Privacy Policy

Last updated: 2026-06-30

Privacy Policy — Maestro

Last updated: 2026-06-30

This policy describes how the Maestro service, a Trello Power-Up published by Rosace, collects and processes users' personal data, in accordance with Regulation (EU) 2016/679 ("GDPR") and the amended French Data Protection Act No. 78-17 of January 6, 1978 ("Informatique et Libertés").

Maestro collects the strict minimum amount of data necessary for its operation. Your data is never sold, used for advertising purposes, or shared for any purpose unrelated to the provision of the Service.

Article 1 — Data Controller

The data controller for personal data is:

  • Company name: ROSACE 19, single-member private limited company (SARL unipersonnelle)

  • Registration: RCS Orléans No. 850 360 595 (SIREN 850 360 595)

  • Registered office: 4 Chemin des Fourneaux, 45190 BEAUGENCY, France

  • Personal data contact: privacy@byrosace.com

  • Data Protection Officer (DPO): Michel Wieczorkiewicz — privacy@byrosace.com

  • Website / domain: byrosace.com

Hereinafter referred to as "Rosace", "the Publisher", or "we".

Article 2 — Description of the Service and Architecture

2.1. Maestro is a Trello Power-Up distributed via the Atlassian Marketplace. It connects a Trello workspace to a Rosace project management workspace and ensures the synchronization of boards, lists, and cards.

2.2. The Service is provided as a multi-tenant SaaS: each Trello workspace corresponds to a dedicated and isolated Maestro space (a separate PostgreSQL database schema per tenant). This logical isolation is one of the primary data protection measures (see Article 9).

Article 3 — Categories of Data Collected

We process the following categories of data:

CategoryDetailsSourceTrello identifiers and identityMember ID, username, workspace (organization) ID, and where applicable, name and avatarTrello (Atlassian)Trello authorization tokenOAuth token allowing actions on your behalf on Trello — encrypted at restTrello (Atlassian)Synchronized board and card dataBoards, lists, cards, checklists, and members synchronized from Trello (may contain personal data)Trello (Atlassian)Account email addressEmail address associated with the accountTrello (when provided) / registrationBilling dataCustomer, subscription, payment method (full card details are never stored by Maestro)StripeSupport dataContent of messages sent via the "Contact Us" button and associated metadataUserTechnical logsIP address, user agent, actions, administrative operationsOperation of the Service

Note: The Trello API only returns a member's email address when the account scope is granted. Maestro only requests the read scope; a member's identity is therefore primarily keyed to their Trello ID, and the email may be absent.

Article 4 — Purposes of Processing

Your data is processed exclusively to provide the Service, specifically:

  • Authentication and linking of your Trello account and workspace to your Rosace space;

  • Synchronization of boards, lists, and cards between Trello and Rosace;

  • Subscription and billing management (customer account creation, payment collection, plan management);

  • Support and assistance (handling requests sent via the contact button);

  • Security, fraud prevention, and legal obligations (technical logging, administrative access audits, accounting records retention);

  • Improvement and operational maintenance of the Service.

Your data is used for no other purpose: no sale, no advertising, and no sharing unrelated to the Service.

Article 5 — Legal Bases

In accordance with Article 6 of the GDPR, each processing activity relies on a legal basis:

ProcessingLegal BasisProvision of the Service (authentication, linking, synchronization)Performance of a contract (Art. 6.1.b)Subscription and billing managementPerformance of a contract (Art. 6.1.b)Retention of accounting and tax documentsLegal obligation (Art. 6.1.c)Security, logging, abuse prevention, administrative access auditsLegitimate interest (Art. 6.1.f)Handling of support requestsPerformance of a contract / Legitimate interestNon-strictly necessary trackers / cookies (if applicable)Consent (Art. 6.1.a) — see Article 10

Article 6 — Recipients and Subprocessors

Your data is accessible to authorized Rosace personnel and to the following subprocessors, each acting for a specific purpose. The complete list is as follows:

Subprocessor / RecipientRole and PurposeLocationAtlassian / TrelloPlatform on which Maestro runs; source of board and identity data; authentication provider (SSO)United States — governed by EU Standard Contractual Clauses (Atlassian Data Processing Addendum)StripePayment processing and billing managementEuropean Union (Stripe Payments Europe, Ireland); any transfer to the United States is governed by EU Standard Contractual ClausesAmazon Web Services (AWS)Hosting, computing, storage, and loggingEU — eu-west-3 region (Paris)MeilisearchSearch engine / indexing (per tenant)EU — hosted on AWS eu-west-3 infrastructure (Paris)Amazon SES (Amazon Simple Email Service)Sending transactional and support emailsEU — eu-west-1 region (Ireland)

No data is transferred, rented, or sold to third parties for commercial purposes.

