Privacy policy

Rowclerk for Trello® · Effective 2026-11-01 · Version 1 · Change history

Summary

• Who is responsible: Zsombor Mátyás Kispéter, a private individual in Hungary who runs Rowclerk (“we”, “us”). We are the data controller for Rowclerk for Trello® (“Rowclerk”) and this website. Rowclerk, not Atlassian or Google, is responsible for the add-on and for this policy.
• Your boards stay between Trello® and your sheet. Your browser fetches your Trello® data directly from Trello®, and the add-on writes it only into the Google Sheets™ spreadsheet you use it in. Our servers never receive your Trello® data, your Trello® token or your spreadsheet content.
• What our servers see: a random install ID, your licence key and plan choice if you buy, the technical request data that any web server sees (such as your IP address) and, after a purchase, the buyer details in Creem’s replies, which our licence service uses only to check your plan and doesn’t store. We keep no logs of it.
• No cookies, no analytics scripts, no trackers, no ads: only anonymous daily totals of five events (section D). We never sell personal data. Rowclerk has no AI features.
• Payments: Creem (Armitage Labs OÜ, Estonia) sells paid plans as merchant of record and handles your payment data as an independent controller.
• Your rights: access, correction, deletion and more. Write to privacy@rowclerk.com. We answer within one month. You can complain to the Hungarian data protection authority, NAIH (section 11).

Contents

1. Who we are
2. How Rowclerk works
3. What we process, why, and for how long
4. Google user data
5. Cookies and similar technologies
6. Who receives your data
7. Transfers outside the EEA
8. How long we keep data
9. Your rights
10. How to use your rights
11. Complaints
12. Children
13. Security and data breaches
14. Where this policy applies
15. Changes to this policy

1. Who we are

We have not appointed a data protection officer. We are not required to: we don’t monitor people on a large scale and don’t process special categories of data (GDPR Art. 37).

2. How Rowclerk works

Rowclerk is a Google Sheets™ add-on. Its sidebar runs in your browser, inside Google Sheets™, in your Google account.

• Trello® data: the sidebar fetches your boards from Trello®’s servers (api.trello.com) with your read-only Trello® token, and passes the data to the add-on’s code, which writes it into the current spreadsheet. This happens between your browser, Trello® and Google. Nothing passes through our servers.
• Connecting Trello®: Trello® shows its own authorization screen. Afterwards it sends your token to a page on rowclerk.com in the part of the web address after “#”, which browsers never send to any server. That page hands the token to your sidebar and removes it from the address bar. It doesn’t store or send the token anywhere else.
• Licences: to start a checkout, activate a licence or check that it is still valid, the sidebar talks to our licence service at api.rowclerk.com. That service talks to Creem, our merchant of record, and returns a signed licence status to the add-on.

3. What we process, why, and for how long

Do you have to give us data?

No law requires you to give us personal data. To sync, you must connect Trello®. To buy a plan, you must give Creem the checkout details it asks for, and the add-on sends us your licence key. Without them, those features can’t work. Emailing us is voluntary.

A. Our website

• Data: when you visit rowclerk.com, your browser sends its IP address, browser type, the page requested and the time, as with any website.
• Why: to deliver the pages and protect the site against abuse and attacks.
• Legal basis: our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).
• Kept for: we keep no request logs of our own. The site uses no cookies, no analytics, no third-party scripts and no third-party fonts or images. Our host, Cloudflare, processes this data for us as our processor (section 6).

B. Add-on data in your Google account

The add-on keeps the data it needs in your own Google account. We have no access to it from our side: it isn’t sent to us, and we can’t read, change or delete it remotely.

• In the add-on’s storage for your Google account (Apps Script user properties): your Trello® token, a random install ID created by the add-on, your licence key and signed licence status if you have a paid plan, and the date your trial started.
• In the spreadsheet: the tabs Rowclerk creates and the board data synced into them, hidden tags that mark Rowclerk’s tabs, and the add-on’s settings for that spreadsheet (the boards you chose, with their names, and the times of the last syncs).
• Other people’s data: your boards may contain other people’s names and usernames, for example card members. Rowclerk copies them only into your spreadsheet. Who can see that spreadsheet is up to you.
• Your Trello® connection: when you connect, Trello® (Atlassian) records that you authorized Rowclerk with read-only access, and your browser’s requests to Trello® reach Atlassian’s servers. Atlassian handles this as the provider of your Trello® account, under its own privacy policy. Rowclerk only reads boards. It stores no Trello® data and no Trello® token on our servers: the only places they are stored are your spreadsheet and your Google account. Google decides in which countries it stores the data in your Google account; see Google’s privacy policy.
• Why: to sync your boards, remember your settings and unlock the features of your plan.
• Legal basis: performance of our contract with you, i.e. providing the add-on you installed (Art. 6(1)(b)).
• Kept for: the Trello® token until you click Disconnect Trello® in the sidebar, which revokes it at Trello® and deletes it from your Google account. The licence key and licence status until the add-on finds that your plan has ended. The install ID and the trial start date stay in the add-on’s storage for your Google account, so that the trial can be used only once; they hold no name or email address, and we can’t read them. Synced data stays in your spreadsheet until you delete the tabs or the spreadsheet. The support page explains how to remove the add-on and its access.

