Privacy Policy — Board Assistant

Effective from 14.May.2026

Welcome to Board Assistant Power-Up!

This Privacy Policy has been developed taking into account Our awareness of the importance and significance of Your Personal Data. Maintaining Your privacy is Our top priority. The main purpose of this Policy is to help You understand how We Process and protect Your Personal Data when You use the Power-Up.

We strive to ensure that You can use the Power-Up with confidence that Your Personal Data is properly protected and Processed in accordance with legal requirements and standards. We promise to treat any Personal Data You provide to Us with the utmost care and strive to ensure that it is stored securely.

This Privacy Policy is developed and operates taking into account the General Data Protection Regulation (GDPR), as well as other regulations and practices on the protection of Personal Data.

In order to make the most of Our Power-Up, please carefully read this Policy before using the Power-Up.

By using the Power-Up, providing any of Your Personal Data to Us, and agreeing to the terms of the Privacy Policy, You confirm that:

(I) You have read, understood, and agree to this Policy;

(II) You have reached the age from which the legislation of the country of Your stay allows You to give Consent to the Processing of Your Personal Data. In any case, in order to use the Power-Up, You must be at least 16 years old (at least 13 years old in certain regions) or one of Your legal representatives or guardians must have read and agreed to the terms of the Privacy Policy on behalf of You.

If You do not agree with these Privacy Policy, or any part thereof, please refrain from using the Power-Up.

1. For Your convenience, We use the following terms:

“Privacy Policy” – this document, which is available at the following link:https://plainandsimplesolution.com/board-assistant/privacy-policy/ (hereinafter — “Privacy Policy”, “Policy”).

“Company” – DUBYCH SINGLE MEMBER P.C., legal address: Argous 107, 21100, Nafplio, Peloponnissos, Greece, individual tax identification number (AFM): 802428980 (hereinafter referred to as “Company”, “We”, “Us”, “Our”).

“Power-Up” – a digital product developed and owned by the Company, accessible through the Trello Marketplace or directly via the following link: https://trello.com/power-ups/685016dd47b5654ae385bba6 (hereinafter referred to as “Power-Up” “Board Assistant” “Board Assistant Power-Up”).

“Trello” – a web-based project and task management platform that allows its users to create, organize, and collaborate on visual boards, lists, and cards. The Power-Up functions as an enhancement to the Trello platform, which is governed by its own Terms of Service and Privacy Policy.

“User” – any individual who accesses or interacts with the Power-Up as a result of authorizing through the Power-Up (hereinafter referred to as the “User”, “You”, or “Your”).

“Account” – a technical profile generated in the Company’s system upon the User’s authorization of the Power-Up via Trello’s OAuth mechanism. This profile is necessary to enable and manage the Power-Up’s Features for the authorized User and is not a separate User Account in the traditional sense.

“Features” – the tools and functionalities made available to Users through the Power-Up, designed to enhance productivity, streamline board management, and automate repetitive actions within Trello.

“Extended Activity Log” (EAL) – a Feature of the Power-Up that, when activated by You, records and stores detailed activity data from Your Trello boards via Trello’s official webhook mechanism, creating a persistent audit trail of board events.

“Content” – any materials, information, media, or intellectual property presented on the Power-Up. This includes, but is not limited to, text, images, graphics, videos, audio files, and any content posted on the Power-Up.

“Personal Data” — any information relating to a natural person who is identified or can be identified using this information (hereinafter — “Personal Data”, “Data”).

“Processing of Personal Data” – any operation or set of operations which is performed on Personal Data or on sets of Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (hereinafter — “Process”, “Processing”, “Processing of Personal Data”).

“Consent” — any freely given, specific, informed, and unequivocal indication of the Subject of Personal Data wishes by which he or she, through clear affirmative actions, signifies agreement to the Processing of his or her Personal Data.

“Third Party” — a legal person, public authority, agency, or body other than the Subject of Personal Data, and persons who is authorized to Process Personal Data, other services which are integrated into the Power-Up and individuals who can receive User lists or other information from the Power-Up.

“Controller” – the Company, which determines the purposes and means of Processing of Personal Data, establishes the composition of this Personal Data and the procedures for its Processing.

“Processor” – the Company or other persons that are authorized by the Controller or by law to Process Personal Data on behalf of the Controller.

“Cookies” — files that are downloaded to the User’s device when the User utilizes the Power-Up.

“General Data Protection Regulation” – European Parliament and Council Regulation № 2016/679 as of 27.04.2016 On the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter – “GDPR”).

“CCPA” – California, USA Consumer Privacy Act of 2018.

“CalOPPA” – The Internet Privacy Protection Act of 2003 of the State of California, USA.

2. Personal Data We Process when You use the Power-Up

2.1. Personal Data You provide to Us personally:

When You first access the Power-Up, You will be presented with an interface requesting that You review and accept this Privacy Policy and the Terms of use. This Consent screen ensures transparency and provides You with clear information regarding how Your Personal Data is Processed.

