Privacy Policy and Terms of Use

This Policy explains how personal data is handled when you visit, create an account, use a tenant portal, submit or manage work orders, communicate through the Service, or connect an external service. An organization using Komma generally determines why and how its customer and work-order data is used; Komma processes that data to provide the Service on the organization’s behalf. Komma is responsible for data used for platform accounts, security, operation, support, and optional integrations where Komma determines the processing purpose.

Depending on how you use the Service, information may include:

• identity and contact details, including name, national ID, email address, and phone number;
• account, organization membership, role, permission, verification, and authentication information;
• work orders, descriptions, locations, messages, files, images, offers, approvals, schedules, expenses, and related records;
• calendar event titles, descriptions, times, status, attendees where provided, and synchronization identifiers;
• technical and security information such as timestamps, browser information, necessary cookies, IP addresses in operational logs, and error data.

We receive information from you, authorized users in your organization, customers submitting requests, normal use of the Service, and integrations you choose to connect. We use it to authenticate users, enforce access controls, operate tenant portals, process work orders and offers, provide scheduling and communications, synchronize calendars, send service notifications, support users, diagnose failures, protect the Service, comply with law, and establish or defend legal claims.

Where the GDPR or comparable law applies, processing may rely on performance of a contract or steps requested before entering one, compliance with legal obligations, legitimate interests in operating and securing the Service, and consent where specifically requested. You may withdraw consent at any time, without affecting processing already carried out lawfully.

Google Sign-In provides verified basic account information such as your name, email address, and Google account identifier for authentication. Google Calendar access is separate and optional. When you connect it, the Service may read calendar events needed to show your schedule and may create, update, or delete events to keep work orders and portal calendar entries synchronized with your connected calendar.

We may store your Google email address, encrypted refresh token, granted scopes, calendar and event identifiers, synchronization tokens, and a limited event-data mirror needed for synchronization. Imported private events remain associated with the connected user and are not exposed to other tenant administrators. Shared portal events remain visible only to users with appropriate tenant access.

Google user data is used only to provide visible authentication and calendar features. It is not sold, used for advertising, used to determine creditworthiness or lending eligibility, or used to train general-purpose artificial-intelligence models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We do not sell personal data. We may use providers for hosting, databases, storage, authentication, email delivery, monitoring, and other infrastructure necessary to operate the Service. Access is limited to what those providers need and is subject to appropriate confidentiality and data-protection terms. Information may also be disclosed when you request it, to provide the Service, investigate security, complete a corporate transaction with appropriate safeguards, or comply with law. Where data is transferred outside the EEA, we use an appropriate legal transfer mechanism where required.

We retain account, tenant, work-order, and transaction data while needed to provide the Service, meet contractual or legal obligations, maintain auditability, resolve disputes, and protect legal rights. Security and diagnostic logs are kept for a limited operational period. When Google Calendar is disconnected, the active connection token and private imported-event mirror are removed from the active system. Events already written to Google Calendar may remain there until you delete them or a specific synchronization action removes them. Backup copies expire through normal backup rotation.

We use reasonable technical and organizational safeguards, including tenant separation, role-based access controls, encrypted network connections, protected session cookies, one-way password hashing, and encryption of sensitive integration tokens. No system is completely risk-free, and users should promptly report suspected unauthorized access.

The Service uses cookies and local browser storage that are necessary for secure authentication, OAuth state protection, selected interface settings, and core functionality. These technologies are not used for behavioral advertising.

Depending on applicable law, you may have rights to access, correct, delete, restrict, or transfer your personal data, and to object to certain processing. You can disconnect Google Calendar in the calendar settings and can also revoke access from your Google Account. Requests can be sent to hello@kommakomma.is. We may need to verify your identity and may refer tenant-controlled requests to the relevant organization.

The Service is intended for authorized business users and customers able to use it lawfully. Guardians are responsible where a minor’s use is permitted. You may contact us first with a concern and may also complain to the Icelandic Data Protection Authority or another competent supervisory authority. We may update this Policy for legal, security, operational, or feature changes; the current version and date will remain available here.

By accessing or using the Service, you agree to these Terms. If you use it for an organization, you confirm that you are authorized to do so. Do not use the Service if you do not agree. Mandatory consumer and statutory rights are not waived by these Terms.

You must provide accurate account information, protect your login methods, use only the access granted to you, and notify us promptly of suspected misuse. Access is determined by tenant membership, customer access, roles, and permissions. You may not impersonate another person or share access in a way that defeats those controls.

Komma supplies the software platform. Each tenant organization is responsible for the services it offers, its customer relationships, staff actions, work descriptions, quotations, pricing, schedules, invoices, and legal obligations. Unless expressly agreed otherwise, Komma is not a party to a contract between a tenant and its customer and does not guarantee that work will be accepted, performed, or paid for.

You are responsible for the legality, accuracy, and permissions associated with content you submit, including personal information about others. You retain ownership of your content and grant Komma a limited right to host, copy, process, and display it only as needed to operate, secure, and provide the Service to authorized users.

Offers, prices, estimates, and schedules are based on information supplied by tenants and users. Their binding effect depends on their wording, the parties’ agreement, and applicable law. A calendar entry alone is not a guarantee of attendance, delivery, or performance. Users should verify important dates, amounts, and records with the relevant organization.

Third-party integrations are optional and are also governed by the provider’s terms. You must have authority to connect an account. Synchronization can be delayed, duplicated, or temporarily fail because of network conditions, expired authorization, provider changes, or outages. Verify important calendar entries in the relevant system. Komma is not responsible for an independent provider’s availability or decisions, although we remain responsible for addressing failures in our own Service as required by law.

You may not use the Service unlawfully or fraudulently; violate privacy, confidentiality, intellectual property, or other rights; bypass access controls; access another tenant’s data; upload malicious code; disrupt or overload the Service; perform unauthorized security testing; resell or copy the Service to create a competing product; or submit content you have no right to process or share.

The Service’s software, design, branding, documentation, and platform content are protected by intellectual-property law. Subject to these Terms, you receive a limited, revocable, non-transferable right to use the Service. No ownership rights transfer unless agreed in writing.

We work to provide a secure and reliable Service but do not promise uninterrupted or error-free operation. We may perform maintenance, deploy security updates, change functionality, or temporarily restrict parts of the Service. Where practical, we will provide reasonable notice of material planned interruptions.

The Service is provided on an “as available” basis to the extent permitted by law. Users remain responsible for their decisions, lawful records, appropriate backups, and verification of important information. To the extent permitted by mandatory Icelandic law, Komma is not liable for indirect or consequential loss, loss caused by inaccurate user data, unauthorized account use, preventable data loss, network failure, or independent third-party services. Nothing excludes liability that cannot legally be excluded, including liability arising from intent, gross negligence, fraud, or personal injury.

Access may be restricted or terminated for security risk, suspected abuse, material breach, legal requirements, non-payment where applicable, or the end of a tenant or user relationship. Where circumstances permit, an opportunity to explain or correct the issue will be provided. Some information may be retained after termination where required for law, settlement, security, or legal claims.

We may update these Terms for legal, security, operational, or feature changes. Material changes will be communicated when required. Icelandic law governs these Terms, subject to mandatory consumer rights. The parties should first try to resolve disputes informally; otherwise, Icelandic courts have jurisdiction under ordinary venue rules. Questions and notices may be sent to hello@kommakomma.is.