Privacy and data retention
Version 2026-09-13
Draft — the provider details and retention information below must be completed before publication.
Who handles your data
The provider identified below handles account administration, service security and its own commercial records. Your organization determines the purposes of personal data entered for its work; the provider processes that content on its instructions, under the applicable data processing agreement. Contact your organization about its use of workplace data or the provider about its own processing.
What we collect and why
We process your name, email address, language, account credentials, memberships and assignments. These may come from you, an administrator or the organization inviting you. We also store submitted content and files, comments, status history, notifications, subscription records, session data and administrative logs to operate accounts, collaborate, provide support and protect the service.
Legal grounds
Depending on the purpose and relationship, processing relies on performance of a contract with the individual, applicable legal obligations, or documented legitimate interests in service administration and security, balanced against individual rights. The organization is responsible for the legal grounds for its own processing. Any optional processing requiring consent must be explained separately and consent must be withdrawable.
Storage and access
Account and work records are held in the application database; uploaded files are stored in file storage. Access depends on organization membership and assigned roles. Authorized support administrators may access data when needed for support or administration; impersonation is logged. Hosting and email suppliers process data to provide their services. Supplier, location, transfer and backup details are listed below.
Retention and deletion
Administrative log entries are scheduled for deletion once older than 730 days. An account-deletion entry contains the user’s name, email and work-role details and follows that period from its creation. Deleted projects normally remain recoverable for 30 days before scheduled permanent deletion; earlier permanent deletion is possible. Read notifications are retained for 90 days and unread ones for 365 days. Business history remains with the relevant organization or project until its applicable deletion process; personal data must not be retained indefinitely without a justified purpose. Commercial records may need to be retained for applicable statutory periods. Organization closure and backup periods must be specified below.
Your rights and requests
Subject to applicable law, you may request access, correction, erasure, restriction, objection or portability of your personal data, and withdraw consent where processing relies on it. Account deletion and erasure of all personal data are different requests; retained data must have a justified basis. Use the privacy contact below. We may verify your identity and normally respond within one month where GDPR applies, explaining any permitted extension. You may complain to the competent data protection authority, including Serbia’s Commissioner where applicable.
Cookies
The application uses cookies and browser storage for sign-in, security and user preferences. Any additional tracking that requires consent must be disclosed and offered separately before it starts.
- Service provider
- To be completed before publication
- Registered address
- To be completed before publication
- Privacy contact
- To be completed before publication
- Hosting, email providers, data locations and international transfer safeguards
- To be completed before publication
- Backup retention and deletion
- To be completed before publication
- Data retention after an organization closes
- To be completed before publication