Privacy policy

The website and database run at Render Services, Inc. (USA) in the Frankfurt am Main region; Cloudflare sits in front of the website to protect against overload attacks. Render processes the data as a processor. Any transfer to the USA is covered by Render's certification under the EU-US Data Privacy Framework, alternatively by the EU Standard Contractual Clauses.

When you visit the website, the server processes technically necessary data (IP address, time, requested address, browser identifier) to deliver the page and fend off attacks. Render deletes these logs automatically after 14 days. Legal basis: Art. 6(1)(f) GDPR.

When you create a workspace via the “Start” page, we store the company, your name, your business email address, your VAT ID if given, the project name, the short description and the plan you are interested in. In the workspace we also store what you and your colleagues enter there — project description, stack, conventions and links —, the members (email address and role) and the time of the last activity. These details may contain personal data.

For every platform you connect, we store the platform, the target (e.g. the address of a repository or your shop), your note and the state of the invitation with timestamps (added, invited, confirmed, removed). We do not store passwords, API keys or access tokens: we only get access by you inviting our accounts.

For every card on the board we store the title, description, “Done when”, links and attached files, for a card we create from an issue in your issue tracker (e.g. Jira) the link to that issue, column and order, who created it (name, email address, language), from the start the scope, acceptance criteria and delivery date, the delivery (summary, result links, test steps, an AI fact sheet if any and the time of the senior review), the acceptance with the confirmed criteria, revision requests with the unmet criteria and the messages on the card. If you don't respond to a delivery for 7 days after our delivery email, we record the acceptance automatically (section 6 of the terms). We also record the start, delivery, acceptance, revision requests, moves, order and cancellation with their time in a log, so that what was agreed and delivered can be proven.

The purpose is providing the workspace and carrying out your tasks; legal basis: Art. 6(1)(b) GDPR, for the log also Art. 6(1)(f) GDPR (proof of performance). Personal data in your systems that we come into contact with while working on cards is processed on your behalf; the data processing agreement (Art. 28 GDPR) applies to it, and you are the controller for that data.

Until you have created a new card, your browser stores the draft locally (localStorage) so nothing gets lost. It only leaves your device when you create the card and is deleted afterwards.

The first task is free once per company. To keep it that way, before it starts we compare the company name, VAT ID, the email addresses of a workspace and their domain with the other workspaces we store. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is preventing repeated use of the free offer.

We keep no separate list for this: the comparison only covers workspaces that are still stored (see "Retention").

When you request a Projekt-Check or write to us via the contact form, we store your details (company, name, email, phone number and VAT ID if given, your description or message and your answers in the form) in our database to prepare the Projekt-Check or answer your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request).

You book the Projekt-Check via a link to Calendly, a service of Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. It is an ordinary link: our website loads nothing from Calendly and sends no data to Calendly unless you click it.

Only when you click the link does your browser open Calendly's booking page; Calendly then receives technical connection data such as your IP address and browser identifier. Calendly receives your booking details (name, email address, chosen time and any notes you add) only if you book an appointment. Calendly processes them on our behalf as a processor to schedule the appointment and passes the booking on to us. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request).

Calendly, LLC is certified under the EU-US Data Privacy Framework; the transfer to the USA relies on the European Commission's adequacy decision. Processing on Calendly's own pages, e.g. through cookies, is governed by Calendly's privacy notice: calendly.com/legal/privacy-notice. If you prefer not to use Calendly, you can also arrange the appointment by email to info@techmg.de.

When you create a workspace, we create a client account for you. For this we store your name, company, email address, VAT ID if given and your language, as well as the times of registration and confirmation. In the account you see the workspaces you are a member of, and we prefill your details in our forms.

There is no password: to confirm your address and for every sign-in we email you a sign-in link that is valid for 20 minutes. It also contains the page you return to after signing in (such as your board). Your address counts as confirmed as soon as you open such a link. We only send sign-in links to addresses that have a client account, are a member of a workspace or previously sent us a task or had a Prozess-Abo.

The owner of a workspace can add colleagues as members by their email address; we store the address with the role and send it a sign-in link. When a member opens a sign-in link and has no client account yet, we create one with their email address — with the name and company from their last request to us, otherwise with the address as the name until the member changes it. Legal basis: Art. 6(1)(b) GDPR, for added colleagues Art. 6(1)(f) GDPR (their company's legitimate interest in working together in the workspace).

Unconfirmed accounts are deleted 30 days after registration. Confirmed accounts are not deleted automatically but when you ask us to — an email to info@techmg.de is enough. When we delete workspaces is set out under "Retention".

When you order a Prozess-Abo in the workspace or accept an individual offer from us, we store the contract data: company, name and email address of the person ordering, VAT ID if given, plan, monthly fee, the number of tasks that can be in progress at the same time, for a plan with a monthly limit the number of tasks per billing month, start, cancellation and end, requests to change the plan and, for an individual offer, its content. Credits for late tasks follow from the start, delivery date and delivery of the cards. The purpose is performing the Abo contract; legal basis: Art. 6(1)(b) GDPR.

