Legal Notice

Legal Notice — Maestro

This legal notice is established in accordance with French Law No. 2004-575 of June 21, 2004, on Confidence in the Digital Economy (LCEN) and applies to the Maestro service, a Trello Power-Up published by Rosace, accessible via the domain byrosace.com.

1. Publisher of the Site and Service

The Maestro service (hereinafter the "Service") is published by:

• Company name: ROSACE 19

• Legal form: Single-member private limited liability company (SARL unipersonnelle)

• Share capital: 1,000 euros

• Registration: SIREN 850 360 595 — Orléans Trade and Companies Register (RCS) No. 850 360 595

• EU VAT Number: FR33850360595

• Registered office: 4 Chemin des Fourneaux, 45190 BEAUGENCY, France

• Support / Sales contact: support@byrosace.com

• Personal data contact: privacy@byrosace.com

• Website / Domain: byrosace.com

Hereinafter referred to as "Rosace" or the "Publisher".

2. Publication Director

The publication director is: Olivier CESARO.

3. Hosting Provider

The Service is hosted by:

• Host: Amazon Web Services (AWS)

• Hosting region: eu-west-3 (Paris), European Union

• Company name and address of the contracting entity: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg

4. Contact Information

• Support / General inquiries: support@byrosace.com

• Personal data and privacy: privacy@byrosace.com

5. Intellectual Property

5.1. The trademarks "Rosace" and "Maestro", logos, as well as all content, texts, graphics, interfaces, structures, and source code of the Service are the exclusive property of the Publisher or are licensed for its use, and are protected by intellectual property laws.

5.2. Any reproduction, representation, modification, publication, or adaptation, whether total or partial, of the elements of the Service, by any means whatsoever, is prohibited without prior written permission from the Publisher.

5.3. "Trello" and "Atlassian" are trademarks of their respective owners. Maestro is a third-party Power-Up distributed through the Atlassian Marketplace and is not published by Atlassian.

6. Personal Data and Cookies

The processing of users' personal data is described in the Privacy Policy, accessible separately. For any questions regarding your data, please write to privacy@byrosace.com.

7. Terms and Conditions

The use of the Service is governed by the Terms of Sale and the Terms of Use, which are accessible separately.

8. Credits

No specific third-party credits.

Last updated: 2026-06-30

Last updated: 2026-06-30

This policy describes how the Maestro service, a Trello Power-Up published by Rosace, collects and processes users' personal data, in accordance with Regulation (EU) 2016/679 ("GDPR") and the amended French Law No. 78-17 of January 6, 1978 ("Data Protection Act").

Maestro collects the strict minimum amount of data necessary for its operation. Your data is never sold, used for advertising purposes, or shared for any purpose unrelated to the provision of the Service.

Article 1 — Data Controller

The data controller for personal data is:

• Company name: ROSACE 19, single-member SARL

• Registration: Orléans RCS No. 850 360 595 (SIREN 850 360 595)

• Registered office: 4 Chemin des Fourneaux, 45190 BEAUGENCY, France

• Personal data contact: privacy@byrosace.com

• Data Protection Officer (DPO): Michel Wieczorkiewicz — privacy@byrosace.com

• Website / Domain: byrosace.com

Hereinafter referred to as "Rosace", the "Publisher", or "we".

Article 2 — Description of the Service and Architecture

2.1. Maestro is a Trello Power-Up distributed via the Atlassian Marketplace. It connects a Trello workspace to a Rosace project management workspace and ensures the synchronization of boards, lists, and cards.

2.2. The Service is provided as a multi-tenant SaaS: each Trello workspace corresponds to a dedicated and isolated Maestro workspace (a distinct PostgreSQL database schema per tenant). This logical isolation represents one of the primary data protection measures (see Article 9).

Article 3 — Categories of Data Collected

We process the following categories of data:

CategoryDetailSourceTrello identifiers and identityMember ID, username, workspace (organization) ID, and if applicable, full name and avatarTrello (Atlassian)Trello authorization tokenOAuth token allowing actions on your behalf on Trello — encrypted at restTrello (Atlassian)Synchronized board and card dataBoards, lists, cards, checklists, and members synchronized from Trello (may contain personal data)Trello (Atlassian)Account email addressEmail address associated with the accountTrello (when provided) / registrationBilling dataCustomer, subscription, payment method (full card details are never stored by Maestro)StripeSupport dataContent of messages sent via the "Contact Us" button and associated metadataUserTechnical logsIP address, user agent, actions, administrative operationsService operation

Note: The Trello API only returns a member's email address when the account scope is granted. Maestro only requests the read scope; therefore, a member's identity is primarily keyed to their Trello identifier, and the email may be absent.

Article 4 — Purposes of Processing

Your data is processed exclusively to provide the Service, specifically:

• Authentication and linking of your account and Trello workspace to your Rosace workspace;

• Synchronization of boards, lists, and cards between Trello and Rosace;

• Subscription and billing management (customer account creation, payment collection, plan management);

• Support and assistance (handling inquiries sent via the contact button);

• Security, abuse prevention, and legal obligations (technical logging, administrative access auditing, accounting retention);

• Improvement and operational maintenance of the Service.

Your data is not used for any other purpose: no sales, no advertising, and no sharing unrelated to the Service.