Article 7 — Hosting, Data Residency, and Transfers Outside the EU

7.1. Data is hosted by Amazon Web Services (AWS), in the eu-west-3 region (Paris), within the European Union.

7.2. Transfers outside the EU. Processing carried out by Rosace takes place within the European Union: hosting, computing, and storage are provided by AWS in the eu-west-3 region (Paris), transactional emails are sent via Amazon SES in the eu-west-1 region (Ireland), and payment provider Stripe processes billing data via Stripe Payments Europe (Ireland). Two subprocessors may process data outside the European Union: Atlassian / Trello (United States) — the platform from which your Trello data originates and on which Maestro runs — and, where applicable, Stripe for transfers to its US entity. These transfers are governed by appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR, specifically the European Commission's Standard Contractual Clauses, as incorporated into these service providers' data processing agreements.

Article 8 — Data Retention Periods

8.1. Account and workspace data: retained for as long as the subscription or trial period is active.

8.2. Trial period: the trial lasts 14 days without requiring a credit card. At the end of the trial, in the absence of a paid subscription, the workspace switches to the free plan (free).

8.3. Inactive free workspace: a workspace on the free plan that is inactive for 60 days (no user login) is subject to automatic deletion of its data (deletion of the schema and associated search indexes). Paid workspaces are never deleted due to inactivity.

8.4. After termination: at the end of a paid subscription (voluntary cancellation or non-payment), the workspace reverts to the free plan and remains usable; it is then subject to the 60-day inactivity deletion rule set out in Article 8.3.

8.5. Technical logs: purged after 90 days (by default, configurable duration).

8.6. Accounting and billing data: retained for the duration required by applicable legal obligations (in particular accounting and tax regulations).

Article 9 — Security Measures

We implement appropriate technical and organizational measures, including:

  • Encryption at rest of the Trello authorization token;

  • Tenant isolation: a distinct PostgreSQL database schema per workspace;

  • Communications encryption (TLS);

  • Administrative access audit: any administrative operation ("impersonation") is logged, reported to the affected user, and explicitly terminated.

Article 10 — Cookies and Trackers

10.1. The application uses session cookies strictly necessary for its operation (authentication, session maintenance).

10.2. An internal audit (reference ROS-549) confirmed that the application only places cookies strictly necessary for its operation — anti-CSRF token, session cookie, and the JWT cookie for the Mercure real-time channel (SSE) — and that no third-party trackers (analytics, advertising, or tracking) are loaded. Consequently, no cookie consent banner is required under the exemption applicable to strictly necessary cookies (CNIL guidelines). Should a non-strictly necessary tracker ever be introduced, a consent collection mechanism would be implemented beforehand.

Article 11 — Rights of Data Subjects

In accordance with the GDPR, you have the following rights regarding your data:

  • Right of access (Art. 15);

  • Right to rectification (Art. 16);

  • Right to erasure (Art. 17);

  • Right to restriction of processing (Art. 18);

  • Right to data portability (Art. 20);

  • Right to object (Art. 21).

How to exercise them: by email to privacy@byrosace.com (DPO: Michel Wieczorkiewicz). We may need to verify your identity before responding. We strive to reply within 30 days.

You may disconnect Maestro at any time using the "Disconnect Maestro" action in the Power-Up, which revokes the Trello authorization token.

Article 12 — Complaint to the CNIL

If you believe that the processing of your data does not comply with regulations, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

Article 13 — Automated Decision-Making and Profiling

Maestro does not implement any automated individual decision-making or profiling producing legal effects or significantly affecting you, within the meaning of Article 22 of the GDPR.

Article 14 — Changes to This Policy

This policy may be updated to reflect changes to the Service or regulations. The date of the last update appears at the top of the document.

Last updated: 2026-06-30