The short version: your business records are yours, we hold them so the product works, and we do not sell, share or mine them. This site sets no cookies and runs no trackers. Everything below is the long version.
Version 1.0 · Effective 1 September 2026 · Kardo Ltd, England & Wales
This is the privacy notice for Kardopal — the apps, the web dashboard, the API and the devices that run on it. It explains what personal data we handle, why, and what you can ask us to do about it.
The signage player has a separate, narrower notice because it is a different kind of thing: a screen on a wall that handles almost nothing about a person. You can read it at Privacy for KardoSign. Where the two disagree about the player, that notice wins.
Almost every question about privacy in a product like this comes down to one distinction, so it is worth stating plainly.
For your own account data — your name, your email, your billing — we are the controller. We decide what to collect and we answer to you for it.
For the business data you put into Kardopal — your customers, your employees, your suppliers — you are the controller and we are the processor. It is your data about other people. We hold and process it on your instructions and for no purpose of our own. If one of your customers asks you to delete their record, you can do that yourself; if they ask us, we will point them to you.
We try to hold as little as the product can work with. Here is the whole of it.
To perform our contract with you — running your account, providing the service, taking payment.
Our legitimate interests — keeping the service secure, investigating faults, preventing abuse. We only rely on this where it does not override your rights.
Legal obligation — keeping billing records for as long as tax law requires.
Consent — where we ask for it, such as optional marketing email. You can withdraw it at any time, and withdrawing it does not affect anything done before.
This marketing website sets no cookies and carries no analytics, no advertising pixels and no third-party trackers. We are not measuring you as you read this.
Two honest exceptions. Fonts are loaded from Google’s font service, which means your browser contacts Google and Google sees your IP address. And the page keeps one value in your browser’s session storage to detect a stale stylesheet — it holds a build number, nothing about you, and it is gone when you close the tab.
The product is different from the website: once you sign in, it stores your session so you stay signed in, and remembers preferences like your language and which location you last used. That is the app working, not us tracking you across the internet.
We do not sell personal data. We do not share it with other customers. We do not hand it to advertisers.
We use third parties to run parts of the service, and they only ever act on our instructions. As in our terms, we describe them by category rather than publishing a map of our systems: cloud hosting, transactional email, payment processing, AI model providers, real-time voice and video, and mobile push notifications.
The current named list is available to customers on request — write to support@kardopal.com and we will send it and tell you when it changes.
We will disclose data if the law genuinely requires it. If we are allowed to tell you that has happened, we will.
Your data is held in one region, and we tell you which one on request. If we ever need to move it, we will tell you before we do.
Where data moves outside the UK or the EEA — because a sub-processor operates elsewhere — we rely on the safeguards the law provides for that, such as standard contractual clauses.
While your account is active, we keep your data so the product works.
When you close your account we delete your business data within 30 days. Backups roll off on their own cycle and are gone within 90 days.
We keep billing records longer where tax law requires it. We keep nothing else “just in case”.
You can ask us to give you a copy of your personal data, correct it, delete it, restrict what we do with it, or hand it to someone else in a portable form. You can object to processing we base on legitimate interests. Where we rely on consent, you can withdraw it.
Ask at support@kardopal.com. We will respond within one month, and we will not charge you for it.
If the request is about data one of our customers holds about you — you bought something from a shop that runs on Kardopal, say — then that business is the controller and we will point you to them, because it is their record to change.
If you think we have got this wrong you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority. We would rather you told us first and gave us the chance to fix it.
Kardopal is a tool for running a business and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, tell us and we will delete it.
Encrypted in transit and at rest. Passwords stored hashed, never in a form we could read back. Access to production limited to the people who need it, and logged. Inside your account, every action is attributed to the person who took it.
If a breach affects your data we will tell you without undue delay — an incomplete answer quickly rather than a tidy one late — and, where the law requires it, we will tell the regulator within 72 hours.
If we change something material we will tell you in the app and by email to account owners before it takes effect, and we will move the version number at the top.
Privacy questions, or any of the requests above: support@kardopal.com.
Kardo Ltd, 2nd Floor College House, 17 King Edwards Road, Ruislip, London HA4 7AE, United Kingdom. Registered in England & Wales.