Article 5 — Legal Bases

In accordance with Article 6 of the GDPR, each processing activity is based on a legal ground:

ProcessingLegal BasisProvision of the Service (authentication, linking, synchronization)Performance of a contract (Art. 6(1)(b))Subscription and billing managementPerformance of a contract (Art. 6(1)(b))Retention of accounting and tax recordsLegal obligation (Art. 6(1)(c))Security, logging, abuse prevention, administrative access auditingLegitimate interest (Art. 6(1)(f))Handling support requestsPerformance of a contract / Legitimate interestNon-strictly necessary trackers / cookies (if applicable)Consent (Art. 6(1)(a)) — see Article 10

Article 6 — Recipients and Subprocessors

Your data is accessible to authorized Rosace personnel and to the following subprocessors, each acting for a specific purpose. The complete list is as follows:

Subprocessor / RecipientRole and PurposeLocationAtlassian / TrelloPlatform on which Maestro runs; source of board and identity data; authentication provider (SSO)United States — governed by EU Standard Contractual Clauses (Atlassian Data Processing Addendum)StripePayment processing and billing managementEuropean Union (Stripe Payments Europe, Ireland); any transfer to the United States is governed by EU Standard Contractual ClausesAmazon Web Services (AWS)Hosting, computing, storage, and loggingEU — eu-west-3 region (Paris)MeilisearchSearch / indexing engine (per tenant)EU — hosted on AWS infrastructure eu-west-3 (Paris)Amazon SES (Amazon Simple Email Service)Sending transactional and support emailsEU — eu-west-1 region (Ireland)

No data is transferred, rented, or sold to third parties for commercial purposes.

Article 7 — Hosting, Residency, and Transfers Outside the EU

7.1. Data is hosted with Amazon Web Services (AWS), in the eu-west-3 region (Paris), within the European Union.

7.2. Transfers outside the EU. Processing activities performed by Rosace take place within the European Union: hosting, computing, and storage are handled by AWS in the eu-west-3 region (Paris), transactional emails are sent via Amazon SES in the eu-west-1 region (Ireland), and the payment provider Stripe processes billing data through Stripe Payments Europe (Ireland). Two subprocessors may process data outside the European Union: Atlassian / Trello (United States) — the platform from which your Trello data originates and on which Maestro runs — and, if applicable, Stripe for transfers to its US entity. These transfers are governed by appropriate safeguards pursuant to Articles 44 et seq. of the GDPR, namely the European Commission's Standard Contractual Clauses, as incorporated into these service providers' data processing agreements.

Article 8 — Retention Periods

8.1. Account and workspace data: retained as long as the subscription or trial period is active.

8.2. Trial period: the trial lasts 14 days without a credit card required. At the end of the trial, without a paid subscription, the workspace switches to a free plan (free).

8.3. Inactive free workspace: a workspace on the free plan that is inactive for 60 days (no user login) is subject to automatic deletion of its data (deletion of the schema and associated search indexes). Paid workspaces are never deleted due to inactivity.

8.4. After cancellation: following the end of a paid subscription (voluntary cancellation or non-payment), the workspace reverts to the free plan and remains usable; it is then subject to the 60-day inactivity deletion rule set out in Article 8.3.

8.5. Technical logs: purged after 90 days (by default, configurable duration).

8.6. Accounting and billing data: retained for the duration required by applicable legal obligations (notably accounting and tax obligations).

Article 9 — Security Measures

We implement appropriate technical and organizational measures, including:

• Encryption at rest of the Trello authorization token;

• Per-tenant isolation: a distinct PostgreSQL database schema for each workspace;

• Communications encryption (TLS);

• Administrative access auditing: any administrative action ("impersonation") is logged, reported to the affected user, and explicitly terminated.

Article 10 — Cookies and Trackers

10.1. The application uses session cookies strictly necessary for its operation (authentication, session maintenance).

10.2. An internal audit (reference ROS-549) confirmed that the application only sets cookies strictly necessary for its operation — anti-CSRF token, session cookie, and JWT cookie for the Mercure real-time channel (SSE) — and that no third-party trackers (analytics, advertising, or tracking) are loaded. Consequently, no cookie consent banner is required under the exemption applicable to strictly necessary cookies (CNIL guidelines). Should any non-strictly necessary tracker be introduced in the future, a consent collection mechanism would be implemented beforehand.

Article 11 — Rights of Data Subjects

In accordance with the GDPR, you have the following rights regarding your data:

• Right of access (Art. 15);

• Right to rectification (Art. 16);

• Right to erasure (Art. 17);

• Right to restriction of processing (Art. 18);

• Right to data portability (Art. 20);

• Right to object (Art. 21).

How to exercise them: by email at privacy@byrosace.com (DPO: Michel Wieczorkiewicz). We may need to verify your identity before responding. We strive to reply within 30 days.

You can disconnect Maestro at any time using the "Disconnect Maestro" action in the Power-Up, which revokes the Trello authorization token.

Article 12 — Complaints to the CNIL

If you believe that the processing of your data does not comply with regulations, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

Article 13 — Automated Decision-Making and Profiling

Maestro does not implement any automated individual decision-making or profiling producing legal effects or significantly affecting you, within the meaning of Article 22 of the GDPR.

Article 14 — Changes to this Policy

This policy may be updated to reflect changes in the Service or regulations. The date of the last update is indicated at the top of the document.

Last updated: 2026-06-30