Only after providing Your explicit Consent can You proceed to authorize the Power-Up through Trello’s OAuth authorization system. During this authorization process, Trello explicitly displays which types of Data the Power-Up will be able to access. By confirming the authorization, You allow Us to access Your Trello Data to the extent You permit.

Upon successful authorization, Trello securely transmits the permitted Data to Us via its official API. Based on this Data, We automatically generate a User Account in Our system. No separate registration or manual creation of login credentials is required.

We collect only the Personal Data that You knowingly provide as the Subject of Personal Data. The Processing of Your Personal Data occurs based on the legal basis specified in section 5 of the Policy, and in accordance with the purposes of Processing set forth herein.

The following Data is stored as a direct result of Your actions (authorization, configuration, subscription):

• Your Trello username;
• Your email address;
• Your User avatar (as publicly available in Trello);
• date of Account creation in Our system;
• date the Power-Up was added to a Trello board;
• date of the User’s last recorded activity;
• selected subscription plan;
• Trello token allowing the Power-Up to perform automated actions on the User’s behalf within Trello.

Although the OAuth token technically grants broader access, We only access and use Trello data required to perform the specific automation tasks You enable. Unless the Extended Activity Log (EAL) Feature is activated (see section 2.2.1 below), We do not store Your card titles, card content, list names, or custom field names — even if technically accessible through the API. Our use is limited to what is necessary for the automation Features explicitly activated by You.

If You reach out via the embedded “Support” form, We Process the following Data:

• Your name,
• Your email address,
• message content.

This information is used solely for responding to Your inquiry and is not linked to Your Trello Data.

2.2. Personal Data We Process automatically

To enable the Power-Up’s automation Features, We Process certain Data automatically retrieved from the Trello API, based on the automation configurations You actively set.

This includes:

• Trello User identifiers and metadata (ID, name, avatar, last activity) — for Users involved in automation rules,
• card IDs for which automation is applied,
• IDs of boards, lists, and workspaces involved in automation,
• automation settings selected by You in the interface,
• logs of API interactions (including request metadata and IP address),
• logs of payment transactions Processed via Stripe (including request and response data, but never payment credentials).

We collect and retain this Data only when a relevant Feature is activated. While We do not actively Process such Data after the Feature is deactivated, the Data may remain stored unless explicitly deleted in accordance with Our data retention practices as provided per section 6.1 of this Policy.

2.2.1. Additional Data Processed when the Extended Activity Log (EAL) Feature is active

When You activate the Extended Activity Log Feature, We collect and store activity data retrieved from Your Trello boards via Trello’s official webhook mechanism. This includes any event data transmitted by Trello’s webhook system for the boards connected to Your subscription, which may include, but is not limited to: Trello Member IDs and display names of members involved in logged actions; card titles and card-level changes (creation, modification, movement, archiving, deletion); names of lists and boards; content of comments; label names and their changes; custom field names and changes to their values; board-level changes (such as background updates); and timestamps and action type identifiers for each logged event. The scope of collected data corresponds directly to the event types provided by Trello’s webhook API and may be updated as Trello’s platform or Our logging capabilities evolve.

This data is collected exclusively when You have enabled the EAL Feature via the dedicated toggle within the Power-Up interface. Prior to activation, You are explicitly informed about the scope of data collection through an in-app confirmation dialog. Once enabled, activity logging applies to all Trello boards connected to the Power-Up under Your active subscription plan. The legal basis for this Processing is performance of the contract (Terms of Use), specifically the delivery of the activity logging functionality You have requested and confirmed.

3. Children’s Privacy

Ensuring the privacy and safety of children online is a top priority for Us. We are committed to complying with the privacy laws, particularly concerning the protection of children’s Personal Data.

We knowingly do not Process the Personal Data of children under the age of 13 (applies to Users who are residents of countries with a reduced minimum age for Personal Data Processing) and children under 16.

If We become aware that a person who has not reached the age from which it is permitted to Process their Personal Data has provided Us with their Personal Data without the Consent of a legal representative, guardian, or other person authorized to provide such Consent, We will take all necessary measures to delete such Data. If You believe We might have any information from or about a child under 16 (or 13 if applicable), please contact Us at

board-assistant@plainandsimplesolution.com.

We disclaim any responsibility or liability in the event that a person under the legal age for Personal Data Processing begins using the Power-Up and provides their Personal Data without obtaining the necessary Consent from their legal representatives.

We further advise that Users, particularly minors, exercise caution when engaging in online activities. It is crucial to recognize the potential risks associated with online interactions and to take appropriate steps to safeguard Personal Data.

It is the responsibility of such persons or their guardians to ensure that the appropriate Consent is obtained prior to using the Power-Up. You must be of legal age to be in line with Our Privacy Policy, as well as with Our Terms of use.

