Privacy Policy

This privacy policy explains how d1 group, e-business GmbH (‘Teamwide’, ‘we’ or ‘us’) processes personal data when you visit teamwide.app, use an account or workspace, communicate with us or interact with Teamwide through a board, sharing link or invitation.

1. Controller and contact

2. Scope and data protection roles

For account, contractual, website, security and support data, we determine the purposes and means of processing and act as controller.

When a customer uses Teamwide to create, store or share boards and collaborate in a workspace, the customer generally determines the purpose and essential means of processing. For personal data in this content, we generally act as their processor or subprocessor. The terms governing processing on behalf of the customer are set out in our DPA. We publish our current Subprocessors separately.

Questions about the legal basis, origin or deletion of content on a customer's board should generally first be directed to the customer or the person responsible for the workspace.

3. Categories of personal data

Depending on use, we process in particular:

• Account and identity data: name, business email address, organisation, workspace memberships, role, settings and language;
• Authentication and security data: password hash, recovery and session events, multi-factor configuration where applicable, login times, IP address, browser and device information, and security events;
• Contractual and billing data: plan, allowances, billing address, billing email address, company and tax details, and invoice and payment status where billing is agreed;
• Communication data: content and context of support, sales, security and other correspondence;
• Collaboration and configuration data: board permissions, sharing links, invitations, comments, presence and change information, integrations, API credentials and encrypted credentials for AI providers;
• Usage and log data: pages and functions accessed, API and MCP requests, tool calls, timestamps, status, technical errors, latencies, assignment identifiers and audit events; and
• Board and agent data processed on the customer's behalf: text, notes, shapes, connections, images, files, collections, exports, agent configurations, instructions, chat histories, responses, tool results and runtime metadata.

For online payments, Stripe also processes full payment information, such as card or bank details, and fraud prevention information. We generally receive and store only limited payment references and status data, not full card numbers or card verification codes.

Only submit special categories of personal data or secrets where necessary for the purpose and where an appropriate legal basis exists. When assessing suitability, consider public board sharing and external AI processing in particular.

4. Data sources

We receive data directly from you, from administrators or members of your workspace, automatically when the website and service are used, from connected applications and integrations, and from infrastructure, payment and AI providers used to provide the services.

5. Purposes and legal bases

We process personal data for the following purposes:

• concluding contracts, administering accounts and providing services under Article 6(1)(b) GDPR;
• managing contacts, workspaces, roles and permissions under Article 6(1)(b) and (f) GDPR;
• billing, accounting and documentation required by tax and commercial law under Article 6(1)(b) and (c) GDPR;
• support, troubleshooting, product operation and improvement under Article 6(1)(b) and (f) GDPR;
• authentication, misuse and fraud prevention, IT security and stability under Article 6(1)(f) GDPR and applicable legal obligations;
• enforcing and defending legal claims under Article 6(1)(f) GDPR; and
• communication or processing based on consent under Article 6(1)(a) GDPR where we expressly obtain it.

Our legitimate interests lie in the secure and reliable operation of a collaboration platform, protecting customers and users, preventing misuse and maintaining traceable administration of our business relationships.

6. Required information

Mandatory information at registration and contract formation is necessary for use. Without necessary account, contact, security or billing data, we cannot provide an account or certain services. The customer decides which board content, files and agent instructions to supply within technical and legal requirements.

7. Cookies, local storage and fonts

Teamwide uses technically necessary session and account-selection cookies for login, the active workspace, CSRF protection and, where applicable, access to password-protected board shares. The production session cookie is protected with Secure, HttpOnly and SameSite=Lax. Settings such as appearance and drawing tools may be stored locally in the browser. Where necessary for an expressly requested function, this is based on section 25(2), no. 2 of the German TDDDG. When you choose a language, Teamwide stores it in a technically necessary preference cookie so your selection remains available on future visits.

We do not use advertising cookies or non-essential analytics cookies. For embedded payment functions, Stripe may process technically necessary connection data and fraud prevention information. Cloudflare processes technical connection and security data to protect and deliver the application. Public marketing pages use Owondo for page-view and usage statistics. Loading the script and sending events to in.owondo.com involves processing technical connection data. No analytics cookies are used. Form, revenue, download, outbound-link and custom events are disabled.

