Privacy policy

1. Who is responsible

CRYPTO MONEY INVEST d.o.o. is the controller of account, service administration, security and support information. Contact support@weeyuga.com for privacy matters; this is our privacy contact, not a representation that a statutory Data Protection Officer has been appointed. Where an organization supplies workspace content on its own instructions, it generally determines the purpose of that processing and we act as its processor. Contact us about appropriate data-processing terms for your organization.

2. Information and its sources

You supply your name, email, handle, password and workspace details when creating or managing an account. Passwords are stored as hashes, not readable passwords. We keep membership and role information, preferences, API-token identifiers and audit history, and records of your acceptance of the Terms and Refund Policy, including policy versions and acceptance time. We also receive invitations and assignments from workspace administrators or other authorized members.

Workspace information includes projects, epics, stories, tasks, descriptions, comments, mentions, assignees, tags, dependencies, calendars, workflow stages, commit references, orchestration events, run history, and activity records. Uploaded import files may contain names, emails, source identifiers, descriptions and links. Import processing maps this information to tasks and retains relevant source metadata and duplicate-detection records. We do not fetch external attachment links merely because they appear in an import.

Authorized connected applications can submit feedback, including comments, screenshots, page URL/title, application context and reporter details. These become private project tasks and attachments. Support correspondence contains what you send us. Please remove confidential material that is not needed to investigate your request.

When payments are configured, Paddle supplies customer, transaction and subscription identifiers, plan, currency, status, billing dates and payment-management information. Paddle collects the payment details entered in its checkout. Technical records can include IP addresses, browser/request information, timestamps, errors and security events from our application, web server and authentication system. Operational and security logs are also processed on our centralized, self-managed logging infrastructure; this is not third-party advertising analytics.

3. Purposes and legal bases

We use account, workspace and billing information to provide the requested service, authenticate access, enable collaboration, administer subscriptions and respond to support requests. For individual customers this is necessary to perform our contract or take requested steps before it. For organization representatives, administration and communication also serve our legitimate interest in providing the contracted service.

Security monitoring, abuse prevention, troubleshooting and internal product analytics serve our legitimate interests in maintaining a reliable service. Internal analytics derive from workspace membership, tasks and workflow activity; they are not advertising tracking. We consider the effect on individuals and limit access and processing to these purposes. We process records required for accounting, tax or lawful requests to meet legal obligations. Where optional processing requires consent, we ask separately and allow its withdrawal.

4. Sharing and service providers

Authorized members and administrators can see and manage content according to workspace/project permissions. Our authorized personnel can access information where needed for support, operation, security and lawful requests. We use self-managed Contabo infrastructure for the application, PostgreSQL database and centralized operational/security logging. The operator has confirmed completion of Contabo data-processing agreements. We do not use Contabo-managed backups; application backups are managed by us.

Paddle processes buyer and payment information as merchant of record under its own Privacy Notice when you use checkout or payment support. Our current public deployment uses local account sign-in; it does not use Auth0 login. If we introduce an external sign-in provider, we will update this notice before that processing begins. Customer-authorized API/MCP tools and integrations receive the information their permissions allow and process it under their own arrangements.

We may share limited information with professional advisers or authorities when required by law or necessary for a legitimate legal claim, and with a successor if the service is reorganized, with appropriate safeguards and notice. We do not sell personal information or disclose it for third-party targeted advertising.

5. Hosting and international processing

Contabo’s control panel identifies our application and centralized logging instances with the location label EU, as confirmed by the operator on 15 October 2026. We administer the service from Serbia. This describes the provider’s region label, not a particular hosting country or city and not a promise that all access or recipients are exclusively in the EU. Payment providers and tools you choose to connect may process information in other countries. Where cross-border processing requires a legal transfer mechanism, we use the applicable safeguards, such as contractual protections or a legally recognized adequacy basis. Contact support@weeyuga.com for information about the arrangements relevant to your data.

6. Cookies and browser storage

We use first-party cookies and browser storage for sign-in, workspace/project selection, language, theme, board preferences and returning to a requested page after login. Our Cookies Policy lists the keys, purposes and durations. We do not deploy third-party advertising or audience-tracking analytics on these pages. Paddle’s script loads when a configured checkout or payment-management flow is opened and uses its own payment/security technologies. Blocking necessary storage may prevent sign-in or payment from working.

7. Retention and verified closure

We retain active account and workspace information while needed to provide the service. Canceling a subscription does not request erasure. To close an account or workspace, email support@weeyuga.com. We verify identity, ownership and the requested scope before confirming closure; this protects other members and prevents unauthorized deletion. We can help with an export before closure.

We delete active workspace data in the verified closure scope within 30 days after closure is confirmed. Application backup copies expire within a further 30 days, so ordinary backup copies are removed no later than 60 days after verified closure. Backups are restricted to recovery; an erasure record is kept separately so restoring an older backup does not bring the erased account or workspace back into use.

Our approved policy for operational and security logs is to retain only the most recent 30 days. Enforcement across centralized logging, local files, journals and copied logs is still being verified and older log records may remain while that work is completed. We do not currently represent that all log copies already meet the 30-day limit. This log policy is separate from workspace content, financial records, support correspondence and application-backup retention.

We isolate only the minimum records needed for a documented legal obligation, security investigation or legal claim, with a recorded reason and review or expiry date. Such records are not used to reactivate a closed account. Payment records controlled by Paddle follow its retention policy. Support correspondence and legally required business records are retained only as needed for the request or documented obligation; they are not covered by the automatic workspace-backup timer.

A personal account closure does not automatically erase a separately controlled organization’s active workspace or other members’ work. We confirm ownership transfers and the treatment of shared content with the authorized administrator. Browser-stored preferences remain on your device until they expire or you clear them, as explained in the Cookies Policy.

8. Security

We use HTTPS for the public service, password hashing, authentication, role-based access checks, scoped API credentials and restricted operational access. Backups and retained records are access-controlled. These measures reduce risk but cannot guarantee absolute security. Protect your credentials and report suspected security problems privately to support@weeyuga.com; do not include a password, API key or payment-card number.

9. Your rights and requests

Subject to applicable law, you may request access, correction, export/portability, erasure or restriction of your personal information, object to processing based on legitimate interests, and withdraw any consent without affecting earlier lawful processing. Contact support@weeyuga.com from your account email, describe the request and identify the relevant workspace. We may request proportionate verification and will respond within the applicable legal period. For organization-controlled data, contact its administrator; we assist that organization with its obligations.

You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection or another competent data-protection authority, including one in your country where applicable. We do not use your information to make solely automated decisions producing legal or similarly significant effects about you. Connected tools are chosen and controlled by their users and must be assessed separately.

10. Children and updates

The service is intended for adults and organizations, not children under 18. Contact us if a child has submitted personal information. We update this notice when our processing changes and will give notice of material changes where required. The effective date is shown above.