Privacy Policy

We collect the following information:

• Account: your name, email address, password (stored only as a hash), two-factor authentication settings, language, and a record of which versions of our Terms of Service and this policy you accepted, when and how.
• Google sign-in, if you use it: from Google we receive your name, your email address and whether Google has verified it, a link to your profile picture and your Google account ID, along with the sign-in tokens Google issues. We use them to create your account, fill in your profile and sign you in. We do not receive your Google password or access other Google data, such as your contacts or files.
• Organization: business name, legal name, tax ID, contact details, address, logo, payment instructions, settings, team members and their roles.
• Content you enter: your customers' names, contact details, tax IDs, addresses and notes; products; terms; quotes, invoices and the payments you record.
• Shared documents: when someone unlocks a document you shared, the time and a one-way hash of their IP address; when they accept or decline a quote, the name they type, their IP address and the time.
• Usage and device: the IP address and browser type of your sign-in sessions; activity records (for example approvals, sends and the delivery status of emails you send); and short-lived security counters, some of which contain an IP address.
• AI: the text you send to AI Refine. We do not store it; our provider processes it (see section 10).
• Support: what you write to us and your email address.
• Payments, once paid plans are available: handled by our payment provider; we never see or store full card numbers. We keep the plan, its status and its dates.

We use this information to provide and secure Kabkan, verify accounts, prevent abuse, send the emails you ask for and service emails, provide support, bill paid plans once they are available, meet legal duties and improve Kabkan.

We do not sell personal information. We do not share it for targeted advertising. We do not use analytics or advertising trackers.

Your organization's data is visible to its members, according to their roles, and to the people you send documents to. Our database keeps each organization's data separate with row-level security.

Our admin tools show account and organization details (such as member emails, plan and usage counts), not your customers, quotes or invoices. A small number of our staff can access stored data through our providers' systems; they do so only to run, secure, back up or support Kabkan, to investigate abuse, or when the law requires it. Our providers process data for us as listed in section 4.

We use a few cookies and browser storage, only to run Kabkan:

• Sign-in session (better-auth.session_token; on our secure site __Secure-better-auth.session_token): keeps you signed in for 7 days, renewed while you use Kabkan.
• Sign-in steps: short-lived cookies set by our sign-in system only while you sign in with Google or with two-factor authentication.
• Shared document (doc_unlock): keeps one shared document open for 24 hours after its access code is entered.
• Preferences: language (NEXT_LOCALE cookie, 1 year), light or dark theme (theme cookie, 1 year, and browser storage) and sidebar state (quotient_sidebar_collapsed cookie, 1 year, and browser storage).
• Browser storage in the app: the table or board view of quotes and invoices (quotient_quotes_view_mode, quotient_invoices_view_mode) and the period you pick for each dashboard chart (dashboard.charts keys), kept until you clear them; and, during sign-up, the email address waiting for its code (pending-email-verification), kept until you close the tab.

Our sign-up and email verification pages use Cloudflare Turnstile to block bots. Cloudflare processes information about your browser and device, including your IP address, for that purpose.

We do not use advertising or analytics cookies, and we do not track whether you open or click our emails. Because we do not track you across sites, Kabkan does not change how it works when your browser sends a Do Not Track or Global Privacy Control signal; if we ever add such tracking, we will honor Global Privacy Control.

We use these providers to run Kabkan:

• Vercel: hosting, server logs and file storage (logos, payment QR images and profile pictures).
• Neon: our database and its backups.
• Resend: sending email.
• Upstash: security and rate-limiting counters.
• Cloudflare: Turnstile bot protection on sign-up, and forwarding of email sent to our support, legal and privacy addresses.
• Google: AI Refine (Gemini), Google sign-in, and the mailbox where we receive email sent to our support, legal and privacy addresses.
• Have I Been Pwned: checks whether a new password has appeared in a data breach. We send only the first five characters of a hash of the password, never the password itself.
• Stripe and a Stripe affiliate: payments, once paid plans are available.

Vercel, Neon, Resend and Upstash process data in the United States. Our providers may also process data in other countries where they operate. We may change providers, and we will update this list.

We share information with others only when you ask us to (for example when you send a document), to comply with the law or protect rights and safety, or as part of a merger or sale of our business.

We keep your data while your account and organization exist.

An Owner can delete an organization after a waiting period of 14 days, or immediately. After the waiting period, the deletion runs in a daily job, usually within a day; it can take a few days. You can delete your account at any time, and it is deleted right away. Details are in our Terms of Service.

Some data is kept for a limited time, including after deletion:

• database backups and history: up to 7 days after deletion;
• logs of the emails we send, kept by our email provider (Resend): up to 30 days;
• hosting logs (Vercel): up to 30 days;
• security counters: they expire within 2 hours;
• support emails: up to 2 years after the last message;
• payment records: kept by the payment provider for as long as it is required to keep them.

We keep a minimal record that a deletion happened, and a few records needed for accountability and billing. They hold ids, dates and actions, not your content or your customers' details.

When you delete your account, the records you created in an organization stay with it, and where you are recorded as the author they show "Deleted user". Text that people typed (for example a note that mentions your name) is not changed. Emails already delivered to other people are not affected.

Approved quotes and invoices keep a fixed copy of the customer details they were issued with. We do not delete a single customer record of a business on request: if you are a customer of a business that uses Kabkan, ask that business, which decides how to change or remove your information (see section 6). Your information is also deleted when the business deletes its organization.

Businesses using Kabkan decide what information they enter about their customers and what they send them. For that information we act as a service provider (processor) for the business.

If you are a customer of a business that uses Kabkan, contact that business to access, correct or delete your information. If you contact us at privacy@kabkan.com instead, we will forward your request to the business within 10 business days when we can identify it, and we will help the business respond.

We use reasonable safeguards, including HTTPS, password hashing, optional two-factor authentication, rate limits, separate data per organization, hashed share links and encrypted access codes. We also rely on the security measures of the providers listed in section 4.

No system is completely secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

You can update your profile in Settings. Owners and Admins can export the organization's data as a JSON file. You can delete your account, and Owners can delete the organization, in Settings.

You can also ask us to access, correct, export or delete your personal information by writing to privacy@kabkan.com. We will confirm your request and answer within 45 days. We may need to verify your identity first.

Depending on where you live, you may have more rights under local law; we will honor them where they apply. You will not be treated differently for using these rights.

Kabkan is for businesses and for people 18 and older. We do not knowingly collect information from children. If you believe a child gave us information, write to privacy@kabkan.com and we will delete it.

When you use AI Refine, the text you choose is sent to Google's Gemini service to create a suggestion. Google processes it under its paid API terms: it does not use the text to train its models, and it may keep it briefly to detect abuse and meet legal duties.

We do not store the text or the suggestion; we record only that a credit was used. Do not include personal or confidential information.

We send service emails (such as verification codes, password resets, invitations, and plan and deletion notices) that you cannot opt out of while you have an account. We do not send marketing emails today; if we ever do, you will be able to unsubscribe at any time.

We do not track whether you open our emails or click their links. Emails that a business sends you through Kabkan come from that business.

We do not make decisions with legal or similarly significant effects about people by automated means.

Kabkan is not designed for sensitive information (such as health information, financial account numbers or government ID numbers other than business tax IDs); do not enter it.

We will post changes here with a new date. For material changes, we will email account holders or show a notice in the app before they take effect.

This policy is written in English. Translations are provided for convenience; if a translation differs from the English version, the English version controls.