For invoicing we store the billing address (company, street, postcode, city, country), a separate email address for invoices if given, and which invoice we issued for which billing month, with its amount, the credits set off and the payment received. Legal basis: Art. 6(1)(b) and (c) GDPR (contract and tax obligations, § 14 UStG).

We write the invoices through our business account at Finom Payments B.V., Jachthavenweg 109h, 1081 KM Amsterdam, Niederlande, where your payments also arrive; we keep our books with Lexware Office der Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg i. Br.. Both receive the invoice data for this.

If a company is based in another EU member state, we invoice without German VAT (reverse charge) and first check its VAT ID in the European Commission's VAT Information Exchange System (VIES). We transmit the client's VAT ID and our own; we keep the result (valid or not, name and address as registered if returned, consultation number) as proof. Legal basis: Art. 6(1)(c) and (f) GDPR; our legitimate interest is issuing reverse-charge invoices only to registered businesses.

The Abo data belongs to the workspace and is deleted with it (see "Retention"). Invoices and other records required by commercial and tax law are kept for the statutory period.

We use Anthropic's Claude API (contracting party: Anthropic Ireland, Limited, Dublin) for two steps. First, to assess a card as soon as it is created in your backlog or when we have it reassessed: we send the card's title, description, “Done when”, links and attachments and the context of your workspace (project description, stack, conventions, links and the connected platforms with target and state). Second, for the handover text of a delivery: scope, acceptance criteria, delivery method, result links, the developer's notes and, where applicable, your latest revision request.

We do not send names, email addresses, the company or VAT ID, nor the contents of your repositories and other systems. Projekt-Check and contact requests are not sent to the AI.

Anthropic acts as a processor, processes and stores the data in the USA; the transfer is based on the EU Standard Contractual Clauses in Anthropic's data processing addendum. Anthropic deletes the data within 30 days (content that violates its usage policy: up to 2 years) and under its commercial terms may not use it to train models.

The AI only drafts. A person fixes the scope and acceptance criteria of a card at the start, and a senior developer reviews and releases every delivery before it reaches you; there is no automated decision-making within the meaning of Art. 22 GDPR. Legal basis: Art. 6(1)(b) and (f) GDPR.

We send sign-in links, invitations to a workspace, confirmations of Projekt-Check and contact requests, notices about your cards (start with delivery date, delivery, acceptance, messages, decline) and about the Prozess-Abo (start, individual offer, change of plan, cancellation) from the info@techmg.de mailbox hosted by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland). Google processes the emails as a processor; transfers to the USA are covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR.

Without your consent we don't use advertising or tracking cookies; Google Analytics sets cookies only if you agree in the consent banner (see "Google Analytics"). We store your choice in your browser (localStorage, key "techmg-consent-ga") so we don't ask again.

A cookie is also set when you sign in via a sign-in link (client_session, 30 days, contains your signed email address). It is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG), as is the locally stored draft of a new card (see "Workspace and board").

We count page views without cookies and without third parties: we store the page, language, referring domain, device type and a visitor ID computed from IP address and browser identifier with a key that changes daily. The IP address itself is not stored; visitors can't be recognised across days. Legal basis: Art. 6(1)(f) GDPR (improving our service).

If you consent in the banner, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse how our website is used. Without your consent, Google Analytics is not loaded.

It sets cookies (_ga, _ga_<ID>, lifetime up to 2 years) and sends usage data such as pages viewed, time on page, device, browser and approximate location to Google. Google Analytics 4 does not store IP addresses. Google Analytics is not loaded in the workspace (including the board and cards) or in the client account; page addresses are sent without workspace and card identifiers and without query parameters other than campaign parameters (utm_…, gclid).

A transfer to the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission's adequacy decision.

Legal basis is your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time via "Cookie settings" in the footer. Google deletes user- and event-level data after 2 months (retention period configured in Google Analytics); aggregated reports without personal data are kept.

Fonts are served from our own server; your browser does not connect to Google or other third parties for them.

Attached files and access notes of a task are deleted automatically 30 days after its last change once the task is accepted, declined or archived. A delivery you did not respond to for 7 days also counts as accepted (section 6 of the terms).

We delete a workspace with everything in it — project details, members, connections, cards with attachments and messages, Abo data and log — once its last Prozess-Abo ended more than 12 months ago and nothing in the workspace, its cards or its Abo has changed for 12 months; if it never had a Prozess-Abo, 12 months after the last change. Workspaces in which nobody confirmed their email address are deleted 30 days after they were created. At your request, we delete a workspace earlier as soon as no Prozess-Abo is running.

Projekt-Check and contact requests that didn't lead to an order are deleted with their messages 12 months after the last change. Individual Abo offers that were not accepted are likewise deleted 12 months after the last change.

Unconfirmed client accounts are deleted 30 days after registration. Confirmed client accounts remain until you ask for their deletion.

Records we must keep under commercial and tax law, in particular invoices, are kept as long as those duties require (up to 10 years, § 257 HGB, § 147 AO) — also beyond the deletion of a workspace.

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. An email to info@techmg.de is enough.

You can also lodge a complaint with a data protection authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.