Privacy Policy

1. Who is the controller

The controller of your personal data is IT Lab czech s.r.o., company ID (IČO) 24150975, VAT ID CZ24150975, with its registered office at Plzeňská 3350/18, Smíchov, 150 00 Prague 5, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 183337 (“we”, “us”). We operate the inbu service.

For any privacy question, write to info@untd.club. We have not appointed a Data Protection Officer, as the law does not require us to.

2. What this policy covers

The web app at app.inbu.io, the inbu app for iOS, the API and MCP interface for connecting other tools (together, the “service”), and this website, inbu.io.

3. What data we process

• Account: your email address and the name shown to others, and the date your account was created. We do not use passwords — you sign in with a one-time code or link sent by email. For sign-in codes and links we store only a fingerprint (hash), the email address, the time issued and used, and the number of attempts — never the code itself.
• Content you create: tasks, projects, folders, notes, comments, tags, lists and perspectives, dates, people assigned to tasks, task change history (who changed what and when) and activity records.
• Attachments: photos and files (e.g. PDFs) you attach to tasks, comments or notes, including their name, type, size and any metadata the file contains. The iOS app accesses your photos only when you pick a photo to upload.
• Contacts in your directory: names, emails, phone numbers, addresses, companies and notes about people you add to the directory. We do not read the contacts on your phone.
• Sharing and guests: share links (what is shared, with which permissions, expiry) and, for guests who open a share link without an account, the name they enter and their comments and photos.
• Notifications and emails: in-app notifications (e.g. that someone commented on or completed a task) and transactional emails — your sign-in code and link, and a task invitation we send to a recipient at your request (the “Send task” feature).
• API tokens: the token name, its first characters for identification, a fingerprint (hash), scopes, and the time it was created and last used. Only you see the full token, once, when you create it.
• Technical data: IP address, device and browser type, request times, sync connection details, and server operational and error logs.
• Communication with us: the content of emails you send to support.

You are the one who adds data about other people to inbu (contacts, invitation recipients, people assigned to tasks). Please make sure you are entitled to do so. We process such data only to provide the service to you.

4. Why we process data and on what legal basis

• Providing the service — your account and sign-in, storing and syncing content across devices, sharing and collaboration, attachments, notifications, transactional emails and the API. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), i.e. our Terms of Service.
• Security and operations — protection against abuse and attacks, limiting sign-in attempts, finding and fixing bugs, aggregate operational statistics (e.g. how many sign-in codes get used). Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
• Support — answering your questions and requests. Legal basis: performance of a contract or legitimate interest.
• Legal obligations and claims — where the law requires it or we need it to defend our rights. Legal basis: Art. 6(1)(c) and (f) GDPR.

If we ever wanted to use your data for another purpose (such as marketing emails), we would ask for your consent first.

5. What we don’t do

• We do not sell or rent your data.
• We show no ads and do not use your data for advertising.
• We use no third-party analytics or tracking tools and do not track you across apps and websites. The iOS app does not use the advertising identifier.
• We do not use your content to train artificial intelligence models.
• We do not carry out automated decision-making or profiling with legal effects.

6. Artificial intelligence and connected tools

inbu currently has no built-in AI features that send your content to an AI provider. If we add them in the future, they will be optional and we will update this policy in advance.

With an API token you can connect your own tool to inbu, such as an AI assistant via MCP. That tool can then read and change data within your account, and it handles the data under the terms of its provider, whom you chose. You can revoke a token at any time in the app settings.

7. Who we entrust data to

The following processors help us run the service. They process data only on our instructions and under a data processing agreement:

• Cloudflare, Inc. (USA) — running the app and API (Cloudflare Workers, Containers and Durable Objects), the sync server, website hosting (Cloudflare Pages), attachment storage (Cloudflare R2), sending emails (Cloudflare Email Service), receiving support emails (Cloudflare Email Routing) and protection against attacks.
• Neon, Inc. (USA) — the PostgreSQL database that stores your account and content. The database runs in the EU region (Frankfurt, Amazon Web Services infrastructure).

We share data with other recipients only in these cases:

• People you share with — members of shared projects and guests with a share link see content to the extent you make it available, including your name next to comments and changes.
• Apple — we distribute the iOS app through the App Store. Apple processes download data as an independent controller under its own policy. If you allow sharing analytics with app developers in iOS settings, Apple provides us with aggregate statistics and crash reports.
• Public authorities — only where the law requires it.