4. Purposes of Personal Data Processing

We Process the Personal Data collected concerning You only for the specific and limited purposes specified below:

• Account initialization and access management: to enable Your use of the Power-Up by creating and maintaining an internal User Account based on the information received from Trello during OAuth authorization. This includes ensuring secure identification and access to the Power-Up’s Features without requiring manual registration or login credentials,
• keep things up & running (i.e., operate, deliver, and maintain Our Features): to operate, deliver, and maintain the core Features of the Power-Up, including: executing automations You configure within Trello boards, ensuring compatibility with Trello’s API, adapting to technical updates (e.g., changes in operating systems, browser environments, or Trello’s architecture).
• management and improvement of the Power-Up: all the time, We try to improve the functions that support the operation of the Power-Up. This allows Users to use the Power-Up smoothly, quickly and efficiently,
• enhance the safety and security of Our Features: We may use Your Personal Data to enhance the safety and security of Our Features, and prevent fraud or other unauthorized or illegal activity. We monitor failures of the Power-Up and create software solutions to eliminate them, detect violations of this Policy, and monitor the use, abuse and potential abuse of the Power-Up,
• User support: Personal Data Processing is utilized for providing customer support Features, including responding to inquiries, resolving issues, and facilitating communication between Users and Our support team,
• activity logging and audit trail: when You activate the Extended Activity Log (EAL) Feature, We Process detailed board activity data to provide You with a comprehensive and searchable log of actions performed within Your Trello boards. This enables teams to track changes, monitor member activity, and maintain accountability and transparency within their projects. This Processing occurs solely based on Your explicit activation of the Feature and is limited to the boards connected to the Power-Up under Your active subscription plan,
• enforce Our Terms of use: We use the Data We collect to enforce Our Terms of use, Policy and the law. This includes enforcing, investigating, and reporting conduct that violates Our Terms of use, Policy, or the law, responding to requests from law enforcement, and complying with legal requirements. In some cases, We may also use or share Your Personal Data to cooperate with law enforcement requests, escalate safety issues to law enforcement, industry partners, or others, or comply with Our legal obligations.

We do not use Your Personal Data for any purposes other than those specified in the Policy. Any further Processing of Your Personal Data will be carried out only with Your express Consent or in accordance with the requirements of the law.

5. Legal basis for Processing Your Personal Data

To Process Your Personal Data, We rely on the following lawful bases:

• performance of the contract — for the Processing of Personal Data necessary for the negotiation, conclusion, and performance of a contract (mainly, the Terms of use) with You,
• legitimate interest — for the Processing necessary for the development of Our Features, taking into consideration Your interests, rights, and expectations,
• legal obligation — for the Processing as required by applicable laws or if requested by a law enforcement agency, court, supervisory authority, or another state-authorized public body,
• Consent — where You have provided explicit and informed Consent for the Processing of Your Personal Data for specific purposes.

It’s important to note that We only Process Your Personal Data on lawful bases and will ensure that the Processing is fair, transparent, and proportionate to the purposes for which the Data is Processed. We will also respect Your rights and freedoms in accordance with applicable privacy laws.

6. Storage of Personal Data

6.1. How long do We keep Your Personal Data?

We retain Your Personal Data only for as long as it is genuinely necessary to deliver the Power-Up’s functionality, ensure legal compliance, and provide You with a smooth and secure user experience.

If You actively use the Power-Up, Your Data remains in Our primary systems for the duration of Your use. Once You stop using the Power-Up, We begin a carefully timed process: Your Data will remain in Our primary database for up to 180 days, during which time You can return and continue using the service seamlessly. This retention period may be extended if You maintain an active paid subscription, even without visible activity, in order to ensure uninterrupted access to the Power-Up Features covered by Your paid subscription. After that period, unless reactivated, Your Personal Data is permanently deleted. Additionally, encrypted backups may be retained for an additional 180 days (a total of 360 days from Your last activity), after which they are also deleted in the normal course of Our system maintenance.

This retention is managed through automated mechanisms — a background system that detects inactivity and initiates the Data deletion process accordingly. These practices help balance performance, safety, and Your right to privacy.

If You delete Your Trello account or revoke the Power-Up’s access, We delete Your Personal Data without undue delay — and in any case within 14 (fourteen) days — as required by Trello’s Power-Ups Compliance API. Backup copies may continue to exist temporarily after deletion, but only in encrypted form, excluded from any operational use, and subject to automated removal within Our standard retention cycle.

We check for such deletion and update events at least once every 14 (fourteen) days. In case of a user profile update (accountUpdated), We synchronize the relevant fields with the current User’s Trello account information.

These practices form part of Our responsibilities as an integrated third-party provider within the Trello ecosystem. You may also contact Us directly at board-assistant@plainandsimplesolution.com to inquire about or verify the status of Your data deletion request.