Fonts are delivered together with the website from our own infrastructure. No requests are sent to Google Fonts or rsms.me to display fonts.

8. Recipients and service providers

Within our company, only people who need access for operations, support, billing, security or legal obligations receive it. Other recipients may include:

• the hosting, network, security, email and, where applicable, AI service providers described in the Subprocessors list;
• Stripe for payment processing, subscription and invoice management, and fraud prevention;
• members and administrators of the relevant workspace, recipients of board shares, and integrations and model providers selected by the customer;
• tax advisers, lawyers, insurers and other advisers subject to professional confidentiality obligations;
• authorities and courts where required by law, under a valid order or as necessary to defend legal claims; and
• potential purchasers or legal successors as part of a corporate transaction, subject to appropriate confidentiality and data protection safeguards.

We do not sell personal data or disclose it for behavioural advertising.

9. Locations, AI and international transfers

The app, database and file storage run on our servers at Hetzner in Falkenstein, Germany. We also operate the Agent Runner and Firecrawl for web research there ourselves. We use our own operational services for email notifications. The location of our servers does not mean that all processing by external providers takes place exclusively in Germany or the EU.

Cloudflare operates a worldwide network. Stripe and enabled AI providers may process data outside the European Economic Area (EEA). Depending on the provider and processing, necessary transfers rely on an adequacy decision, the European Commission's standard contractual clauses and supplementary safeguards. Information is linked on the Subprocessors page.

AI functions use the API keys you supply yourself. There is no shared Teamwide default key for model calls. Depending on your configuration, instructions, chat histories and board content accessible within the permissions may be transferred to your chosen provider. Teamwide does not pass your content on for AI training. Your agreements with your provider govern their processing, particularly retention and possible use for training.

Enabled search and retrieval tools process search queries and destination addresses. Retrieving external content establishes connections to the relevant websites. The customer controls use through agent, tool and provider settings.

10. Retention periods

Account data, boards, files, shares and saved agent chats are generally stored for the duration of the account or workspace and the relevant use. Cancelling a subscription alone does not delete the workspace; it becomes read-only after the paid period ends.

When content, accounts or workspaces are deleted, we remove the relevant data from active systems through our technical deletion processes unless statutory retention obligations or legally required holds prevent this. Backup copies may remain until regularly overwritten. Billing records are retained for the statutory periods under commercial and tax law. We retain security and legal records only as long as necessary for investigation, protection or legal defence.

We cannot delete data already exported, copied or retrieved through sharing from recipients' systems. Further storage by external AI providers depends on the selected configuration and their contractual terms. For questions about specific deletions, contact [email protected] .

11. Security

We implement technical and organisational measures appropriate to the risk. These include access checks based on account, role and board sharing permissions, protected credentials, optional two-factor sign-in, encrypted transmission, encryption of stored AI API keys, log filtering, deletion functions and ongoing data backups to our own servers in the cluster. Further details are set out in the TOM annex to the DPA.

No transmission or storage system is entirely risk-free. Customers must appropriately protect devices, credentials, API keys, integrations and shares and report suspected unauthorised access immediately.

12. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect.

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.

To exercise your rights, write to [email protected] . We may request information necessary to verify your identity and entitlement.

13. Requests concerning customer boards and workspaces

For personal data processed by a customer in a board, comment or agent chat, first contact that customer with questions about origin, legal basis, rectification or deletion. If you contact us, we may request information to identify the board or workspace and forward your request in accordance with our legal obligations. You may contact us directly about your own account and contractual data.

14. Automated decisions

We do not make decisions about individuals based solely on automated processing that produce legal effects or similarly significantly affect them. Automatic security and misuse signals may trigger technical protective measures; significant account measures may be reviewed on request.

15. Right to complain

You have the right to complain to a data protection supervisory authority. The competent authority for us is, in particular, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. You may also contact the supervisory authority for your habitual residence, workplace or the place of the alleged infringement.

16. Changes to this privacy policy

We update this policy when our processing, services or legal requirements change. The current version is available at teamwide.app/privacy. We also provide appropriate notice of material changes.