> How Contals processes personal data – who is responsible, EU hosting on Cloudflare, what we store and why, recipients, cookies, how long we keep data, your…

Source: https://contals.com/es/privacy/  
Language: es

# Privacy policy

How Contals processes personal data – who is responsible, EU hosting on Cloudflare, what we store and why, recipients, cookies, how long we keep data, your rights and how to use them.

Última actualización: 16 de octubre de 2026

Esta página está disponible en inglés y en alemán. Las versiones en inglés y en alemán son las vinculantes; en caso de discrepancia, prevalece la versión alemana.

**Version 1.0 of 16 October 2026.** This policy covers the Contals app (app.contals.com), the website and documentation (contals.com), the e-mails we send and the public pages of the app (polls, bookings, public boards). It follows the Swiss Federal Act on Data Protection (revFADP) and the EU General Data Protection Regulation (GDPR).

**In short:** Contals stores your account and board data in Cloudflare’s EU jurisdiction, uses it only to provide the service, sells nothing and sets no tracking cookies. When you delete your account, your personal data is removed after a 30-day grace period. Billing records – invoices, amounts and payment provider IDs – are kept as long as tax law requires. You can export your data and delete your account yourself; for everything else, write to  [privacy@contals.com](mailto:privacy@contals.com) .

## 1\. Who is responsible

The controller for the processing described here is **Unique-P GmbH, Burengasse 11, 4655 Stüsslingen, Switzerland** (UID CHE-294.954.310), represented by its managing director Dimitri König. Contals is operated by Unique-P GmbH; “we” and “Contals” in this policy mean Unique-P GmbH.

**Data protection contact:**  [privacy@contals.com](mailto:privacy@contals.com) , or by post to the address above, marked “Data protection”.

**Data protection officer:** we have not appointed one. At our size and with the processing described here, neither the revFADP nor the GDPR requires it. Requests are handled by our managing director, Dimitri König, through the address above.

**Representative in the EU:** A representative in the EU (Art. 27 GDPR) is not appointed yet. One will be appointed before Contals serves its first customer in the EU and named here; until then, people in the EU reach us directly at privacy@contals.com.

**Data on boards.** For the data you and your team put on boards (cards, comments, attachments, names of helpers, answers of people without an account), your organization is the controller, and we process the data on its behalf under the  [data processing agreement (DPA)](https://contals.com/en/data-protection/dpa/) . The DPA is part of our  [terms of service](https://contals.com/en/terms/) ; an owner can also accept it in the organization settings, which records who accepted which version and when. Questions about such data are best sent to your organization; if they reach us, we forward them.