As for payment-related information, all transactions and payment data are securely handled by Our trusted third-party provider, Stripe. We do not store Your payment credentials or billing details on our servers. Stripe may retain certain payment records in accordance with its own legal obligations and data retention policies, which You are encouraged to review separately.

If You delete Your Account or revoke the Power-Up’s access, payment-related records — including active or past subscriptions — may continue to be stored by Stripe under its own legal obligations (such as financial reporting, fraud prevention, and tax compliance). These records are Processed under Stripe’s role as an independent data Controller and are subject to Stripe’s own privacy policy.

Deleting Your Account or disconnecting the Power-Up does not affect payment records stored by Stripe, as such Data is collected and retained independently by Stripe.

If You return to the Power-Up after deletion, We may be able to reconnect Your prior subscription if a valid Stripe customer record still exists. To request restoration, please contact Our support team and provide the customer ID associated with Your previous subscription. We will review the request and, where technically feasible, restore access under Your new Account.

This restoration process is entirely optional and depends on whether Stripe still holds the relevant Data.

At every step, We aim to minimize Data storage and preserve only what is necessary to support the core Features You rely on — nothing more.

Extended Activity Log (EAL) Data Retention: Activity log data collected via the EAL Feature is retained for as long as the Feature remains active. Once You disable the EAL Feature, all associated activity log data is permanently deleted without undue delay, and in any case within 14 (fourteen) days of deactivation. This deletion is applied regardless of Your subscription status or overall Account activity. Encrypted backup copies, if any, are also removed within the standard backup cycle (up to 180 days following deletion) and are excluded from any operational use during that period.

6.2. Where do We store Your Personal Data?

We adhere to generally accepted industry standards to protect Your Personal Data both during transmission and after receipt.

When You provide Your Data through the contact form and / or while utilizing the Features of Our Power-Up, We securely store the Data in a database hosted on Our server within Google Cloud. The server is located in the europe-west4 zone. This choice ensures compliance with high Data protection standards and regional regulations.

Additionally, daily backups of the Data are securely transferred to a virtual machine disk located in the europe-west4 zone within Google Cloud infrastructure. This ensures secure and efficient storage of backups to prevent Data loss.

To learn more about Google Cloud host zones and their operational practices, please refer to: https://cloud.google.com/compute/docs/regions-zones.

We take the protection of Your Personal Data very seriously. We take all commercially reasonable measures to prevent unauthorized access to Your Personal Data and those Data obtained in the process of using the Power-Up. Not only that, but We strive to protect Your Personal Data by various means in order to preserve its confidentiality and integrity, prevent unauthorized use or disclosure of Your Personal Data, and protect Your Personal Data from loss, misuse, disclosure, alteration, and / or destruction.

Please note that no method of Data transferring over the Internet can provide a 100% guarantee of preventing information leakage. Any transmission is at Your own risk.

6.3. Security of Your Personal Data

We have put in place appropriate security measures to prevent Your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We apply the following security measures appropriate to the possible risks:

In the event of a Personal Data breach, We are committed to responding swiftly and in accordance with applicable Data protection laws, including the GDPR and relevant local regulations, by promptly assessing the breach, notifying the relevant supervisory authority, within 72 (seventy-two) hours of becoming aware of the breach, providing all necessary details. Unless the Personal Data breach is unlikely to result in a risk to the rights and freedoms of natural persons where the notification is not made within 72 (seventy-two) hours, it could be accompanied by reasons for the delay.

By adhering to these measures, We reaffirm Our commitment to maintaining the confidentiality, integrity, and availability of Your Personal Data at all times.

7. Do We transfer Your Personal Data to third parties?

We take Your privacy seriously and treat Your Personal Data with the utmost care and responsibility. We do not sell or trade Your information, nor do We share it with any third parties for advertising or marketing purposes.

The Personal Data related to payments will be stored on servers managed by Stripe (or its affiliated entities or subprocessors), a payment processing service headquartered in the United States. Stripe stores payment Data on its secure servers located in compliance with applicable data protection laws and standards, including in the United States. You can find out more about the privacy policy of Stripe at the link: https://stripe.com/privacy.

In some instances, to ensure the proper functioning of the Power-Up, certain categories of Our employees (such as administrative staff) or third-party service providers (e.g., independent technical service providers, hosting providers, IT services, and communication services) may have access to Your Personal Data. You may request a list of such third parties from Us at any time.

We ensure that access to Your Personal Data is provided only to those third-party companies and individuals that can guarantee the highest level of data protection, confidentiality, and security, and who will use Your Personal Data solely for purposes consistent with this Policy and in compliance with applicable data protection laws. We limit the Data provided to such service providers to that reasonably necessary for them to perform their functions (a need-to-know basis).

The Company does not have access to Your Personal Data (payment card number, payment cardholder, CVV code, card validity period) that You provide to financial institutions when making payments through the websites of such institutions or with the help of widgets of such institutions placed on the Power-Up.

