Data protection and compliance

Controller

For your account data: name, email, hashed password, avatar and product usage. We decide why and how it is processed.

Processor

For the content your team uploads: tasks, projects, files, comments and AI conversations. We process it on your instructions; your organisation remains the controller.

• Database (accounts, tasks, projects): Google Cloud, in the United States.
• Files and avatars: Cloudflare object storage.
• Web app and API: Cloudflare's global network.
• Backups: managed by the database provider, in the same region.

This means an international transfer of data outside the EEA. It relies on the European Commission's Standard Contractual Clauses, incorporated into the data processing agreements with each provider, and on our providers' certification under the EU-US Data Privacy Framework.

• The certifications above belong to our infrastructure providers. Certified infrastructure does not automatically certify whoever runs on it — it does mean the data centre, network and storage layers are independently audited.
• We're a small team and we're advancing in phases, prioritising the controls that genuinely protect customer data over the paperwork.
• If your procurement process requires ISO 27001 or SOC 2, write to us: we'll tell you exactly where we stand and keep you posted on progress.

• Access: obtain a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your account and personal data.
• Restriction: ask us to restrict processing while a complaint is resolved.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest, including analytics.
• Withdraw consent: at any time, without affecting processing carried out before.

To exercise them, email [email protected] from your account address. We respond within 30 days at most, as Article 12(3) GDPR requires.

If you believe we handle your data improperly, you can lodge a complaint with your national supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).

• Know, update and rectify your personal data, and access it free of charge.
• Request proof of the authorisation granted for processing.
• Be informed about how your data has been used.
• Revoke the authorisation and request deletion when processing does not respect the law's principles and guarantees.
• File complaints with the supervisory authority for violations of the data protection regime.

To exercise them, email [email protected] from your account address. We answer queries within 10 business days and complaints within 15, the deadlines set by articles 14 and 15 of Law 1581.

The supervisory authority is the Superintendencia de Industria y Comercio — SIC (sic.gov.co), where you can file complaints once the direct claim with us has been exhausted. International data transfers (article 26) are disclosed in the Privacy Policy and rest on the authorisation you grant by accepting it and on the data processing agreements with each provider.