## 2\. What we process and why

| Data | Purpose | Legal basis (GDPR / revFADP) |
| --- | --- | --- |
| Account: name, e-mail address, password hash or sign-in links (with the 6-digit code in the same e-mail, stored only as a fingerprint for 10 minutes), language, theme; your confirmation that you are 16 or older or have your parent’s or guardian’s consent, with its date (we never ask for a birth date); if you sign in with Google, Microsoft or another provider or through your organization’s single sign-on, the name, address and confirmation that provider returns (no provider access tokens) | Provide your account, sign-in, security; the minimum age in our terms | Contract (Art. 6(1)(b) GDPR) |
| Personal settings: favorites, saved filters, notification settings (in the app, by push or by e-mail for each kind of event; quiet hours; the default for due reminders; short lock-screen texts) and summary e-mail settings, time zone, the boards you visited and when (for “since your last visit”); assistant conversations if your organization uses AI (30 days) | Provide the service to you | Contract |
| Push notifications, if you switch them on for a device: the address and keys your browser’s push service issues for that device, when it was added and last seen | Show notifications on that device, also when Contals is closed | Contract (you switch them on for each device) |
| Content: boards, lists, cards, comments, labels, assignments, due dates, activity history; files attached to cards (photos are stored without their location and camera data, which are removed while they are uploaded; a deleted file is erased a day later); answers to date polls and appointment bookings, including the name and e-mail address of people without an account (kept apart from the board and deleted at the latest 90 days after the appointment or the poll’s last date; a booker’s name appears in the card’s title only if the organization switches that on for the appointment type) | Provide the service to you and your team | Contract; for teams: processing on behalf of your organization |
| E-mail to a board, if a board admin turns on the board’s address: the mail of a board member becomes a card (sender, subject and text go into the card); for every mail we keep a hash of the sender address, its size and the outcome for 30 days – never the address, subject or text | Turn a member’s e-mail into a card; refuse mail from others and limit abuse | Contract; for teams: processing on behalf of your organization |
| Public poll, booking and board pages: the name of the organization behind the page (for an organization with a single workspace, the workspace’s name); on a poll, members by first name (“Anna K.” when two share one) – full names only if the poll’s organizer switches them on – and guests with the name they typed; for a guest of a poll, a cookie that lets them change their answer | Show people without an account who is asking and who has answered | Contract; legitimate interest of the organization (Art. 6(1)(f) GDPR) |
| Your organization’s data protection settings: the privacy contact its owners or admins enter (name, e-mail address) and who accepted the data processing agreement, when and which version | Reach the right person in a data breach; record the agreement | Contract; legal obligation (Art. 28 and 33 GDPR) |
| Memberships, roles, invitations (e-mail address of the invited person) | Access control, invitations | Contract; legitimate interest of the inviting team |
| Invite links of a workspace: the role, end date and limit of a link and who created it (the link itself is stored only as a fingerprint); who joined through which link, and when | Let a group join a workspace; show owners and admins who joined; keep someone an admin removed from coming back through the same link | Contract; legitimate interest of the team |
| API tokens, connected AI agents and calendar feeds: name, scopes, expiry and last use of a token (the token itself only as a hash); requests of an agent to connect to your account (7 days); the secret link of a calendar feed (only as a hash) | Let you connect scripts, AI assistants and calendar apps | Contract |
| Imports: the export file you choose is read in your browser; what is uploaded for the import waits in storage in the EU while the import runs (at most 7 days); a Trello key you enter is used for that import only and never stored | Import your boards | Contract |
| The free Trello migration, if you ask for it: your organization’s and workspace’s names, your name and e-mail address from your account, the sizes, Trello plan, call language, availability and note you give, when you consented, the request’s status and our internal note; in the video call only what you show on your screen (we do not record calls) | Answer and carry out your request | Contract (your request, Art. 6(1)(b) GDPR) |
| Community templates, if your organization shares one: the board’s structure after our allowlist (titles of lists, cards and checklist items, labels and fields – no descriptions, comments, people or field values), the name, description, category and language you give, your organization’s name only if you tick it, who submitted it (internal only), the review status and note | Review the template and show it in the public gallery on contals.com; let others use it; remove it after a report | Contract; the publishing organization’s decision – once public, the structure is free to use under CC0 |
| Nonprofit pricing, if your organization asks for it: the organization’s legal name, legal form, register entry, country and note, who asked (as a user ID), our decision and note | Decide on the request; keep it with the billing records | Contract; legal obligation (Art. 6(1)(c) GDPR) |
| Technical data: browser, device and session information; the IP address of a request is used for limits against abuse at Cloudflare’s network edge but not stored by us | Security, abuse prevention, troubleshooting | Legitimate interest (Art. 6(1)(f) GDPR) |
| Audit log of security-relevant actions in your organization (who granted or removed access, changed sign-in settings, exported data, opened a confidential board – with IDs, not content) | Accountability and security for your organization and for us | Legitimate interest (Art. 6(1)(f) GDPR); for teams: processing on behalf of your organization |
| Two-factor sign-in, if you or your organization switch it on: the key of your authenticator app (stored encrypted), your recovery codes (stored only as hashes), your passkeys (a public key, the name you give it, when it was added and last used) | Protecting your account | Contract; legitimate interest (Art. 6(1)(f) GDPR) |
| Reports of abuse on public poll, booking and board pages and on community templates: which page (its link token) or template, the reason and an optional note – not who reported it and no IP address | Preventing spam, phishing and illegal content | Legitimate interest (Art. 6(1)(f) GDPR) |
| Billing: organization name, billing address, plan, invoices, amounts, payment provider IDs | Billing, accounting, tax obligations | Contract; legal obligation (Art. 6(1)(c) GDPR) |
| E-mails we send (confirmation, invitations, sign-in links; reminders before a trial ends; the summary e-mail, weekly by default; single notifications such as assignments, mentions and due reminders, collected into one e-mail – only if your organization’s plan includes them and only for what you have not read in the app; you choose the events, how often and your quiet hours, and can unsubscribe from notification e-mails with one click; notices when your sign-in factors or your password change; notices to the owners of a free organization nobody has used for 90 days, 14 and 3 days before it pauses; essential notices about your organization – decisions on nonprofit requests (to the requester and the owners), a failed payment and a read-only organization (to the owners), the hand-over of an organization when its last owner deletes their account (to the new owner, without naming the deleted person), the deletion of an organization (to its members), a public page or community template taken down (to the board’s managers and the publisher), decisions on requests for the Trello migration or a community template (to the requester or publisher) and the restore of your account by support (to you)) | Account and team functions | Contract |
| The newsletter, only if you tick its box when you sign up or switch it on in your profile: that you want it, when you agreed and which wording you saw (in which language), and when you withdrew | Occasional e-mails about Contals – new features and tips. We do not use a newsletter provider yet; before we do, it is named here and in the subprocessor list | Consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in your profile, as easily as you gave it |
| Messages you send us by e-mail (for example to hello@, support@, privacy@ or  [security@contals.com](mailto:security@contals.com) ): your address, your message and our answer | Answer you; document requests about your data | Contract or pre-contractual steps; legitimate interest (Art. 6(1)(f) GDPR); for requests about your data: legal obligation |
| Visits to the website, the documentation and the app’s pages for signing in or up, invitations and invite links: page views counted with Fathom Analytics, without cookies and not with Global Privacy Control or Do Not Track (section 4) | Aggregate statistics of which pages are read and where visitors come from, to improve them | Legitimate interest (Art. 6(1)(f) GDPR) |