Authorities. We reserve the right to disclose and / or report any Personal Data of the User, if this is required by any applicable law as well as law of the European Union or another normative legal act, or a confirmed legal requirement of state authority and / or local authorities, for the purpose of compliance with the requirements of the laws of the Greece and the legislation of the European Union, protection of the integrity of the Power-Up, to fulfill the requests of Users, state authorities and / or local authorities, or for the purpose of facilitating any investigation by law enforcement agencies or an investigation aimed at guaranteeing public (national) security. In some cases, We may also provide the User’s Personal Data to the authorities of the European Union (both national and supranational) and the authorities of other countries, if such provision of Personal Data is required by law, or in the event of an official request from such an authority as part of a criminal investigation.

8. Cross-border transfer of Personal Data

We store and Process all Personal Data in the European Union, specifically within the Google Cloud infrastructure located in the europe-west4 region. This means that Your Data does not leave the EU for the purposes of hosting, storage, or internal Processing performed by Our systems.

The only exception to this geographic scope of Processing involves payment Processing, which is carried out by Stripe, a trusted third-party payment service provider. Stripe may Process certain Data related to subscription payments (e.g., billing identifiers, transaction metadata) on servers located outside the EU, including in the United States.

Payment processing is carried out by Stripe. Where Personal Data is transferred from the UK/EEA to countries outside the UK/EEA without an adequacy decision, such transfers rely on Standard Contractual Clauses and other appropriate safeguards, as described in Stripe’s Privacy Policy.

By using Our services, You acknowledge and agree that certain data necessary for payment operations may be Processed outside of Your country of residence, subject to the safeguards mentioned above. We always ensure that any such transfer is conducted in full compliance with the GDPR and that appropriate contractual or regulatory protections are in place.

We do not use analytics, tracking tools, or other third-party platforms that involve additional international data transfers. Our commitment is to Process only the minimum Personal Data necessary to deliver Our services — and to do so securely, responsibly, and transparently.

If You have any questions about international data transfers or how We protect Your Personal Data, You are welcome to contact Our support team.

We will take all necessary measures to ensure that Your Personal Data is treated securely and in accordance with this Policy.

9. How can You exercise Your right to privacy?

You, as a Subject of Personal Data, have the right to interact with Your Data directly or through a request to Us. This section describes these rights and how You can exercise them:

• right to access: You can request an explanation of the Processing of Your Personal Data, as well as details regarding the Processing activities such as the manner in which the Personal Data are Processed, the purpose for which the Processing is done, the recipients or the categories of Personal Data recipients, etc.,
• right to rectification: You have the right to obtain the correction, without justified delay, by the Company of inaccurate / unjustified Personal Data, as well as the completion of incomplete Personal Data,
• right to erasure (“right to be forgotten”): You can send Us a request to delete Your Personal Data from Our systems and / or databases. We will remove them unless otherwise provided by law,
• right to restrict the Processing: You may partially or completely prohibit Us from Processing Your Personal Data,
• right to Data portability: You can request to receive all the Personal Data You provided to Us in a structured way, commonly used and in an easy-to-read format, as well as the right for this Data to be transmitted by the Company to another Controller, to the extent that the conditions provided for by law are met,
• right to object: You may object to the Processing of Your Personal Data,
• right not to be subject to an automated individual decision: the right not to be the subject of a decision taken solely on the basis of automated Processing activities, including the creation of profiles, which produce legal effects concerning the Subject of Personal Data or similarly affect him / her in a significant measure,
• right to withdraw Consent: You can withdraw Your Consent at any time,
• right to file a complaint: If Your request was not satisfied, You could file a complaint to the regulatory body of the National Supervisory Authority for the Processing of Personal Data or competent courts, to the extent You deem necessary.

To exercise Your rights, please contact Us using the following email address:

board-assistant@plainandsimplesolution.com.

Please note that before providing the information according to Your request, We may ask You to provide additional Data to confirm Your identity. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.
In the event that We receive Your request, We will endeavor to respond as soon as possible, but no later than 30 (thirty) calendar days from the date of receipt of the request.

10. Cookies

10.1. What are Cookies?

Cookies are small text files or pieces of program code that are stored on Your device when You access and use the Power-Up. These files typically contain a unique identifier and basic information about how the Power-Up is used. Cookies are transmitted via a server and stored locally to improve functionality, maintain security, and provide a consistent user experience across sessions.

Cookies do not contain malware or spyware, cannot execute programs, and do not access other data stored on Your device. They are passive technologies used strictly for system-related purposes, helping Us to ensure that Our service runs efficiently, securely, and as expected.

Depending on their duration, Cookies can be:

• session Cookies, which are deleted once You close the Power-Up,
• persistent Cookies, which remain stored on Your device for a limited period and support consistent operation between sessions.

We use only essential (strictly necessary) Cookies, which are required to operate the Power-Up and ensure core functionality such as secure authentication, maintaining session integrity, and adapting to system environments. These Cookies do not track Your behavior and are not used for advertising or analytics.