C. Licence service (api.rowclerk.com)

• Data: the add-on’s random install ID (it contains no name or email), your licence key, the plan you choose, the checkout ID, and the technical request data Cloudflare sees for every request, such as your IP address and browser type. When it checks a completed checkout or your subscription, Creem’s answer also contains the name and email address you gave Creem. The service uses only the plan, the subscription status and the licence key from it, and doesn’t store, log or pass on the rest. It never receives Trello® data, spreadsheet content, spreadsheet IDs or any data from your Google account.
• Why: to create a checkout for the plan you choose, activate your licence, check once a day that your subscription is still active, and open Creem’s customer portal. We pass the install ID and licence key to Creem, so that your purchase is linked to your installation and a licence works only in a limited number of Google accounts.
• Legal basis: performance of the contract (Art. 6(1)(b)).
• Kept for: our licence service has no user database, and its logs are turned off, so we don’t store this data. Creem keeps the install ID with your licence as part of its order records (section E).

D. Usage counts

• Data: the add-on tells our licence service when one of five things happens: the sidebar opened, a sync finished, a trial started, a checkout opened, a licence was activated. The service adds one to that day’s total. The message contains only the event name: no install ID, no IP address and no other identifier is stored, and nothing is stored on your device.
• Why: to see which features are used and whether something is broken.
• Legal basis: our legitimate interest in improving Rowclerk (Art. 6(1)(f)). The totals don’t identify anyone.
• Kept for: the daily totals are not personal data and have no fixed expiry. The request itself is handled as in section C.

E. Purchases through Creem

• Creem (Armitage Labs OÜ, Estonia) is our reseller and merchant of record. It sells you the subscription and handles checkout, payment, tax, invoices and refunds as an independent controller, under its own privacy notice. We never see your card details.
• Data we receive from Creem: in Creem’s merchant dashboard we can see your name, email address, country and billing details, your order and subscription, your licence key and the payment status. Our licence service also sees your name and email address in Creem’s replies, without storing them (section C).
• Why: to deliver and check your licence and answer your questions.
• Legal basis: performance of the contract (Art. 6(1)(b)), or our legitimate interest in supporting customers (Art. 6(1)(f)).
• Kept for: we don’t copy buyer details out of Creem. They stay in Creem’s systems under its privacy notice, and we look at them only to deliver your licence or answer you. If you write to us, section F applies. Our own tax records are Creem’s statements and self-billed invoices, which show totals, not buyer details. We keep them for 8 years from the end of the year of the sale (Hungarian tax law).

F. Support and feedback

• Data: your email address, your name if you give it, your message and attachments, and any details you send us, such as your plan or an error message.
• Who reads it: the operator of Rowclerk, personally. Email to our rowclerk.com addresses is forwarded by Cloudflare Email Routing and delivered to our mailbox, which is hosted by Google (Gmail). Our replies are sent through Brevo’s email service (section 6). To decide what to improve, we keep only anonymized summaries, without names, email addresses or order numbers.
• Why: to answer you and fix problems.
• Legal basis: contract if you are a customer (Art. 6(1)(b)), otherwise our legitimate interest in answering you (Art. 6(1)(f)). Written consumer complaints: legal obligation (Hungarian consumer protection act, Fgytv. 17/A. §, Art. 6(1)(c)).
• Kept for: 24 months after the conversation ends. Formal complaints and our answers: 3 years.

4. Google user data

Rowclerk for Trello®’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

What Rowclerk asks Google for

• Only the current spreadsheet (spreadsheets.currentonly): access to the spreadsheet in which you open Rowclerk, and no other file.
• The sidebar (script.container.ui): permission to show Rowclerk’s sidebar inside Google Sheets™.

Rowclerk doesn’t ask for your email address, your contacts, your other files or any other Google data.

How Rowclerk uses it

• It creates its own tabs in the current spreadsheet, writes the synced Trello® data and the tab metadata (headers, formats and hidden tags that mark its tabs) into them, and stores the add-on’s settings for that spreadsheet.
• To do that, it reads only what it needs: the names of the tabs (so new tab names don’t clash), its own hidden tags, the header rows of its own tabs, recent rows of its own History tab, and the spreadsheet’s time zone. It doesn’t read the content of your other tabs.
• It uses the add-on’s storage in your Google account for the data listed in section B.

What Rowclerk never does with it

• Google user data is used only to provide Rowclerk’s sync feature that you see and use.
• It is never sold, never used for advertising, never used to build user profiles, never used to determine creditworthiness or for lending, and never used to train AI or machine-learning models.
• It is never transferred to us or to anyone else, except as necessary to provide the feature, for security purposes, or to comply with the law. In practice it stays in your Google account: our servers receive no spreadsheet content, no spreadsheet IDs and no data from your Google account, such as your Google email address.
• No human reads it. We have no access to it.

