Last updated: 1 August 2026
This policy explains what personal data we process when you use GTDEasy, why we process it, how long we keep it and what rights you have over it.
Ackermann Labs International, S.L. ("Ackermann Labs") Tax ID: B8829853 Address: Calle Hermosilla 30, 28001 Madrid, Spain Contact: info@ackermannlabs.com
We have not appointed a data protection officer, as none of the circumstances in Article 37 of Regulation (EU) 2016/679 (GDPR) apply. For anything related to your data, write to the address above.
Account data. Your email address, your first and last name if you choose to provide them, and your interface language. If you sign in with Google or with Apple, we receive your identifier and email address from those providers. If you use Apple's "Hide My Email" feature, we receive an anonymous forwarding address rather than your real email.
Content you create. Tasks, projects, contexts, comments, steps, notes, dates and anything else you enter into the app.
Collaboration data. The organisations you belong to, your role in them, the tasks you delegate or are delegated to you, and the projects you share with other people.
Integration data, only if you enable it. When you connect your Gmail, Outlook or Attio account, we process the access credentials needed for synchronisation and the data that integration imports into the app. You can disconnect any integration at any time.
Technical data. Access and error logs, IP address, device type and app version, needed to run the service and detect security incidents.
We do not process special categories of data, we do not build profiles, we do not make automated decisions with legal effects on you, we do not show advertising, and we do not sell or transfer your data to third parties for commercial purposes.
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account and providing the service | Performance of a contract (Art. 6.1.b GDPR) |
| Storing and synchronising the content you create | Performance of a contract (Art. 6.1.b GDPR) |
| Enabling collaboration in organisations and shared projects | Performance of a contract (Art. 6.1.b GDPR) |
| Sending you operational service notices | Performance of a contract (Art. 6.1.b GDPR) |
| Connecting integrations with third-party services | Your consent (Art. 6.1.a GDPR) |
| Keeping the service secure and preventing abuse | Legitimate interest (Art. 6.1.f GDPR) |
| Handling your requests and rights | Legal obligation (Art. 6.1.c GDPR) |
You can withdraw your consent for integrations at any time by disconnecting them from within the app. Withdrawal does not affect the lawfulness of processing carried out before then.
To run the service we rely on providers acting as data processors, under contracts that meet the requirements of Article 28 GDPR:
| Provider | Role | Where data is held |
|---|---|---|
| Supabase | Database, authentication and storage | Ireland (European Union) |
| Lovable | Application hosting and sign-in brokering for Google and Apple | European Union and United States |
| Cloudflare | Content delivery and protection against attacks | Global, with nodes in the European Union |
| Mailgun | Sending service emails | European Union |
In addition, if you enable an integration, the relevant data is exchanged with the provider you connected: Google, Microsoft or Attio as the case may be, each under its own privacy policy.
We may also disclose your data to public authorities where we are legally required to do so.
The bulk of your data, including the database holding your content, is hosted in Ireland and does not leave the European Economic Area.
Some of the providers listed above may process data in the United States. Those transfers rely on the standard contractual clauses approved by the European Commission, or on the adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the safeguards in place by writing to info@ackermannlabs.com.
If you use GTDEasy from outside the European Economic Area, be aware that your data will nonetheless be stored and processed within it, and that the protections described in this policy apply to you regardless of where you are.
We keep your account data and your content for as long as your account remains active.
Tasks you send to Trash are kept for 30 days and then hidden.
When you delete your account from within the app, your account and your personal data are erased immediately and irreversibly. Content you have handed over to an organisation, or that belongs to an organisation you are part of, remains with that organisation.
Technical logs are kept for a maximum of twelve months.
Regardless of the above, we may retain certain data in blocked form for the applicable statutory limitation periods, solely to address potential liabilities.
You may at any time exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw any consent you have given.
You can exercise many of these directly in the app: edit your profile data, export or delete your content, and delete your account entirely from Admin, under Danger zone.
For anything else, write to info@ackermannlabs.com stating which right you wish to exercise. We will respond within one month.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), which is our lead supervisory authority, or with the supervisory authority of the country where you live.
GTDEasy is intended solely for people aged 18 or over. We do not knowingly collect data from minors. If we find that an account has been created in breach of this requirement, we will delete it.
We apply technical and organisational measures to protect your data, including encryption in transit, database-level access control per user and organisation, and restricted staff access limited to what is strictly necessary.
No system is completely secure. If a security breach occurs that poses a high risk to your rights, we will inform you and notify the supervisory authority in accordance with Articles 33 and 34 GDPR.
This policy covers the use of GTDEasy by individuals who create an account in their own name.
If a company or organisation wishes to use GTDEasy to process data about its employees or about third parties, it acts as data controller and Ackermann Labs as processor. That arrangement requires a specific data processing agreement under Article 28 GDPR to be signed beforehand. To request one, write to info@ackermannlabs.com.
We may update this policy to reflect legal or service changes. The current version will always be published at this address, and where a change is significant we will let you know by email or within the app with reasonable notice.