We do not sell personal data, do not use it for advertising and do not build profiles. We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR, Art. 21 revFADP). Content on boards can contain sensitive data (for example religious affiliation in a church). Please keep such content to what is necessary; boards are private by default.

**Swiss law.** Under the revFADP, private companies need a justification only where processing would otherwise infringe someone’s privacy. Where the table names a legal basis under the GDPR, the same reason – your consent, a contract, a legal obligation or an overriding interest (Art. 31 revFADP) – is our justification under Swiss law.

**Do you have to give us data?** The data for your account and sign-in is needed to provide Contals; without it we cannot open an account. Everything else – content, settings, integrations, push notifications – is up to you.

## 3\. Where your data is stored

Contals runs on **Cloudflare** (Cloudflare, Inc., USA, and its affiliates). Board data, the database, queues and backups are created in Cloudflare’s **EU jurisdiction**. A second copy of the backups – including the nightly copies of boards – lies at **DigitalOcean in Frankfurt (Germany)**, encrypted by us before it leaves, so DigitalOcean cannot read it. Cloudflare is a US company; transfers or access from outside the EU are covered by the EU–US and Swiss–US Data Privacy Framework (Cloudflare states it is certified) and, as a fallback, the EU standard contractual clauses. Some technical data is processed outside the EU, mainly in the USA, for operating and securing the network: internal object IDs (which never contain personal data) and request data such as IP addresses, browser information and the requested address (links to boards contain the board title, and links to attached files the file name – except for confidential boards and in organizations that switched on “no titles in links”). Attached files are opened through a separate address of ours with links that expire after 10 to 20 minutes and set no cookies. Details:  [subprocessors and transfers](https://contals.com/en/data-protection/subprocessors/) .

**Point-in-time recovery.** Cloudflare can restore the databases and boards to any moment of the last 30 days. Cloudflare’s EU jurisdiction covers the stored data, but Cloudflare does not document separately where the data for this recovery is kept; until it confirms that this data stays in the EU, we treat it as an open question. Our own backups – the nightly copies, kept 35 days – stay in the EU: in Cloudflare’s EU jurisdiction and, encrypted by us, at DigitalOcean in Frankfurt.

**Access from Switzerland.** Unique-P GmbH administers Contals from Switzerland. Administrative access to the infrastructure is limited to Unique-P GmbH (currently its managing director) and protected by two-factor authentication; access by Cloudflare’s own staff follows Cloudflare’s data processing agreement. The EU recognizes Switzerland as a country with an adequate level of data protection.