Storage, retention and deletion

Google stores this data in your Google account, under your agreement with Google. Delete Rowclerk’s tabs or the spreadsheet to delete the synced data, and click Disconnect Trello® to delete the Trello® token. The install ID and the trial start date stay in the add-on’s storage (section B). Remove Rowclerk’s access in your Google Account to stop the add-on (steps on the support page).

5. Cookies and similar technologies

This website sets no cookies and stores nothing on your device. The add-on stores no cookies of its own. Google Sheets™ and Trello® use their own cookies under their own policies.

6. Who receives your data

We use these service providers as our processors (GDPR Art. 28). They process data only on our instructions, under the terms shown in the table.

These organizations process data as independent controllers, under their own terms and policies:

• Creem (Armitage Labs OÜ, Rotermanni 14, 10111 Tallinn, Estonia): sells paid plans as merchant of record and processes buyer and payment data. We send it your install ID, licence key and plan choice (section C). Privacy notice.
• Google: the add-on runs in your Google account, and Google stores the add-on’s data and your spreadsheet there under your own agreement with Google. Google is not our processor for this. Google also hosts the mailbox where our support email arrives (section F). Privacy policy.
• Atlassian (Trello®): provides your Trello® account and answers your browser’s requests for board data. Privacy policy.

We also disclose data to authorities when Hungarian or EU law requires it. We never sell personal data.

7. Transfers outside the EEA

Cloudflare and GitHub are based in the USA, and Cloudflare serves requests from its worldwide network. We rely on the EU–US Data Privacy Framework, under which both are certified, and for Cloudflare also on its data processing addendum (GDPR Art. 45–46). Creem is in the EU (Estonia). Brevo is in the EU (France); where its own sub-processors are in the USA, its data processing agreement covers the transfer. Google and Atlassian transfer data under their own policies, as the providers of your accounts. You can ask us for a copy of the safeguard we rely on.

8. How long we keep data

Each retention period is in section 3. When a period ends, we delete the data or anonymize it so it no longer identifies anyone.

9. Your rights

You have the right to:

• access: get a copy of your data and information about how we use it (Art. 15);
• rectification: have inaccurate data corrected (Art. 16);
• erasure: have your data deleted, unless we must keep it, for example a formal complaint (Art. 17);
• restriction: have us pause using your data while a dispute is checked (Art. 18);
• portability: receive data you gave us in a machine-readable format (Art. 20);
• objection: object to processing based on our legitimate interest (Art. 21). We then stop, unless we have compelling grounds.

Your right to object. Where we rely on our legitimate interest (sections A, D, E and F), you can object at any time, for reasons arising from your particular situation. Write to privacy@rowclerk.com. We then stop, unless we have compelling legitimate grounds or need the data for legal claims (GDPR Art. 21(1)).

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22).

10. How to use your rights

1. Email privacy@rowclerk.com with the subject “Privacy request” and tell us what you want. You can also write to us at the address in section 1.
2. We may ask for information to confirm it’s you, for example a reply from the email address you used at checkout. We don’t ask for more than we need.
3. We answer within one month of receiving your request. If a request is complex, or there are many, we can extend this by two more months. If we do, we tell you within the first month and explain why (GDPR Art. 12(3)).
4. It’s free. For requests that are clearly unfounded or excessive, we may charge a reasonable fee or refuse, and we explain why (Art. 12(5)).
5. If we don’t act on your request, we tell you why within one month and remind you that you can complain or go to court (Art. 12(4)).

Data stored in your own Google account (section B) is under your control, and you can delete it yourself at any time. For purchase data held by Creem, you can also contact Creem directly.

11. Complaints

You can complain to the Hungarian data protection authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11. · Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400 · Email: ugyfelszolgalat@naih.hu · Web: naih.hu

If you live in another EU country, you can also complain to the authority there (GDPR Art. 77). You can also go to court (Art. 79). In Hungary these cases are heard by the regional court (törvényszék), and you can choose the one for your place of residence.

We’d appreciate the chance to fix the problem first: write to privacy@rowclerk.com.

12. Children

Rowclerk isn’t directed at children under 16, and we don’t knowingly collect their personal data. In Hungary, children under 16 need a parent’s consent for online services (GDPR Art. 8). If you think a child has given us personal data, write to privacy@rowclerk.com and we will delete it.

13. Security and data breaches

All connections use HTTPS. Trello® access is read-only, and the token stays in your Google account. Our accounts are protected with two-factor authentication, and only the operator of Rowclerk can access the support mailbox and the Creem dashboard. If a breach is likely to put your rights at risk, we notify NAIH within 72 hours (Art. 33). If the risk is high, we also tell you without undue delay (Art. 34).

14. Where this policy applies

This policy covers the Rowclerk for Trello® add-on for Google Sheets™, the website rowclerk.com and the licence service api.rowclerk.com. Trello®, Google, Creem and other linked sites and services have their own policies.

15. Changes to this policy

We update this policy when Rowclerk or the law changes, and show the new effective date at the top. We announce material changes at least 30 days in advance on this website and, where we have your email address (for example because you bought a plan), by email. Where a change needs your consent, we ask for it.