In order to obtain additional general information about Cookies, You can check out information about HTTP Cookies, which is available at the following link.

10.2. Consent to the use of Cookies

Because We only use strictly necessary Cookies that are essential for the functioning of the Power-Up, We do not request Your prior Consent. These Cookies are exempt from Consent requirements under the EU ePrivacy Directive and applicable data protection laws, including the GDPR, as they are required for the operation of the service requested by the User.

You may, however, configure Your browser settings to block or delete these Cookies at any time. Please note that doing so may affect the availability or proper functioning of certain core Features of the Power-Up.

10.3. The types of Cookies We collect:

We use only the following category of Cookies:

• strictly necessary Cookies – these are essential to enable basic operations of the Power-Up. Without them, certain Features or services You request may not be available or may function improperly. These Cookies support session control, security Features, and load balancing, among other core functionalities.

10.4. The purposes of collecting Cookies.

The essential Cookies We use serve the following legitimate purposes:

• supporting secure and authenticated session management,
• enabling navigation and the proper rendering of interface components,
• ensuring compatibility with the User’s device and operating system,
• preventing fraudulent or unauthorized access;
• maintaining the availability and technical performance of the Power-Up.

These Cookies are necessary for delivering the Features as intended and for maintaining the stability and safety of the environment.

10.5. Services used to collect Cookies

We do not use third-party tools, plugins, or services to set or collect Cookies. All Cookies are set directly by the Power-Up and used solely for technical purposes. No external platforms (such as advertising, analytics, or tracking providers) are involved in Our Cookie-related operations.

10.6. How You can manage Cookies settings?

You can manage and control the privacy Cookies settings through Your desktop browser’s privacy or security settings.

To manage tracking and Data collection on different desktop browsers:

• For Chrome: Go to Settings > Privacy and Security > Cookies and other site data to set Your preferences for cookies and tracking data.
• For Firefox: Navigate to Settings > Privacy & Security and adjust options under Cookies and Site Data to control Data collection.
• For Safari: Go to Preferences > Privacy and configure cookie management settings according to Your preferences.

For additional information about managing website tracking and Сookie settings, You can visit Your browser’s support page.

PLEASE NOTE THAT CHANGES TO THE TRACKING AND DATA COLLECTION SETTINGS MAY RESULT IN LIMITED FUNCTIONALITY OF THE POWER-UP, WHICH COULD IMPACT YOUR USER EXPERIENCE.

11. External links

Please note that within Trello boards and cards where Our Power-Up is used, Users may include or share external links to websites, platforms, or third-party resources that are not under Our control. These links may appear in comments, descriptions, attachments, or other fields available in Trello.

We are not responsible for the content, Data practices, or privacy policies of such third-party websites or services. The inclusion of any external link does not imply Our endorsement or affiliation with the linked entity, unless expressly stated.

We strongly recommend that You review the privacy policies and terms of use of any third-party sites You visit via such links, as they may collect and Process Your Personal Data independently from Our Power-Up.

If You believe that a posted link is harmful, abusive, or violates this Policy, please contact Our support team so We may review the matter.

12. Dispute Resolution

Before filing a claim in court in disputes arising from the relationship between the User and Us, it is mandatory to submit a claim (a written proposal for voluntary settlement of the dispute). The recipient of the claim shall, within 30 (thirty) calendar days from the date of receipt of the claim, notify the applicant of the claim in writing about the results of the consideration of the claim.

In case of failure to reach a compromise, the dispute will be referred to the competent court of Greece. The Policy is governed by and interpreted in accordance with the laws of Greece.

13. Changes to the Policy

We have the right to make changes to this Policy at any time and for any reason by posting a new version of the Policy at the above link. We strongly recommend that You check the Policy and the date of the last change from time to time to stay informed of the latest changes.

If You do not agree with any changes made to the Policy, You must stop using the Power-Up, and You can also request the deletion of Your Personal Data.

Users will be notified of any planned changes to the Policy at least 15 (fifteen) days prior to the changes taking effect and, if necessary, ask for Your Consent.

14. Contact information

If You have any comments, doubts, or questions regarding this Policy, please contact Us at

board-assistant@plainandsimplesolution.com.

We will try to answer You as soon as possible, but no longer than within 30 (thirty) calendar days.

15. Additional information for residents of the United States of America

This section applies only if You are a resident of certain U.S. states that have implemented state-level privacy laws. You, as a Subject of Personal Data, have some special privacy rights. To use them, please contact Us at

board-assistant@plainandsimplesolution.com.

Please note! Depending on the state and legislative requirements, We have from 30 (thirty) to 60 (sixty) days to exercise Your request, with the right to postpone it for 30 (thirty) days more.

If Your complaint is not satisfied, You can file a complaint with the Federal Trade Commission.