8. Transfers outside the EU

The database holding your content is located in the EU. Cloudflare runs a global network, so some data (e.g. when delivering a request or an email) may be processed outside the European Economic Area. Both processors are US companies. Such transfers are safeguarded by the European Commission’s Standard Contractual Clauses and, where applicable, the provider’s certification under the EU–U.S. Data Privacy Framework.

9. How long we keep data

• Account and content — for as long as you have an account. For account deletion, see the next section.
• Sign-in records (code fingerprints, times, attempts) — for the lifetime of the account; we delete them together with it.
• Technical logs — briefly, usually a few days and at most 30 days.
• Database backups — used only for disaster recovery and overwritten within 30 days at the latest. Deleted data therefore disappears from backups no later than 30 days after permanent deletion.
• Share links and guest data — until you revoke the link or it expires; guests’ comments and photos stay with the shared content until its owner deletes it.
• Support emails — for as long as needed to resolve your request and then for at most 3 years in case of legal claims.

10. Deleting your account

You can request deletion of your account at any time, directly in the app (its interface is currently in Czech) — in the iOS app via the account menu ⋯ in the header → Nastavení (Settings) → Smazat účet (Delete account); in the web app by clicking your name → Nastavení (Settings) → the Smazání účtu (Account deletion) section → Smazat účet…. You can also email info@untd.club from the address you sign in with. The steps are also on the Support page.

Right after your request:

• your account is deactivated immediately and you are signed out,
• we email you a confirmation with the date your data will be permanently deleted,
• your API tokens (REST and MCP) and the share links you created stop working.

If you sign in again within 30 days, the request is cancelled and your account is restored — including your data, API tokens and share links.

After 30 days we permanently delete:

• projects in which you are the only member, including their tasks, comments, attachments (and the stored files), change history and activity,
• your notes (with their attachments), tags and lists,
• contacts in your directory and the records of guests who joined through your share links,
• notifications, API tokens, share links, sign-in records and the account itself.

Shared projects (with at least one other member) are not deleted — their content stays available to the others:

• as the author of comments, the assignee of tasks and the actor in change history, “Smazaný uživatel” (Deleted user) is shown instead of you (the same applies to guests from your links and to mentions),
• your tags are removed from their tasks,
• if you owned a shared project, ownership passes to another member.

11. Your rights

Under the General Data Protection Regulation (GDPR) you have the right:

• of access to your data and to a copy of it,
• to rectification of inaccurate data,
• to erasure (“right to be forgotten”),
• to restriction of processing,
• to data portability — on request we provide your data in a machine-readable format (JSON),
• to object to processing based on legitimate interest.

To exercise your rights, email info@untd.club. We will respond without undue delay and within one month at the latest. So that we don’t hand your data to someone else, we may ask you to verify that the account is yours.

You also have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.

12. Cookies and on-device storage

• The web app uses a single essential cookie, inbu_session, which keeps you signed in (valid for 30 days). It stores your preferences and a local copy of your data in browser storage so the app is fast and works offline.
• The iOS app stores your sign-in token and preferences in the device’s secure Keychain.
• The inbu.io website uses no cookies. Your browser only remembers your chosen theme (light/dark) and language.

All of this is strictly necessary storage, so it needs no consent and we show no cookie banner.

13. Security

All communication with the service is encrypted (HTTPS/TLS). We store sign-in codes and API tokens only as fingerprints; codes are short-lived and have a limited number of attempts. Access to content is governed by permissions — only you and the people you share with can see it. Our infrastructure providers encrypt stored data. No security is perfect, though; if a breach ever put your rights at risk, we would let you know.

14. Children

inbu is not intended for children under 15. If we find that a younger child created an account without a parent’s or guardian’s consent, we will delete it.

15. Changes to this policy

We may update this policy, for example when we add a feature or a processor. The current version is always on this page with its effective date. We will notify you of material changes in advance in the app or by email.

16. Contact

IT Lab czech s.r.o., Plzeňská 3350/18, Smíchov, 150 00 Prague 5, Czech Republic. Email: info@untd.club.