Privacy policy

Last updated: 11 October 2026

OVERBRING Labs ("we") operates kanpo, an online deal workspace for small and medium businesses. This policy explains what personal data we process when you use kanpo — including when you open a document as a counterparty (supplier or customer) without an account.

Who is responsible

OVERBRING Labs, contact: info@overbring.com.

For the business data inside a workspace (documents, contacts, notes, files), the company that owns the workspace is the controller and we process the data on its instructions, as its processor. For data needed to run the service itself — accounts, security logs, billing — we are the controller.

What data we process

• Account data: name, work email, password hash (never the password itself), language and theme preferences, last sign-in times.
• Workspace data: company name, legal name, VAT number and address, and the members you invite.
• Deal content: the RFQs, quotes, offers, purchase orders, pro formas, notes, clarifications and file attachments that you or your counterparties create in or share into a workspace.
• Counterparty data: names, emails and phone numbers of the people you add to your contacts or invite to quote — normally collected by the workspace owner in the course of their business relationship with them.
• Usage and security data: originating-send counts, activity timelines, and standard server logs (IP address, user agent) used to keep the service working and to prevent abuse.
• Push notifications: if you enable web push, your browser gives us an endpoint token for delivering notifications. This is opt-in and can be turned off at any time in your notification settings.
• Plan consultations: the plan chooser on our marketing pages records the answers you give and the verdict shown, as product research. It asks about your firm's shape — desk size, volumes, growth — not its identity: no account, name or e-mail is collected to see an answer. An e-mail address enters a consultation record only if you open the inquiry door yourself and type one, and it is then used for exactly that one link.
• Account hints on your device: when you sign in, your browser stores a signed cookie listing the accounts you last used on it, so a later visit takes you straight to the sign-in screen. We never see this list, it does not keep you signed in, and you can clear it from the sign-in screen ("Forget these accounts on this browser").

We do not use advertising trackers, and we do not sell personal data.

Legal bases

• Contract: providing the workspace and the features you subscribe to, including sharing documents with your counterparties.
• Legitimate interest: service security, spam and abuse prevention, troubleshooting, and aggregate product improvement.
• Consent: web push notifications and non-essential preferences; you can withdraw it at any time without affecting prior processing.
• Legal obligation: issuing and keeping invoices under tax law.

Counterparties and shared links

Suppliers and customers can view and answer documents through unguessable links, without registering. The workspace that invited them stores the minimal data needed to run the deal (who was invited, their answers and documents). If you received such a link and have questions about your data, contact the company that sent it — or us, and we will route the request.

Where data is stored

kanpo runs on servers we operate, and files are kept in object storage, within the European Union. Data is transferred outside the EU only if required by law applicable to us, with appropriate safeguards.

Who else sees data

• OVERBRING staff, limited to what support, billing and operations require.
• Our invoicing and accounting providers, for the invoices we issue to you.
• Subprocessors for hosting and email delivery, bound by data protection agreements.

Retention

Workspace content is kept while the workspace exists. After a workspace is closed, its content is deleted after a short grace period for accidental closures; billing and accounting records are kept for the periods tax law requires (five years in Greece). Security logs are kept only as long as needed for the purpose they were collected for. Plan consultations are research data and are deleted on a rolling window of 400 days, whatever becomes of the visit.

Security

Transport is encrypted (HTTPS), passwords are hashed with bcrypt, every query is scoped to a single organization, and operator access follows least privilege. No system is perfectly secure; if a breach affects your data, we will notify you and the supervisory authority as the law requires.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction of processing, data portability, and can object to processing based on legitimate interest. Contact info@overbring.com and we will handle the request; workspace owners can also do most of this directly from kanpo. You may also lodge a complaint with the Greek Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) or your local supervisory authority.

Children and scope

kanpo is business software and is not directed at children under 16.

Changes

Material changes to this policy are announced in the workspace or by email. The date at the top always reflects the current version.