operate our Service, acting as data processors on our behalf:

• Cloud hosting providers (infrastructure and data storage)
• Email service providers (transactional and notification emails)
• Analytics services (usage analysis and improvement)
• Customer support tools

These providers are contractually obligated to protect your data and may only process it according to our instructions.

5.3 Legal Requirements

We may disclose your data if required by law, legal process, or government request, or to protect our rights, privacy, safety, or property.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you of any such change.

5.5 With Your Consent

We may share your data with third parties when you explicitly consent to such sharing.

5.6 AI Platform Integrations (ChatGPT)

When you use our ChatGPT integration, the following data may be transmitted to OpenAI:

• Your natural language queries and commands
• Board names, list names, card titles, and descriptions
• Card comments, checklist items, and other board content as needed to fulfill your requests
• User display names (for assignees and comment authors)
• User identifiers (for assigning or unassigning team members to cards)
• Workspace and board membership information, including roles
• Card metadata such as priority levels, due dates, blocked status, and completion status
• Checklist items and their completion status
• File attachment names and download links
• Authentication tokens during the OAuth authorization flow

How this data is processed: OpenAI processes your queries to generate natural language responses and determine which actions to take on your behalf. Akievo's API then executes the authorized actions on your boards.

OpenAI as independent controller: For data processed through ChatGPT, OpenAI acts as an independent data controller and processes your data according to their own Privacy Policy. We encourage you to review OpenAI's privacy practices before using the integration.

Your control: You may choose not to use the ChatGPT integration. If you have connected your account, you can revoke access at any time through your Akievo account settings (API Keys section) or through ChatGPT's connected apps settings. You may also delete your conversation history directly within ChatGPT.

6. International Data Transfers

Your data may be processed in countries outside the UK and European Economic Area (EEA), including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement (IDTA) where applicable
• Adequacy decisions where the destination country provides adequate protection
• Binding Corporate Rules for intra-group transfers

Paddle's international transfers: As an independent data controller for payment data, Paddle maintains its own international data transfer mechanisms. Please refer to Paddle's Privacy Policy for details on how they handle cross-border data transfers.

You may request a copy of the safeguards we use by contacting us at support@akievo.com.

7. Data Retention

We retain your data for as long as necessary to provide our Service and fulfill the purposes described in this policy:

• Account data: Retained until you delete your account, plus a reasonable period for legal compliance
• Content data: Retained until you delete the content or your account
• Usage data: Typically retained for 24 months
• Backup data: Retained for up to 30 days after deletion
• Legal records: Retained as required by applicable law (e.g., 7 years for tax records)

Payment data retention: Paddle retains payment and transaction data in accordance with their own retention policies and legal obligations. Please refer to Paddle's Privacy Policy for details.

8. Your Rights (GDPR)

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at support@akievo.com. We will respond within one month of receiving your request.

Rights regarding payment data: For requests relating to payment information held by Paddle, please contact Paddle directly through paddle.net as they are the data controller for that information.

9. US State Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of what personal information we collect, use, and disclose
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell your data)
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

Categories of Personal Information

Under CCPA, we collect the following categories of personal information:

• Identifiers: Name, email address, account credentials
• Commercial information: Subscription and transaction history
• Internet activity: Browsing history, interactions with the Service
• Geolocation data: Country/region (derived from IP address)
• Professional information: Workplace information if provided

Other US States

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with privacy laws may have similar rights. Please contact us at support@akievo.com to exercise your rights.

10. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance your experience. When you first visit our site, you will see a consent banner that allows you to accept or reject non-essential cookies.

Types of Cookies We Use

Third-Party Cookies

When you make a purchase, Paddle may set cookies for payment processing, fraud prevention, and analytics purposes. These are considered essential for completing transactions. Please refer to Paddle's Privacy Policy for details on their cookie usage.

Managing Your Cookie Preferences

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of any page. Your choice is remembered for 12 months. You can also control cookies through your browser settings, though disabling certain cookies may affect the functionality of our Service.

Withdrawing Consent

You have the right to withdraw your consent at any time. To do so, click "Cookie Settings" in the footer and update your preferences, or clear your browser's cookies and revisit the site to see the consent banner again.

11. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we learn we have collected personal data from a child under 16, we will delete that information promptly.

For US users, we comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect information from children under 13.

12. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure password hashing
• Access controls and authentication
• Regular security assessments and monitoring
• Employee training on data protection
• Incident response procedures

Payment security: Paddle maintains PCI-DSS compliance and implements industry-standard security measures to protect payment data. We never have access to your full payment card details.

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy on this page with an updated date
• Sending an email notification for material changes
• Displaying a notice within the Service

We encourage you to review this policy periodically. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

We aim to respond to all requests within one month.