Also, You may submit a complaint as follows:

• For Colorado residents, to the Colorado AG at: https://coag.gov/file-complaint/
• For Connecticut residents, to the Connecticut AG at: https://www.dir.ct.gov/ag/complaint/
• For Montana residents: https://dojmt.gov/consumer/
• For Oregon residents: https://justice.oregon.gov/consumercomplaints/
• For Texas residents: https://oag.my.salesforce-sites.com/CPDOnlineForm
• For Utah residents: https://attorneygeneral.utah.gov/contact/complaint-form/
• For Virginia residents, to the Virginia Attorney General at: https://www.oag.state.va.us/consumercomplaintform
• For residents of Florida at: https://www.myfloridalegal.com/consumer-protection/consumer-complaint-form

Your rights vary depending on the laws that apply to You, but may include:

Access to specific Data and the right to transfer Data

With certain exceptions, if You are a resident of the state of California, USA, You have the right to request a copy of the Personal Data (defined as Personal information for the purposes of this section) We have collected about You in the 12 (twelve) months prior to Your request. After receiving Your request and establishing Your identity, We will inform You of:

– categories of Personal information that We have collected about You,

– Our business or commercial purpose for collecting such Personal information,

– categories of Third Parties with whom We share this Personal information.

Also, if You are an Oregon resident, Delaware, Minnesota (effective from 31/07/2025), Maryland (effective from 01/10/2025) You also have the right to receive a list of the specific Third Parties to which We have disclosed Personal Data in Our capacity as a Controller, provided that We are not required to disclose its trade secrets.

To exercise Your rights, You may submit the request by sending an email to:

board-assistant@plainandsimplesolution.com.

We will ensure that Your request is processed in accordance with the relevant legal requirements. We may require specific information from You to help Us confirm Your identity and process Your request. You have the right not to be discriminated against for exercising any of Your rights.

Non-discrimination

We will not discriminate against You for exercising Your rights related to the Processing of Your Personal information, as well as Your right to refuse to receive Our Features in the future, or for refusing to receive further marketing, informational / advertising materials from Us.

Do not sell and share my Personal information

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to opt out of the “sale” or “sharing” of their Personal information. “Sale” refers to the disclosure of Personal information to a third party for monetary or other valuable consideration. “Sharing” refers to the disclosure of personal information for cross-context behavioral advertising.

We do not sell or share Your Personal information as those terms are defined under the CCPA and CPRA. We do not use any third-party advertising or analytics services, and We do not disclose Your Data to third parties for marketing purposes. The only third party with access to Personal Data is Our payment provider (Stripe), which acts as the Merchant of Record and processes payment data for transaction processing, fraud prevention, and legal compliance, as described in Stripe’s Privacy Policy.

If You are a resident of California or any U.S. state that grants similar rights, and You would like to ensure Your preference is recorded, You may contact us at

board-assistant@plainandsimplesolution.com. We will log Your request and confirm that Your information is not being sold or shared.

We do not collect sensitive Personal information as defined under the CCPA.

COPPA (Children Online Privacy Protection Act)

When it comes to the collection of Personal information from children under 13, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation’s consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online.

Fair Information Practices

The Fair Information Practices Principles form the backbone of privacy law in the United States, and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect Personal Data.

In order to be in line with Fair Information Practices We will take the following responsive action, should a data breach occur:

– We will notify the Users via Website notification within 7 (seven) business days.

We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data Collectors and Processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and / or prosecute non-compliance by Data Processors.

16. Additional information for residents of Canada

This section applies only to residents of Canada. The Company Processes Personal Data in accordance with the Personal Information Protection and Electronic Documents Act, Personal Information Protection Act of British Columbia, Personal Information Protection Act of Alberta, and Act respecting the protection of Personal information in the private sector of Quebec have the right to interact with its data directly or through a request to Us regarding privacy issues.

This section describes the privacy rights of Canadian residents and how they can exercise them:

To exercise Your rights, contact Us at the following email address:

board-assistant@plainandsimplesolution.com. We have 30 (thirty) calendar days to exercise Your request from the moment it is received on Our contact email.

We have the right to extend the 30-day period for providing an answer to the request for another 30 (thirty) calendar days in the event that:

• failure to respond within the initial 30 (thirty) calendar days may be considered unreasonable interference with Our business,
• We need additional time for consultation,

• We need additional time to convert the Personal Data into a format that is easy to read.

You have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) if We do not respond to Your request within the first 30 (thirty) days.

In the event of a leak of Your Personal Data, We will promptly notify You of such a case and the degree of threat to Your Personal Data. In accordance with PIPEDA, We will immediately notify the Office of the Privacy Commissioner of Canada (OPC) and keep a record of the leak that has occurred.

