Privacy notice
Last updated 7 November 2026
Kamiboard is a service for running daily SQCDP boards, KPIs, actions and layered audits in manufacturing plants. This notice explains what personal data the service handles, why, where it is kept and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who is responsible for your data
The service is run by Paul McWilliam trading as Kamiboard.
- Your employer is the controller for what it and its people put into Kamiboard: board entries, actions, comments, audit results, photos and documents, and the user accounts it creates. We process that data for them as their processor, under our contract with them.
- We are the controller for running the service itself: keeping it secure, preventing abuse, and contacting the people who manage a customer account.
Contact: paulmc18@proton.me.
What we collect
- Account details: your name, work email address, the plants and areas you can see and your role. There is no public sign-up; your organisation invites you.
- Your password, stored only as a salted scrypt hash. We can't read it.
- Work you record: KPI values, comments, actions, audit answers, photos, documents and plans, with who entered them and when.
- Security records: while you are signed in we keep the IP address and browser type of your session; we count sign-in attempts per IP address to stop password guessing; and an audit log records who changed what.
We don't use advertising or analytics trackers, and we don't sell or share data for marketing.
Why we use it, and our lawful basis
- To provide the service your organisation has contracted for: its contract with us, and its own lawful basis as controller.
- To keep the service secure, prevent misuse and fix faults: our legitimate interest in running a safe, reliable service.
- To send service email (invitations, overdue action and missed audit notices): part of the service your organisation has switched on.
Where it is stored, and who helps us
Data is stored in the United Kingdom. We use these providers:
| Provider | What for | Location |
|---|---|---|
| Vercel | Application hosting; file storage for photos and documents | London; requests may pass through its global network |
| Neon | Database and its backups | London (AWS eu-west-2) |
| Resend | Sending service email | EU (Ireland) |
| Inngest | Triggering scheduled checks; it receives no personal data | United States |
These providers are US-based companies. Where one may access data from outside the UK, we rely on the safeguards in our contract with it, such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.
How long we keep it
- Sign-in sessions end after 12 hours and are deleted a day later, with their IP address. Invitation links expire after 7 days.
- Sign-in attempt counters are deleted after a day without attempts.
- Account data and work records are kept while your organisation is a customer, unless it deletes them sooner. When its contract ends we delete or return its data as the contract sets out.
- Database backups roll over and are kept for up to 7 days.
Cookies and storage on your device
Kamiboard sets one strictly necessary cookie, which keeps you signed in. It is HttpOnly and sent only over HTTPS. Display Mode keeps a copy of the boards it shows in the browser's local storage, so a wall screen stays readable through a brief network drop. Neither is used for tracking, so no cookie consent is needed.
Your rights
You can ask for a copy of your personal data, and ask for it to be corrected, deleted, restricted or moved, or object to how it is used. For work data held for your employer, please ask your employer first: they decide, and we help them. For anything else, contact us at paulmc18@proton.me. We reply within one month.
If you are unhappy with how your data is handled you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes
We will update this page if anything changes, and tell organisation admins about significant changes.