Version 1.0 of 16 October 2026. Annex 3 of the data processing agreement between your organization and Unique-P GmbH, which operates Contals. We announce new or replacement subprocessors to organization owners at least 30 days in advance.
Subprocessors
| Subprocessor | What for | Data | Where | Transfer basis |
|---|---|---|---|---|
| Cloudflare, Inc. (USA) and affiliates | Hosting: application, board and user data, databases, archive and backups, queues, network, firewall | All customer data; request metadata | Stored data in the EU jurisdiction. Requests are processed in the nearest Cloudflare data center. Some metadata (internal IDs, request logs and analytics) mainly in the USA; support access by Cloudflare affiliates (e.g. UK, Singapore, India, Japan) | EU–US and Swiss–US Data Privacy Framework (Cloudflare certified); EU standard contractual clauses with Swiss amendments as fallback |
| Cloudflare, Inc. – Email Service (from the e-mail launch) | Sending sign-in links (with their sign-in code), confirmations, invitations, booking and poll confirmations, the summary e-mail (weekly by default); single notifications collected into one e-mail (paid plans); essential notices about an account or organization (password changes, nonprofit and request decisions, payment problems, hand-overs, deletions, takedowns, an account restore) | Recipient, first name, the mail content (summary e-mail: titles of your cards and boards with counts of changes; notification e-mails: card and board titles and who acted; never comment texts; no titles or other content from confidential boards). We keep the address and content only until the mail is sent, then just a hash of the address and the delivery status for 30 days | Not documented by Cloudflare yet | As above |
| Cloudflare, Inc. – Email Routing (when a board’s e-mail address is turned on) | Receiving mail to board addresses; the mail of a board member becomes a card | Sender and recipient address, subject and text of the mail. We keep only the card and, for 30 days, a hash of the sender address with the outcome – never the address, subject or text | Not documented by Cloudflare yet | As above |
| DigitalOcean, LLC (USA) – Spaces storage (from the launch) | A second copy of our nightly backups, so losing our Cloudflare accounts cannot take the backups with it | Encrypted by us before it leaves (the key stays with Contals): DigitalOcean stores only unreadable data. The backups hold account data, memberships, board titles, audit records, booking contacts and the list of deletions, and the nightly copies of boards hold board content (cards, comments) | Frankfurt, Germany; deleted after 35 days (audit archive 2 years) | Data Privacy Framework (DigitalOcean certified) and standard contractual clauses |
| Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA) (from the first paid plan) | Payments, subscriptions, invoices, tax calculation | Organization, billing contact, address, VAT ID, invoices; payment details are entered at Stripe only. Contals itself keeps only Stripe IDs, amounts and states | EU and USA | Data Privacy Framework (Stripe certified) and standard contractual clauses |
Cloudflare’s own subprocessors are listed at cloudflare.com/gdpr/subprocessors.
In the app we use no analytics, tracking or advertising services, no third-party error tracking and no support tool with access to your content.
Processors for our own website
Not subprocessors of your data: they receive nothing from boards or organizations, only what a visitor’s browser sends when it opens a page.
| Processor | What for | Data | Where | Transfer basis |
|---|---|---|---|---|
| Conva Ventures Inc. (Canada) – Fathom Analytics | Counting page views on the website and the documentation (not the docs search) and the app’s pages for signing in or up (/login and its confirmation, link and two-factor steps), for invitations (/invite) and for invite links (/join) – never after sign-in | The page (in the app only its template, without tokens or query; on the website its address), the referring site’s origin, the IP address and the browser’s user agent, which Fathom says it anonymises immediately. No cookies, no profiles; nothing at all with Global Privacy Control or Do Not Track | Canada; visitors from the EU, the EEA, Switzerland and the UK in the EU | Adequacy decision for Canada (EU and Switzerland); Fathom’s data processing agreement |
Recipients you connect yourself
These are switched on by your organization – push notifications by each person for their own device; you choose the provider and need your own agreement with it (push services come with the person’s browser). They are not subprocessors of Contals.
