This policy explains what personal data Retrocycle (https://retrocycle.app) collects, why, who it is shared with, how long it is kept and what your rights are.
1. Who is responsible
Retrocycle is operated by Tiago Carvalho, sole trader (empresário em nome individual), NIF 230589685, Rua José Régio 68, 7.1, 4425-111 Águas Santas, Maia, Portugal ("we", "us").
Contact for anything about your data: [email protected].
We are the controller for account, billing-status and technical data. For the content your team puts into retros (cards, comments, action items), we process it on behalf of the team that owns it (see section 8).
2. What we collect
| Data | From whom | Why | Legal basis (GDPR) |
|---|---|---|---|
| Email address, password (stored only as a hash), display name | Account holders | Create and secure your account, sign you in, send account emails | Contract (Art. 6(1)(b)) |
| Google account email and name, if you choose "Continue with Google" | Account holders | Sign you in | Contract |
| Teams you belong to, your role, join requests | Account holders | Run the team features | Contract |
| Retro content: cards, votes, comments, action items, links you paste, report summaries | Account holders and guests | Provide the service | Contract (for account holders); on behalf of the team (see section 8) |
| Guest display name and a temporary guest session | Guests (no account) | Let you take part in a retro you were invited to | Legitimate interest of the inviting team (Art. 6(1)(f)) |
| Plan, subscription status and dates, Stripe customer reference | Pro subscribers | Give you Pro features and keep them in sync with your payments | Contract |
| Feedback you send us through the app | Any user | Improve the service and answer you | Legitimate interest |
| Emails you send to [email protected] | Anyone | Answer you | Legitimate interest / contract |
| Technical data: IP address, browser type, timestamps, rate-limit counters, security logs | Everyone | Keep the service secure, stop abuse and bots | Legitimate interest |
We do not collect payment card details: payments are handled by Stripe (section 4). We do not use advertising trackers or sell personal data. We do not use analytics cookies.
When you sign up we record which site or page brought you to Retrocycle (for example a search engine or a link), to understand which channels work. We don’t use cookies for this.
3. Cookies and local storage
We only use what is strictly necessary for the service to work:
- Local storage in your browser to keep you signed in (account or guest session) and remember simple preferences.
- Cloudflare Turnstile on sign-up, sign-in and password-reset forms, to check you're not a bot. Turnstile processes technical signals from your browser for this purpose only.
Because these are strictly necessary, no consent banner is needed. Fonts are served from our own domain; we don't load Google Fonts.
4. Payments
Pro subscriptions are sold through Stripe's Managed Payments: Stripe, acting through Link (Stripe Payments Europe / Stripe Technology Europe Ltd, Ireland, and affiliates), is the reseller and merchant of record for your purchase. Link collects your payment details, billing address and, if relevant, your VAT number; it charges VAT, issues receipts and invoices, and handles payment support and refunds. Link processes that data as an independent controller under its own privacy policy (https://link.com/privacy).
We receive from Stripe only what we need to run your plan: a customer and subscription reference, the subscription status and period dates, and payment success or failure.
5. Who we share data with (processors)
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Database, authentication, file-free backend functions | EU (Stockholm, Sweden) |
| Cloudflare Inc. | Website hosting and delivery, Turnstile bot protection, Web Analytics (visit counts), receiving email to [email protected] | Global network; US company |
| Brevo (Sendinblue SAS) | Sending account emails (confirmation, password reset, security notices) | EU (France) |
| Microsoft (Outlook.com) | Our support mailbox: messages to [email protected] are forwarded there | EU/US |
| Stripe / Link | Payments, as independent controller (section 4) | EU/US |
| Only if you choose "Continue with Google"; independent controller for your Google account | Global |
We use Cloudflare Web Analytics to count visits. It doesn’t use cookies or track you across sites, and we only see aggregated numbers.
Where a provider processes data outside the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
We may also disclose data if the law requires it.
6. How long we keep data
| Data | Kept for |
|---|---|
| Account data and the teams, retros and content you own | Until you delete it or delete your account |
| After account deletion | Your account and the teams you own are deleted immediately. We keep only your email address and deletion date for 90 days (to match support requests or payment disputes), then erase the email |
| Guest data | As long as the retro it belongs to exists |
| Data export files you request | Removed after 1 day |
| Rate-limit and anti-abuse records (join attempts) | 1 day |
| Subscription and payment references | As long as your account exists; invoices and payment records are kept by Stripe/Link as the law requires |
| Feedback and support emails | Until resolved, and no longer than 24 months |
| Backups | Rolling backups kept by Supabase for up to 7 days |
7. Your rights
You can, at any time:
- access and export your data — self-service under Account → Download my data;
- correct your name and email in your profile;
- delete your account — self-service under Account → Delete account;
- object to processing based on legitimate interest, or ask us to restrict it;
- ask any question or exercise any right by writing to [email protected]. We answer within one month.
You can also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or the authority in your own EU country.
8. Content about other people
Retro content is written by your team and may mention colleagues. The team that owns a retro decides what goes into it and who is invited; for that content we act on the team's behalf (as a processor) and only use it to provide the service. Teams are responsible for using Retrocycle in line with their own organisation's rules. A data processing agreement is available on request at [email protected].
9. Security
Data is encrypted in transit (HTTPS) and at rest. Access to data is limited by row-level security rules in the database; guests only see the retros they were admitted to. Passwords are never stored in plain text. If a breach puts your data at risk, we will notify the authority within 72 hours and inform you without undue delay where required.
10. Children
Retrocycle is a tool for professional teams and is not intended for anyone under 16.
11. Changes
If we change this policy in a way that matters, we will tell account holders by email or in the app before the change applies. The date at the top shows the latest version.