Privacy Policy

1. Who is responsible

Limita is operated by Dannie Hansen Consulting ApS, CVR 45631044, Grenaa, Denmark. Contact us at privacy@limita.org.

We are the controller for our own customer administration, billing, business correspondence, public website operation, aggregated service statistics and the security of those activities.

Where an organisation uses Limita to manage its team’s time records, that organisation normally decides why those records are processed and is the controller. We process its customer data on its documented instructions under our Data Processing Agreement, except for the aggregated service statistics described in section 3. That organisation is responsible for informing its staff and choosing an appropriate legal basis for employee time tracking.

Support work on customer records and diagnostics used to maintain the customer’s service remain processing on that customer’s behalf. We distinguish those activities from our own account and business administration; a support request does not give us a separate right to reuse its customer data.

2. Data we process

• Trello information: workspace, board, list, card and member identifiers; card and checklist information; member names and usernames used to display records; membership and permission information; and OAuth credentials for authorised integration access.
• Time tracking: timer start and stop times, logged hours and dates, member assignments, estimates, billable status, billing notes, clients and contact information, custom-field values, preferences and settings.
• Account and billing: Stripe customer, subscription and invoice references; subscription status, plan and billing period; payment status; the purchaser and order details Stripe shares with us as merchant of record, such as name, contact details, billing address and tax ID; business information where supplied; and cancellation feedback. Stripe handles payment details; we do not receive complete card numbers.
• Support: email addresses, correspondence, attachments and the information you choose to provide in support or privacy requests.
• Technical information: IP addresses, browser and request information, operational logs, audit events, security-related membership state, service metrics, errors and diagnostic breadcrumbs. These may contain member, workspace or session identifiers.

We receive information from you, your organisation, its authorised users, Trello and our payment and service providers. A stable member identifier can still be personal data even when we do not hold that person’s email address.

The service is intended for ordinary work and project information. Do not enter health information, other special-category data, criminal-offence data or unnecessary sensitive details into card titles, notes, clients or custom fields.

3. Purposes and legal bases

• Providing the customer’s time-tracking service: we follow the customer/controller’s instructions for storing, displaying, synchronising and reporting its records. The customer determines its legal basis.
• Individual subscriptions and requested support: where you personally enter a contract with us, we process information necessary to perform that contract or take steps you request before entering it, under Article 6(1)(b) GDPR.
• Business relationships: we process business representatives’ contact information under our legitimate interest in administering the customer relationship and answering enquiries, under Article 6(1)(f).
• Billing and accounting: we process records needed to meet applicable tax and bookkeeping obligations under Article 6(1)(c). Other necessary subscription administration follows the contractual or business-relationship basis above.
• Security and reliability: our legitimate interests under Article 6(1)(f) concern protecting our own website, account administration and business systems. We limit the information to what is necessary and consider its impact. Apart from the service statistics below, customer-data diagnostics and service security performed on a customer’s behalf follow its documented instructions under the DPA.
• Service statistics: every five minutes we calculate totals across all customers from time-entry member and board identifiers, start times and subscription records: the number of distinct Trello members, and of boards, with time entries started in the last 30 days; subscriptions by status and billing interval; current trials, and how many of those trial organisations have a board with time recorded on at least three different days in the last seven days; total boards and time entries; and recurring revenue estimated from these counts at list prices. We use them to operate and secure the service, plan capacity, administer billing and plan our business, based on our legitimate interests under Article 6(1)(f). The results are totals for Limita as a whole and contain no figures for an individual person, board or organisation. They are kept with our service metrics and operational logs.
• Rights requests and legal matters: we process what is necessary to meet data-protection obligations and, where applicable, establish, exercise or defend legal claims. The relevant bases are Article 6(1)(c) and our legitimate interests under Article 6(1)(f).

Using Limita is not treated as blanket consent to processing. If we introduce optional processing that relies on consent, we will explain it and obtain that consent separately. You may withdraw such consent without affecting processing already lawfully performed.

Identifiers and information needed for authentication, subscription administration and the requested service are necessary to provide those functions. Optional notes, client details and custom fields depend on what the customer chooses to use. We do not use your data to make solely automated decisions producing legal or similarly significant effects about you.

4. Who can receive data

Time records are shared within the customer’s use of Limita. Board members can see colleagues’ card-level time entries, which can include notes and custom fields. Administrators have additional reporting and management access. A report filtered to your own entries does not make every card-level record private.

We use providers for hosting, media and website delivery, diagnostics, incident alerts, email and bookkeeping. The provider register distinguishes customer-data subprocessors, providers used for our own operations, and Trello as the customer’s chosen platform. A provider’s role depends on the processing concerned.

Subscriptions are purchased through Stripe as merchant of record. Stripe collects the purchaser’s details at checkout and processes checkout, payment, tax, invoicing, fraud-prevention and regulatory data as an independent controller under the Link Privacy Policy. We send Stripe the Trello Workspace identifier and platform, a placeholder customer name, trial start and end dates, the chosen plan, cancellation and resumption requests, and any business details an administrator supplied for invoicing. Stripe sends us subscription status and billing-period updates and shares purchaser and order details with us.

We may also disclose information where legally required or necessary for legal claims, and in a business transfer subject to applicable data-protection obligations. We do not sell personal data.

5. Locations and safeguards

The platform and database are hosted with Hetzner in Nuremberg, Germany, with encrypted backups in Falkenstein, Germany. Requests to the app and API at app.limita.org go directly to Hetzner and do not pass through Cloudflare. Cloudflare delivers in-app help and onboarding media from media.limita.org and the public website, and provides DNS for limita.org, through its global network.