## 4\. Recipients and subprocessors

| Recipient | Purpose | Location |
| --- | --- | --- |
| Cloudflare, Inc. | Hosting, database, storage, e-mail sending and receiving, network | EU jurisdiction for stored data; global network |
| DigitalOcean, LLC | A second, encrypted copy of our backups (only data we encrypted; the key stays with us) | Frankfurt, Germany |
| Stripe Payments Europe, Ltd., with Stripe, Inc. | Payments, subscriptions, invoices and tax calculation, from the first paid plan; for fraud prevention and financial regulation Stripe acts as a controller of its own | EU and USA (Data Privacy Framework, standard contractual clauses) |
| Conva Ventures Inc. (Fathom Analytics) | Counting page views on the website and the documentation (not the docs search) and the app’s pages for signing in or up (`/login` and its confirmation, link and two-factor steps), for invitations (`/invite`) and for invite links (`/join`) – never after sign-in | Canada; visitors from the EU, the EEA, Switzerland and the UK in the EU (see below) |

**Fathom Analytics.** Fathom counts page views without cookies and without building profiles of visitors. It runs on the website and the documentation (not the docs search) and the app’s pages for signing in or up (`/login` and its confirmation, link and two-factor steps), for invitations (`/invite`) and for invite links (`/join`) – never on pages after sign-in, on public poll, booking or board pages or on card links. If your browser sends Global Privacy Control or Do Not Track, nothing is loaded from Fathom and nothing is sent. Otherwise Fathom receives the page – on the app’s pages only its template, such as `/join`, never a token or a query string (a page whose address carries campaign keys is not counted at all); on the website and the documentation the page address, with the campaign parameters of a link such as `utm_source` – the referring site (its origin only) and, as with any request, your IP address and your browser’s identification (user agent). According to Fathom, it anonymises the IP address immediately and does not store it, and visitors from the EU, the EEA, Switzerland and the UK are processed in the EU (“EU isolation”). Fathom (Conva Ventures Inc., Canada) processes the data for us under its data processing agreement; the EU recognizes Canada as a country with an adequate level of data protection, and so does Switzerland. Our legal basis is our legitimate interest in aggregate visitor statistics. You can object at any time (section 7) – switching on Global Privacy Control has the same effect; blocking Fathom does not affect Contals.

The video calls of the free Trello migration use a video call service that we name here before the first call; it carries only what you show on your screen. Our mailboxes (for messages you send us) are hosted by an e-mail provider that processes them on our behalf. If the law obliges us, we disclose data to authorities or courts, and only what we must. If the operation of Contals passes to another company, the data passes with it; we tell you at least 30 days in advance (see the terms of service).

Details, transfer mechanisms and the recipients you can connect yourself (chat tools, your own AI provider, sign-in providers, webhooks):  [subprocessors and recipients](https://contals.com/en/data-protection/subprocessors/) . We announce changes to the subprocessors that process data on boards at least 30 days in advance.

**Push notifications** are delivered by your browser’s push service – Google (Chrome; Edge and other browsers on Android), Apple (Safari; Contals on the Home Screen of an iPhone or iPad), Mozilla (Firefox) or Microsoft (Edge on Windows) – and only if you switch them on for a device. Each message is encrypted for your device: the push service cannot read it and sees only the device address it issued, the time and the size of the message. Notifications about confidential boards never name a card, a board or a person; you can choose the same short texts for all notifications.

## 5\. Cookies and similar technologies

We use only cookies and storage that are needed for what you ask for – no tracking or advertising cookies, also not for the page view counting (section 4).

| Name | Where | What for | How long |
| --- | --- | --- | --- |
| `contals_locale` | Website, documentation and app | The language you picked (only if you pick one) | 1 year |
| `__Host-contals_locale` | App | The language you picked in the app | 1 year |
| `__Host-contals.session_token`, `__Host-contals.session_data` | App | Keeps you signed in (strictly necessary); the second holds a 5-minute copy of the session so pages load faster | 30 days after the last use; 5 minutes |
| `__Host-contals.two_factor` | App | Remembers a sign-in that waits for its second factor | Until the sign-in is finished (short-lived) |
| `__Host-contals-signup` | App | Ties a new account’s confirmation link to the browser it was requested in (protection against misuse) | 8 days |
| `__Host-contals.join` | App | Remembers the invite link while you join a workspace with Google, Microsoft or another provider | 30 minutes |
| An edit cookie per poll | Public poll pages | Lets a guest change their own answer | Half a year |

The app’s cookies are bound to app.contals.com alone; the sign-in cookies cannot be read by scripts (HttpOnly).

