Privacy Policy
Effective 14 September 2026 — Version 1.1
This policy explains what KODAVARA LLC ("Kodavara", "we", "us"), a Nevada limited liability company, collects when you use Kodavara DataFlow at dataflow.kodavara.io, why we collect it, and what you can do about it.
Contact us about anything in this policy at info@kodavara.com.
1. The Short Version
- We collect what we need to run the Service: your account details, your connection credentials, and the work-management data you point us at.
- We do not sell your personal information, and we never have.
- We do not use your data to train machine learning models.
- We do not run advertising or analytics trackers. The only cookie we set is the one that keeps you signed in.
- Export files are deleted automatically when your plan's retention period ends.
2. Information You Give Us
Account information. First and last name, email address, and optionally a phone number and company name. Country, state or region, and timezone — the timezone matters because your schedules run in it.
Payment information. Payments are handled by Stripe. Card numbers and bank details go directly to Stripe; we never see or store them. We keep the Stripe customer and subscription identifiers, your plan, and its status.
Connection credentials. When you connect ClickUp, we store either the OAuth access token ClickUp issues or the personal API token you paste. These are encrypted before storage with per-connection keys. We deliberately keep the last four characters of a personal token readable so you can tell your connections apart in the interface.
What you send us. Support emails and anything you choose to include in them.
3. Information From Your Connected Workspace
When you connect a workspace and choose a scope, the Service reads and stores the records inside that scope so exports can run against them without hitting ClickUp's API on every run. Depending on your scope and configuration, that includes:
- tasks and their fields — names, descriptions, statuses, priorities, dates, tags, and custom fields;
- time entries — durations, dates, notes and billable flags;
- workspace members involved in that work — names, email addresses, and identifiers;
- the structure around it: spaces, folders and lists.
That data very often includes other people's personal information — your colleagues, your contractors, your clients. For it, you are the controller and Kodavara is a processor: we handle it on your documented instructions, which are the export configurations you build. You are responsible for having the right to extract it.
We access this data to run your exports, to show you previews, and to investigate a problem you report. Nothing else.
4. Information We Collect Automatically
Session and security data. IP address, browser user-agent, and session timestamps, kept so you can see and revoke your own sessions and so we can investigate suspicious sign-ins.
Audit and usage records. Actions taken in your account — who changed a DataFlow, who ran it, who downloaded a file, who changed a plan — plus counts of runs, records processed and bytes stored. These drive your usage meters, our billing, and any security investigation.
Application logs. Ordinary operational logs of requests and errors.
5. Why We Use It, And Our Legal Basis
| What we use it for | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the Service you signed up for | Performance of a contract |
| Billing and collecting payment | Performance of a contract |
| Service emails — verification, password resets, run failures, usage warnings | Performance of a contract |
| Security, fraud prevention, abuse investigation, audit records | Legitimate interests |
| Improving reliability and fixing defects | Legitimate interests |
| Marketing emails about the product | Consent — the opt-in at signup, withdrawable any time |
| Meeting legal, tax and accounting obligations | Legal obligation |
6. Who We Share It With
We share personal information only with service providers who help us operate, each bound to protect it and to use it only for what we have asked:
- Stripe — payment processing and subscription billing.
- Resend — delivery of transactional email such as verification and alerts.
- ClickUp — the source you connect; data flows from them to us at your instruction.
- Our cloud infrastructure provider — hosting the application, database and file storage. We will name the current provider on request at info@kodavara.com.
We also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a merger or sale of the business — in which case the acquirer is bound by this policy until it gives notice of a change.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. Under Nevada law (NRS 603A), Nevada residents may submit a verified request not to sell covered information; we do not sell it, but you may still send that request to info@kodavara.com.
7. Cookies
We set one essential cookie, which holds your sign-in session. It is HTTP-only, and marked Secure in production. Without it you cannot stay signed in.
We do not use advertising cookies, third-party analytics, tracking pixels or session recording. There is no consent banner because there is nothing to consent to.
8. How Long We Keep Things
| Data | Retention |
|---|---|
| Export files | Your plan's retention window, shown against each file in the application, then permanently deleted from storage |
| Records synced from your workspace | Until you delete the connection, remove the scope, or close your account |
| Account and connection details | While your account is open |
| After you confirm account deletion | Account data, connections and files are deleted; backups age out within 35 days |
| Billing records | 7 years, as tax and accounting law requires |
| Audit and security logs | Up to 24 months |
9. How We Protect It
- Encryption in transit — HTTPS everywhere.
- Encrypted credentials — connection credentials are sealed with per-connection keys that are themselves wrapped by a master key held outside the database, so database access alone does not reveal them.
- Database-level isolation — every tenant's rows are separated by row-level security in PostgreSQL, not by application filtering that a bug could skip.
- Least-privilege access — the application connects with a restricted role; administrative access is limited to named superadmin accounts on an approved email list, can be further restricted to approved IP addresses, requires a stated reason, and is written to an audit log. If our staff ever access an account for support, that too is recorded.
- Rate limiting and lockouts on sign-in and other sensitive endpoints.
No system is perfectly secure. If a breach affects your personal information, we will notify affected account owners and the relevant authorities as the law requires.
10. Your Rights
Whatever jurisdiction you are in, you can:
- See and correct your account information in Account Settings.
- Export your data — request a copy from Account Settings.
- Delete your account — request deletion from Account Settings. We confirm by email before anything is removed.
- Withdraw marketing consent — from Account Settings or the unsubscribe link.
If you are in the UK or EEA, you additionally have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority. Ask us at info@kodavara.com and we will answer within 30 days.
If you are in California, you have the rights to know, delete, correct and opt out of sale or sharing under the CCPA as amended by the CPRA. We do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising these rights.
If the data is your workspace's data and you are an employee or client of one of our customers rather than the account holder, contact that customer — they control it. We will help them respond.
11. International Transfers
The Service is operated from the United States. If you use it from elsewhere, your information is transferred to and processed in the United States, which may not offer the same protections as your home country. Where required for transfers from the UK or EEA, we rely on the European Commission's Standard Contractual Clauses, and we will provide the relevant terms on request.
12. Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to info@kodavara.com and we will delete it.
13. Changes To This Policy
We may update this policy. Each version carries a number and an effective date, and the version you accepted is recorded against your account. For material changes we email account owners at least 30 days before they take effect.
14. Contact
KODAVARA LLC
Nevada, United States
info@kodavara.com
For privacy questions, put "Privacy" in the subject line and we will route it accordingly.
Version 1.1 · effective 9/14/2026