Where personal data is transferred outside the EEA, we rely on the following mechanisms:

• Hetzner: no transfer outside the EEA.
• Sentry: service events are stored in its EU region in Frankfurt. Account, integration and support processing in the United States relies on the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as fallback. Canada, where Sentry Software Canada Inc. provides parts of the service and support, has a European Commission adequacy decision for commercial organisations.
• Proton Mail: encrypted mailbox content is stored in Switzerland, Germany and Norway. Switzerland has a European Commission adequacy decision.
• Cloudflare: requests are processed across its global network, including the United States. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, and its data processing addendum incorporates Standard Contractual Clauses for transfers the framework does not cover.
• PagerDuty: operational alerts are sent to its United States service region. PagerDuty, Inc. is certified under the EU-U.S. Data Privacy Framework, and its data processing addendum includes Standard Contractual Clauses.
• Stripe: processing includes Ireland and the United States. Stripe, LLC is certified under the EU-U.S. Data Privacy Framework, and Stripe’s DPA and Data Transfers Addendum include Standard Contractual Clauses.
• Visma Dinero: a Danish provider whose data-processing agreement requires Standard Contractual Clauses for transfers outside the EEA, including to its one subprocessor in the United States.

An EU storage location alone does not settle every transfer question. The provider register gives further details; contact us for information about these safeguards or how to obtain a copy.

Our security measures include HTTPS for public service connections, tenant access controls, encrypted database and monitoring storage, encrypted backups, restricted operational access, and security testing. No service can guarantee absolute security.

6. Retention and deletion

You can request the return or deletion of your workspace data by contacting privacy@limita.org.

We retain customer data while the subscription or trial is active. After subscription or trial access ends, the workspace stays readable and its time records can be exported as CSV from Timesheets until the data is deleted. The app shows how long the data remains available. Workspace data is deleted from the live service within 120 days after access ends, unless the subscription resumes before deletion.

For a board connected or transferred into an organisation after its subscription has already ended, the period starts at that later connection or transfer. Recently transferred data is not treated as if it had already been inactive in its new organisation.

You can request earlier return or deletion. This ordinary retention window does not extend the deadline for handling a valid individual rights request.

Customer data that EU or Member State law requires us to keep is retained only for that purpose and period. Separately, we may retain narrowly necessary records for our own bookkeeping or legal claims where we act as controller and have a lawful basis. That does not authorise retaining the customer’s other records against a deletion instruction.

Encrypted database backups are pruned after 30 days, and the backup storage keeps up to seven daily snapshots, so deleted data normally remains in backup copies for no more than about 37 days. Backup copies are not used for ordinary processing, and completed deletions are reapplied before restored data is returned to normal use.

For records we hold as controller, including our own support and security records, retention depends on the unresolved issue, documented security purpose or applicable legal obligation. We review whether identifiable records remain necessary and remove or minimise them when that need ends. These purposes do not override the customer-data return and deletion instructions. The platform’s operational logs have a seven-day retention setting and metrics, including the service statistics, have a 15-day setting. Sentry keeps error events for up to 90 days. Backup lifetimes are described above.

Danish bookkeeping records are generally kept for five years after the end of the relevant financial year. Specific tax rules or a documented legal claim may require a different period. These exceptions do not justify keeping unrelated time-tracking data.

7. Access, deletion and other rights

You may request access to your personal data, correction, erasure, restriction or portability, and object to processing where the relevant conditions apply. These rights can be subject to legal exceptions.

Email privacy@limita.org. Please describe your request and, where relevant, provide your Trello username or account identifier and the board or organisation involved. Never send passwords or access tokens. Do not send identity documents unless we specifically establish that further evidence is necessary.

We may ask for proportionate information to locate the records or resolve reasonable doubt about identity. We can use an existing authenticated Trello session or assistance from the relevant customer. A billing email alone does not authorise deleting an entire team’s workspace. You can still contact us if you have left the board or cannot sign in.

Where we act as processor, we forward the request to the relevant customer/controller and assist it in responding. We handle requests concerning our own controller processing directly. We respond without undue delay and within one month, subject to the permitted extension below. If an extension is necessary because of complexity or the number of requests, we explain the reason within that first month; the extension can be up to two further months.

If we cannot identify the records from the information available, we explain what additional identifier would help. We do not build an unnecessary email directory solely to identify users. If we cannot fulfil a request, we explain the reason and the available complaint and judicial remedies.

You can complain to the Danish Data Protection Agency, Datatilsynet, or another competent supervisory authority, including in your country of habitual residence, place of work or the alleged infringement.

8. Browser storage and diagnostics

The public website does not load advertising tags or Google Analytics. Cloudflare still processes visitor request data to deliver and secure the website. It processes the same kind of request data, including IP address and browser user agent, when the Power-Up loads help and onboarding clips from media.limita.org.

The Power-Up obtains authentication tokens from Trello. Browser storage is also used for interface preferences and a session identifier used in diagnostics. Sentry receives errors, breadcrumbs and relevant technical context; session replay and frontend performance tracing are disabled.

Trello’s platform and Stripe’s checkout and Link pages operate under their own notices. Any future optional tracking that requires consent will be explained and offered separately.

9. Contact and updates

Limita is not intended for children under 16. Contact us if you believe a child has provided personal data to the service.

We may update this notice to reflect service or legal changes and will communicate material changes through an appropriate service or contact channel. The date at the top identifies this version.

Privacy requests: privacy@limita.org. General support: support@limita.org.