We may disclose Personal Data to third-party service providers and related corporations located outside of Canada for the purposes described in the Policy. The Policy requires that the Company share Your Personal Data abroad in a manner that requires the highest standards of confidentiality and security when transferring Personal Data abroad. Please note that when Personal Data is transferred abroad, it may be accessed by courts, law enforcement agencies, and national security agencies. Before disclosing Personal Data, We will assess possible risks that may adversely affect the protection of Personal Data. We ensure the appropriate level of integrity and protection of Personal Data when transferred to Third Parties, which is required by the provisions of PIPEDA, by entering into agreements with such companies, which provide for the limitation of the use of Personal Data by the Third Party solely for the purposes provided for in the agreement.

Accountability

The Company is accountable for all Personal Data in Our possession or control. We have established policies and procedures aimed at protecting the Personal Data of Users, Our clients and personnel. We have appointed a Privacy Officer to oversee privacy issues for the Company. We have also educated Our personnel about the Privacy Policy and their role in protecting the Personal Data of Users, Our clients, and personnel.

If You have questions about Our privacy practices, You are free to contact the Privacy Officer at

board-assistant@plainandsimplesolution.com.

17. Additional information for residents of Australia

This section applies only to residents of Australia. The Company Processes Personal Data in accordance with the Australian Privacy Act 1988 (“APA”) and the Data Breach Notification Guidelines (2018).

Prior to Processing Your Personal Data, the Company will inform You of the Personal Data Controller, the basis and purpose of the Processing, and whether Your Personal Data will be transferred outside of Australia. The Company will not Process “sensitive data” without Your prior Consent.

The Company will not send You marketing emails without Your Consent.

We may disclose Personal Data to third-party service providers and related corporations located outside of Australia for the purposes set out in this Policy. It is the Company’s policy that the Company shares Your Personal Data overseas in a manner that requires the strictest privacy and security standards while transporting Personal Data overseas.

In the event of a breach of Your Personal Data, We will promptly notify You of such a breach and the extent of the threat to Your Personal Data. In accordance with the APA, We will immediately notify the Office of the Australian Information Commissioner (OAIC) of such a breach.

To request information about what Personal Data We are Processing about You, please contact Us at

board-assistant@plainandsimplesolution.com.

18. Additional information for residents of Ukraine

The conditions of this section apply only to residents of Ukraine, which is contained in the Privacy Policy and relates to specific requirements, in accordance with the provisions of the legislation of Ukraine, in particular, the Law of Ukraine “On Personal Data Protection” №2297-VI dd. 01.06.2010.

Each User’s personal non-proprietary rights regarding Personal Data are inalienable and inviolable.

The User, resident of Ukraine, has the following rights in relation to the provided Personal Data:

– to know about the sources of collection, location of the provided Personal Data, purposes of their Processing, and location of the Company,

– to receive information about the conditions for providing access to Personal Data, in particular, information about Third Parties to whom Your Personal Data is transferred,

– to access his / her Personal Data,

– to receive, no later than 30 (thirty) calendar days from the date of receipt of the request, except in cases provided for by law, a response on whether his or her Personal Data is Processed, as well as to receive the content of such Personal Data,

– to submit a reasoned request to the Controller with an objection to the Processing of his / her Personal Data,

– to submit a reasoned request to change or destroy his / her Personal Data by the Company if this Data is Processed illegally or is unreliable,

– to protect his / her Personal Data from unlawful Processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision, as well as to protect against the provision of information that is inaccurate or discrediting the honor, dignity and business reputation of the User,

– to file complaints about the Processing of Personal Data to the Ukrainian Parliament Commissioner for Human Rights or to the court,

– to apply legal remedies in case of violation of the legislation on the protection of Personal Data,

– to make warnings regarding the restriction of the right to Process his / her Personal Data when giving Consent,

– if We Process Your Personal Data on the basis of the User’s prior Consent to this Processing – to withdraw the Consent to the Processing of Personal Data, after which such Processing will cease,

– if the Personal Data is exclusively Processed automatically, including profiling, which may have legal consequences for the User – to receive protection from an automated decision.

In order to exercise any of the above rights, the User shall contact the Company in writing at the following email address:

board-assistant@plainandsimplesolution.com.

The Subject of Personal Data is obliged to submit a request for access to Personal Data to the Controller, in accordance with the requirements provided for in part 3 of article 16 of the Law of Ukraine “On Personal Data Protection” №2297-VI dd. 01.06.2010. The period for examining the request for its satisfaction will not exceed 10 (ten) business days from the date of its receipt. During this period, the Controller will inform the User submitting the request that the request will be granted, or the relevant Personal Data will not be provided, indicating the grounds specified in the relevant regulatory legal act. The request shall be satisfied within 30 (thirty) calendar days from the date of its receipt, unless otherwise provided by law.

The Controller will notify the Ukrainian Parliament Commissioner for Human Rights of the Processing of Personal Data that poses a particular risk to the rights and freedoms of Personal Data Subjects within 30 (thirty) business days from the date of commencement of such Processing.