Privacy notice
Last updated: 30 October 2026
1. Who is responsible
KaizenaLabs, organisation number 915429777, Ekebergveien 255b, is the controller for the processing described in this notice. Contact us about privacy at support@kaizenalabs.com.
2. What this notice covers
This notice covers the personal data we process about people who visit Kaizena Flow's own website, ask for access, run stores on Kaizena Flow or work in them, and contact us.
It does not cover what stores do with their own customers' data. Each store is the controller for its customers and visitors and has its own privacy notice; we process that data on the store's behalf under our data processing agreement.
3. What we process, why, and on what basis
Requests for access: your name, email address, the store you want to open, what you tell us and the language you write in, to consider your request and reply. Basis: steps at your request before entering into a contract (GDPR Article 6(1)(b)).
Your account: name, email address, password (stored only as a protected hash by our sign-in provider), profile picture, two-step sign-in factors and recovery codes (stored as hashes), and your choices of language and appearance, to give you access to the admin. Basis: our contract with you or your employer (Article 6(1)(b) and (f)).
Security and the activity log: sign-ins and the changes made in each store, with who made them and when, to keep the service and stores secure and to let owners see what was done. Basis: legitimate interest in security (Article 6(1)(f)).
Billing: your business's details, your plan, invoices and payments, to charge for the service and keep accounts. Basis: our contract (Article 6(1)(b)) and our legal duty to keep accounts (Article 6(1)(c) and the Norwegian Bookkeeping Act).
Support and the AI manager: what you write to Kaizena Flow's support and to the AI manager, and what the AI manager remembers for you (which you can see, change and turn off), to help you. Basis: our contract (Article 6(1)(b)).
Emails we send: the emails we send you and whether they were delivered, to send what the service needs to tell you. Basis: our contract and legitimate interest (Article 6(1)(b) and (f)).
Our website: the cookies needed for the site to work. Cookies for statistics or marketing, and the referral programme's cookie, are set only if you agree, and your choice is kept for 12 months. Basis: consent (Article 6(1)(a)). See the cookies page.
The referral programme: who referred a store and the credit earned, to pay the referrer. Basis: our contract with the referrer (Article 6(1)(b)).
4. Who we share data with
We use these providers to run Kaizena Flow. They process personal data only on our instructions:
Vercel (hosting; our functions run in Dublin, Ireland)
Supabase (database, sign-in and file storage, in Ireland)
Resend (sending email)
OpenAI (AI features, when Kaizena Flow's own AI connection is used)
Stripe (invoicing and payment of our fees; Stripe is also the controller of the payment data it processes under its own terms)
We also share data where the law requires it, for example with tax authorities, and with a business that takes over all or part of ours, who must then follow this notice.
5. Transfers outside the EEA
Our database and functions are in the EU. Some of our providers are based in the United States or may reach data from there. Such transfers are made under the EU–US Data Privacy Framework where the provider is certified, or otherwise under the standard contractual clauses adopted by the European Commission (GDPR Articles 45 and 46).
6. How long we keep data
Requests for access: until the request is decided, and then as long as needed to answer questions about it.
Accounts: as long as the account exists. When you ask us to delete it, we do so unless the account is still needed for a store you are responsible for.
The activity log: 24 months.
Accounting records, such as invoices: five years after the end of the financial year (the Norwegian Bookkeeping Act, section 13).
Support conversations: as long as set for the support desk, and then anonymised.
Your cookie choices: 12 months.
7. Your rights
You have the right to:
access the personal data we hold about you (GDPR Article 15)
have incorrect data corrected (Article 16)
have data erased (Article 17)
have processing restricted (Article 18)
receive your data in a machine-readable form and have it sent to another controller (Article 20)
object to processing based on our legitimate interest (Article 21)
withdraw your consent at any time, without affecting what was done before (Article 7(3))
Write to support@kaizenalabs.com. You can change many of your details yourself under "Your account" in the admin. We answer within one month (Article 12(3)).
8. Complaints
If you think we process your data unlawfully, you may complain to a supervisory authority, in particular in the country where you live or work (Article 77). In Norway this is Datatilsynet, datatilsynet.no. We would be glad if you contacted us first.
9. Do you have to give us data?
You need to give us your name and email address to get an account, and your business's details to buy a plan. Everything else is up to you.
10. Automated decisions
We make no decisions based solely on automated processing that have legal or similarly significant effects for you (Article 22). The AI features suggest; a person decides.
11. Security
Data is encrypted on its way to and from Kaizena Flow. Passwords, recovery codes and access tokens are stored only as hashes, and secrets such as integration keys are encrypted. Staff sign in with two-step sign-in where the admin asks for it, and every store's data is kept apart from other stores'.
12. Changes
We update this notice when what we do changes. The date at the top shows when it was last changed. We tell account holders about material changes by email or in the admin.