Privacy notice

Who we are

Plumeboard is made by Abreu Data Systems, Portugal, the controller responsible for this website, Plumeboard Desktop and Plumeboard Cloud.

Questions about this notice or your data? Contact us through abreudatasystems.com.

This website

• No cookies, no analytics. This is a static website. It sets no cookies and runs no analytics or tracking scripts. If we ever add statistics, we will use a cookieless, privacy-friendly tool and update this page first. See the cookies page.
• Hosting. Like any web server, our hosting provider may record technical data such as IP addresses in its logs, to keep the site secure. Those logs are deleted automatically after a short period.
• Downloads. The Desktop installer is downloaded from this website. We do not ask for any personal data to download it.

Plumeboard Desktop

• It runs on your computer. Everything you write — boards, cards, comments, attachments — is stored in a JSON file on your own disk (%LOCALAPPDATA%\Plumeboard\dados), with daily backups next to it.
• Only you can reach it. The built-in server only accepts connections from 127.0.0.1, your own computer. Nobody on your network or on the internet can connect to it.
• No account, no analytics, no tracking. Plumeboard Desktop sends nothing to us. We never see or receive your boards or anything about how you use the app.
• Optional extra backup. If you set a synced folder (for example Google Drive) in config.json, Plumeboard also copies its backup there. This is off unless you configure it, and that provider's own terms and privacy policy then apply to the copy.
• Checking for updates (optional, coming). A future version will offer an optional update check. If you turn it on, the app asks our website for the latest version number once a day. Only the standard technical information of any web request is involved — your IP address and the app version. No board content is sent. You can turn it off at any time.
• Trello import. Importing reads the exported file on your computer. Nothing is uploaded.

Plumeboard Cloud: what we collect

• Account data: your name, email address, password (stored only as a secure hash — we never see it), account creation date, last sign-in, plan and language.
• Your content: the boards, lists, cards, comments and attachments you create.
• Security logs: sign-ins and failed sign-in attempts, with IP address, browser and date.
• Optional usage statistics: only if you opt in — anonymous counts of actions (for example, how many cards were created). Never the content of your boards.

Your content is private. Abreu Data Systems staff and administrators do not view your boards. Your content is only processed automatically to provide the service (storing it, showing it to you, searching it, backing it up) and accessed only when we are legally required to.

Connecting your Google or Microsoft account (optional)

In Plumeboard Desktop and Plumeboard Cloud you can choose to connect a Google or Microsoft account in Settings › Connectors. This is off unless you turn it on, and Plumeboard only accesses what each feature needs:

• Google: only the Google Calendar calendars that Plumeboard itself creates (a calendar named "Plumeboard" with the due dates of your cards), plus your email address to show which account is connected. Plumeboard cannot see your other calendars, your email or your files.
• Microsoft: your email (to read the unread messages of the folder you choose and turn them into cards, mark them as read, and send your daily reminder from your own mailbox) and your calendar (a calendar named "Plumeboard" with the due dates of your cards).
• Where the authorization is kept: the access tokens are stored encrypted — on your own computer in Plumeboard Desktop, or on our server in the European Union in Plumeboard Cloud. They are never shown in the app or shared with anyone.
• Use: the data is used only to provide these features to you. We do not use it for advertising, we do not sell it, and we do not use it to train AI models. Nobody at Abreu Data Systems reads it.
• Revoking: you can disconnect at any time with "Disconnect the account" (which deletes the stored tokens and, for Google, also revokes the access), and you can remove the access from your Google or Microsoft account settings.

Plumeboard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Why we use it (legal bases)

• To provide the service you signed up for — your account and your content. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
• To keep accounts and the service secure — security logs, preventing abuse and unauthorised access. Legal basis: our legitimate interest in protecting you and the service (art. 6(1)(f)).
• To improve Plumeboard — optional anonymous statistics. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time in the settings.
• To meet legal obligations — for example billing and tax records for Plumeboard Pro subscriptions, or answering a lawful request from the authorities (art. 6(1)(c)).

We do not show ads, we do not sell or rent personal data, and we do not use it for profiling.

How long we keep it

• Account data and content: for as long as your account exists. When you delete your account, they are removed from the service straight away and from our backups within 30 days.
• Security logs: 12 months, then deleted.
• Usage statistics: kept only as anonymous totals.
• You can ask us to delete your data at any time (see "Your rights").

Payments (Plumeboard Pro)

Plumeboard Pro is sold by Abreu Data Systems. Online payments are collected by EMMA, our payments partner, with Stripe's technology. You enter your card or bank details on Stripe's secure checkout page, and Stripe processes them under its own privacy notice; we never see or store them. If you get a licence by contacting us instead (for example to pay by bank transfer), we only use your name, email address and billing details to issue the licence and the invoice.

• What we receive about payments: only your name, email address, country, plan, subscription status and the Stripe customer and subscription identifiers. We never receive or store your card or bank details.
• Why: to activate Plumeboard Pro on your account, send your Desktop licence key and manage your subscription. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
• How long: subscription data for as long as your subscription or account exists; billing records for as long as required by law (for example tax and accounting rules).

Who helps us (processors)

We use a small number of service providers who process data only on our instructions, under a data processing agreement:

• Hosting: our hosting provider in the European Union, which stores the service and its backups (to be named here before launch).
• Email: an email provider to send account emails such as password resets (to be named here before launch).
• Payments: EMMA, our payments partner, collects payments for Plumeboard Pro with Stripe's technology. Stripe processes payment data under its own privacy notice — see "Payments (Plumeboard Pro)" above.

International transfers

Your data is stored in the European Union. Apart from payment data (see below), no transfers outside the EU/EEA are planned. If that ever changes, we will only do it with appropriate safeguards required by the GDPR (such as an adequacy decision or standard contractual clauses) and update this notice first.

Stripe, which processes online payments, may process payment data outside the EU, with appropriate safeguards (such as standard contractual clauses).

How we protect it

• Passwords are stored only as secure hashes.
• All connections are encrypted (HTTPS).
• Access to the systems is limited to the few people who need it to run the service, and is logged.
• Regular backups, kept in the European Union.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. In Plumeboard Cloud you can export your data and delete your account yourself in the settings; for anything else, contact us through abreudatasystems.com. We answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).

For Plumeboard Desktop we hold no personal data: you are in full control and can delete the data folder at any time.

Children

Plumeboard is a general-purpose tool. Plumeboard Cloud is not intended for children under 16 without the consent of a parent or guardian. If you believe a child has created an account without that consent, contact us and we will delete it.

Changes to this notice

If anything here changes, we will update this page and the date below. For important changes that affect Plumeboard Cloud accounts, we will also let you know by email or in the app before they apply. See also the Terms of Service and the Updates page.