**Storage in your browser.** On the website, if you pick a currency for the prices, your browser keeps that choice (`contals_currency` in its local storage); it is never sent to us. The app keeps a local copy of the boards you opened (IndexedDB) and of your account overview so they stay readable offline – not on devices marked as shared. It also keeps settings of this device in local storage: theme and accent colour, the simple view, whether the device is shared, collapsed sections, whether push is on (to renew the subscription) and “Not now” on the install suggestion (30 days). If you install Contals on your device (Home Screen), the device keeps the app’s files so it starts without a connection. The settings of a device stay on that device.

## 6\. How long we keep data

-   **Organizations:** an organization is deleted 30 days after one of its owners asks for it; when its paid subscription ends, it continues on the free plan and nothing is deleted. During these 30 days it is read-only, everything can be exported, and the owners are told by e-mail. Then its workspaces, boards and member lists are deleted; billing records stay as described below.
-   **Board history:** each board keeps its activity – who changed what, earlier versions of titles and descriptions – for 13 months. Older changes are folded into the board: their result stays, the single steps and earlier texts are deleted.
-   **Account:** as long as you have an account. When you **delete your account**, you leave all workspaces at once, you are signed out everywhere and your name and e-mail address are replaced by a pseudonym immediately. Your remaining **personal data is deleted after a 30-day grace period**. During these 30 days support can restore the account if you write from its address: your name, e-mail address and personal settings come back; your memberships, password, passkeys, two-factor sign-in, API tokens and calendar links do not – your teams invite you again, and you sign in with an e-mail link. We tell you by e-mail when it is restored. After the 30 days, or when another account uses the address by then, the deletion is final.
-   **Shared content:** cards and comments you wrote in shared workspaces stay with the team and show “Deleted user”.
-   **Billing records:** invoices, amounts and payment provider IDs are kept **as long as tax and commercial law requires** (in Switzerland and Germany currently up to ten years), even after an account is deleted. Nonprofit requests are kept with them.
-   **Unconfirmed sign-ups:** deleted after 7 days.
-   **Newsletter:** your choice and the record of your consent as long as you have the account; after a withdrawal we keep when you agreed and when you withdrew as proof, until your account is deleted.
-   **Sign-in sessions** (with the browser name; we store no IP address): a session ends 30 days after its last use or when you sign out; it is deleted a day after it ended.
-   **Two-factor sign-in:** until you switch it off or remove a passkey, or your account is deleted.
-   **Sign-in codes:** 10 minutes, single use; the newest code of an address replaces the older one.
-   **API tokens and calendar feeds:** until you revoke them or they expire, and with your account; requests of agents to connect 7 days after they expired.
-   **Your organization’s privacy contact and the record of the accepted data processing agreement:** until changed or until the organization is deleted; each acceptance is also recorded in the organization’s audit log.
-   **Audit log:** 180 days in the database, then 2 years in the backup storage (IDs, actions and times – no board content).
-   **Abuse reports:** deleted 180 days after we closed them.
-   **Invitations:** valid for 14 days.
-   **Invite links:** a link and the record of who joined through it are deleted 90 days after the end date it was created with; the memberships stay.
-   **Imports:** uploaded content is deleted when the import ends, at the latest after 7 days.
-   **E-mail to a board:** the record of each mail (a hash of the sender, the outcome) 30 days.
-   **Requests for the free Trello migration:** deleted 180 days after the request was closed (done, declined or withdrawn), and with your account.
-   **Community templates:** public ones until the organization withdraws them, we remove them or the organization is deleted; rejected, withdrawn and removed ones 180 days after their last change. Copies others made of a public template under CC0 are theirs.
-   **Notifications in the inbox:** read items 90 days; at most the newest 2,000 items are kept.
-   **Push subscriptions:** until you switch push off on that device or sign out on it, your browser’s push service reports the subscription as expired, or your account is deleted – then at once, without the grace period.
-   **Due reminders:** the due date and reminder of cards assigned to you, until two days after the due date.
-   **E-mail log:** once an e-mail is sent we keep only a hash of the address, its domain and the delivery status, for 30 days – also after your account is deleted, to protect against abuse (limits per recipient, bounces and complaints). Addresses that bounced or complained stay blocked, stored as a hash.
-   **Bookings and polls of people without an account:** name, e-mail address and answers are deleted when the organizers erase them, with the board, and at the latest 90 days after the appointment or the poll’s last date; a poll guest’s address already when the final date has been sent.
-   **Assistant conversations** (if your organization uses AI): 30 days after the last message; you can delete them earlier. The AI usage log keeps only token counts.
-   **Messages to our mailboxes:** as long as we need them to deal with your request, and then up to 2 years for questions that come back; longer only where they belong to a contract or the law requires it (for example as business correspondence, up to ten years).
-   **Backups:** point-in-time recovery of board data for 30 days; an archive of board changes for 90 days; nightly backups of the account databases and nightly copies of the boards that changed for 35 days (the encrypted copy at DigitalOcean as well); the audit log as above. After that, each copy is deleted. We record every deletion (with IDs only, for 120 days – longer than any copy lives) and apply it again whenever something is restored from these copies, so deleted data does not come back.
-   **Logs:** the Workers that run the app keep no request logs. The website’s and the documentation’s edge scripts (they run for the language redirect at contals.com/, the community template pages and the documentation) keep Cloudflare’s Workers Logs with request data such as the address, time and status for 7 days. Cloudflare keeps its own analytics and security events of the network under its terms.
-   **Page view counts (Fathom):** Fathom keeps aggregate counts – pages, referring sites, countries, browsers and devices – without IP addresses or identifiers of persons.