| Recipient | Switched on by | What is sent | Safeguards |
|---|---|---|---|
| Slack, Microsoft Teams, Google Chat, Discord (chat notifications) | A board admin | Board and card titles, list names, names of the people acting, comment excerpts – for the chosen events | Webhook addresses encrypted; no content from confidential boards; can be switched off per channel |
| OpenAI, Anthropic, Google Gemini or a compatible endpoint with your own key | An organization owner or admin | Board, list and card titles and, if your AI policy allows, descriptions and status updates, checklists, comments and names – only for the feature or assistant request used; never e-mail addresses | Off by default; per workspace and per feature; confidential boards are never sent; keys encrypted; Contals stores no prompts or answers in its logs and never trains models |
| Google, Microsoft, Apple, GitHub and other sign-in providers; your own single sign-on | Each person / your organization | Sign-in request; your name and e-mail come back | Provider access tokens are not stored |
| Push services of the browser vendors: Google (Chrome; Edge and other browsers on Android), Apple (Safari; Contals on an iPhone’s or iPad’s Home Screen), Mozilla (Firefox), Microsoft (Edge on Windows) | Each person, for their own device | An encrypted message only the device can read; the service sees the device address it issued, the time and the size | Encrypted for the device; texts as the person chose and always short for confidential boards (no card, board or person named); only these services are accepted; the subscription is deleted when push is switched off, on sign-out on that device and at once when the account is deleted |
| Calendar apps (Google, Outlook, Apple) subscribing to a calendar feed | A person who creates a feed link | Titles and due dates of cards and checklist items; for confidential boards only “Busy” and the card key | Secret link per person, can be renewed or turned off at once; access is checked on every fetch |
| Trello (import with an API key) | A person who imports a board | Contals reads the chosen board from Trello on that person’s instruction; nothing is sent to Trello | Key and token used for that import only, never stored or logged |
| Scripts and AI assistants via the API or MCP | A person who creates a token | What the person’s rights and the token’s scopes allow | Limited, expiring, revocable tokens; logged |
| Webhook endpoints: your own server, Zapier or Make | A board or workspace admin | Signed messages with IDs only – no titles, no texts; the receiver reads details through the API with its own token | Only HTTPS addresses; a delivery log; can be switched off at any time |
Transfers in short
Stored data stays in Cloudflare’s EU jurisdiction. Cloudflare, Inc. is a US company and subject to US law (including the CLOUD Act). It commits to notify customers of government requests, to challenge requests that conflict with EU or Swiss law and to disclose only the minimum, and states it has never handed over encryption keys. Because Cloudflare manages the encryption keys and processes data in plain text, a technical exclusion of such access is not possible. A transfer impact assessment is available on request.
Changes
| Date | Change |
|---|---|
| 2026-10-15 | First version (before the launch) |
| 2026-10-15 | E-mail sending described in detail; Amazon SES (Zurich) listed as an optional fallback – switched on only after 30 days’ notice |
| 2026-10-15 | AI with your own provider is built and no longer marked as planned; Stripe is built and becomes active with the first paid plan. No new subprocessor |
| 2026-10-15 | Cloudflare Email Service is our only e-mail provider: Amazon SES, the optional fallback that was never switched on, is removed. No data was ever sent to it |
| 2026-10-15 | Volunteer sign-up sheets are removed before the launch, so the Email Service no longer sends sign-up confirmations, shift reminders or coordinators’ messages. No subprocessor changes |
| 2026-10-16 | DigitalOcean (Frankfurt) added for an encrypted second copy of our backups – only data encrypted by us, deleted after 35 days (audit archive 2 years). Before the launch, so no customer data is affected |
| 2026-10-16 | The encrypted copy at DigitalOcean also holds the nightly copies of the boards that changed (board content, encrypted by us; 35 days) and the list of deletions that is applied again after a restore. Before the launch, so no customer data is affected |
| 2026-10-16 | Notifications by e-mail and push: the Email Service also sends single notifications collected into one e-mail (paid plans); the push services of the browser vendors deliver encrypted push notifications for people who switch them on. No new subprocessor |
| 2026-10-16 | E-mail to a board: Cloudflare Email Routing receives mail to board addresses (only when a board admin turns the address on). Webhooks send IDs only to addresses our customers choose (their own services, Zapier or Make – processors of the customer, not ours). No new subprocessor company |
| 2026-10-16 | Version 1.0: the processor is named (Unique-P GmbH). Fathom Analytics counts page views on the website, the documentation and the app’s sign-in pages – without cookies, for our own website, not for data on boards. No new subprocessor of your data |