Privacy

This notice explains how producteev.de handles personal data. The controller is TS IT UG (haftungsbeschränkt). Write to admin@producteev.de. Security reports go to security@producteev.de. Support goes to hey@producteev.de. The postal address is on the imprint.

What is processed

• Account data: name, email address, a password hash if you set a password, and the Microsoft tenant and object ids if you sign in with Microsoft.
• Content you put on boards: card text, comments, attachments, and the names of people you invite.
• Security data: passkeys, two-factor secrets, session cookies, and sign-in logs.
• If you connect Google Drive, a token that lets the app write backup files into a folder it creates. The app does not read the rest of your Drive.
• If you use the mobile app, a push token for the device.
• Server logs: IP address, time, and the address requested.

Why

The account, the boards and the emails about invitations and due dates are processed to perform the contract with you (Art. 6 (1) (b) GDPR). Logs, abuse prevention and encrypted backups are processed for the legitimate interest of keeping the service running and recoverable (Art. 6 (1) (f) GDPR). This website has its own Google Analytics property, separate from the app. The tag loads only after you accept, on the basis of consent (Art. 6 (1) (a) GDPR). Until you choose, the tag is not loaded and nothing is sent. You can object to processing based on legitimate interest by writing to admin@producteev.de.

Who receives it

• The people you invite, to the extent of the permission you give them.
• Microsoft, for sign-in (Entra ID) and for sending mail (Microsoft Graph).
• Google, only if you connect Google Drive.
• Cloudflare, which serves this website.
• Google Analytics for this website only, and only after you accept. The property belongs to this site, not to the app.
• The host of the application, in Germany. Board data and the application run without cloud services outside Germany, except for payment processing, analytics and push notifications.
• Bunny Fonts, which serves the typeface to the app.
• A push provider, when the mobile apps send notifications.

The operator does not sell personal data.

How long

Account data and board content stay until you delete them or delete the account. Server logs are kept only as long as needed to operate and secure the service. Encrypted backups stay until the board owner deletes them. Push tokens are removed when the device is signed out.

Your rights

You can ask for access, correction, deletion, restriction, and a copy of the data the operator holds about you, and you can object to processing based on legitimate interest. You can lodge a complaint with a supervisory authority. That can be the authority of the state where you live, or the authority responsible for the operator: the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Wiesbaden.

Cookies

This website does not load Google Tag Manager, and Google Analytics sets no cookie until you accept. If you decline, the tag stays unloaded. The app sets a session cookie so you stay signed in, and a security cookie that protects forms against cross-site requests. Both are required for the app to work.

Security

Board backups are encrypted with the installation key and cannot be opened outside this installation. Passwords are stored as hashes. Microsoft accounts are matched by tenant id and object id, not by email alone.