## 7\. Your rights

You have the right to **access** your personal data, to have it **corrected** or **erased**, to **restrict** its processing, to **data portability** and to **object** to processing based on a legitimate interest (Art. 15–21 GDPR; Art. 25–32 revFADP). Where processing is based on your consent, you can **withdraw** it at any time with effect for the future.

**How to use them:** you can export your data yourself (settings pages) and delete your account yourself (profile page). For everything else, write to  [privacy@contals.com](mailto:privacy@contals.com)  – from the address of your account if the request is about it, so we know it is you; if we cannot tell, we may ask for proof of identity. We answer within 30 days and free of charge; if a request is unusually complex, we tell you within that time why we need longer (at most two more months under the GDPR). For data on boards, your organization decides as controller; we forward such requests to it.

**Complaints:** you may complain to a supervisory authority – in Switzerland the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), Feldeggweg 1, 3003 Bern,  [edoeb.admin.ch](https://www.edoeb.admin.ch/) ; in the EU the authority of the country where you live or work or where the alleged infringement took place (a list is on  [edpb.europa.eu](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) ); elsewhere the authority responsible where you live. We are glad if you write to us first.

**Wherever you live.** These rights apply to everyone, also outside Switzerland and the EU – for example to residents of US states with their own privacy laws. We do not sell or share personal data for advertising, and we do not use it for targeted advertising or profiling.

## 8\. Security

Encrypted connections (HTTPS), boards private by default, permission checks on the server for every change, two-factor sign-in and passkeys (organizations can require them), signed-in devices visible and revocable, audited data exports, an audit log the owners and admins of an organization can read. Details on the  [security page](https://contals.com/en/security/)  and in the  [technical and organizational measures](https://contals.com/en/data-protection/toms/) .

## 9\. Minimum age

Contals is for people aged 16 and older; younger people may use it with the consent of a parent or guardian, which whoever creates the account confirms. We do not knowingly collect data of younger children without that consent; if you think we have, write to  [privacy@contals.com](mailto:privacy@contals.com)  and we delete it.

## 10\. Changes

We will announce material changes to this policy at least 30 days in advance by e-mail and in the app. The version in force is always on this page, with its date at the top.