Legal
Privacy Policy
Last updated: November 6, 2026
1. Who we are
Rindma is operated by M2DT Consulting, Bosnia and Herzegovina ("we", "us", or "our"). This policy explains how we handle personal information on rindma.com, app.rindma.com, and related services.
Legal operator: "M2DT CONSULTING", Klisa - Osmanagići bb, 77220 Cazin, Bosnia and Herzegovina. JIB (tax identification number): 4364585690003. PDV (VAT identification number): 364585690003. For privacy questions or requests, contact support@rindma.com.
M2DT Consulting acts as controller for account administration, billing administration, service security, and our own communications. Where we process personal information in workspace content on an organization's instructions, that organization may act as controller and we act as processor.
2. Information we handle
- Account and profile information: name, email, authentication and session information, profile preferences, and any profile details you supply, such as date of birth, country, city, phone number, job title, and profile images.
- Workspace content: workspaces, Spaces, Thinking pages and boards, Tasks, milestones, comments, Updates, attachments, invitations, membership, permissions, and activity history.
- Private Notes: the notes you create in your personal area. Their content is encrypted on the server using a service-managed key. This is not end-to-end encryption.
- Agent access information: Agent configuration, permissions, key hashes, expiry and revocation information, last-used timestamps, and activity associated with authorized Agent actions. Protect the original keys and revoke access when it is no longer needed.
- GitHub integration information: installation and account identifiers, connected repository names and identifiers, commit messages and author metadata, branches, pull-request references and activity, reviews, workflow results, and release activity made available through the integration.
- Billing information: billing contact information, customer, subscription and transaction identifiers, plan and member quantities, amounts, currency, invoice references, payment status, and renewal or cancellation dates. Payment details are entered through Paddle checkout and handled under Paddle's privacy notice.
- Technical and communication information: information necessary to maintain sessions and security, preferences, support correspondence, and operational records.
- Website visit information: basic website traffic statistics collected through Cloudflare to understand visits to our website.
We receive information from you, authorized collaborators and Agents, and connected services such as GitHub and Paddle. Invitations may include an invitee's email before they create an account.
3. Purposes and legal bases
Subject to applicable law, we process information:
- To provide accounts, collaboration, storage, integrations, and paid features, as necessary to perform our contract with you or take requested steps before entering it.
- To maintain security, prevent abuse, troubleshoot, and administer the service, based on our legitimate interests in operating a reliable service, balanced against your rights.
- To maintain required financial records and respond to lawful requests, as necessary to comply with legal obligations.
- Where consent is required for an optional activity, based on that consent. You may withdraw it without affecting the lawfulness of earlier processing.
Workspace content processed on a customer's behalf is handled under that customer's instructions and the applicable processing agreement.
Account email and essential authentication information are necessary to provide an account. Optional profile information is not necessary to use the core service. Information needed for payment may be required to complete a purchase.
We do not sell personal information. We do not use workspace content to train general-purpose public AI models. Independently authorized AI clients have their own terms and data practices.
4. Who receives information
Information may be disclosed to:
- Workspace owners, Space members, and other collaborators according to the applicable permissions. Do not assume shared workspace content is visible only to its author.
- Agents and external clients you or an authorized administrator connect, within their granted access. Information sent to those clients is subject to their providers' policies.
- GitHub when you connect and use the GitHub integration.
- Paddle for checkout, subscription management, invoicing, and payment support. See Paddle's Privacy Notice.
- Render for application and database hosting in Frankfurt, Germany.
- Cloudflare for website traffic analytics.
- Service providers supporting hosting, databases, transactional email, and security. Resend is integrated for transactional email.
- Authorities or other recipients where disclosure is legally required or necessary to establish, exercise, or defend legal claims.
6. Retention and deletion
We retain information only as long as necessary for the relevant purpose, including providing the service, meeting legal obligations, resolving disputes, and maintaining security. Relevant criteria include account and workspace activity, the nature of the information, customer instructions, and applicable recordkeeping requirements. Information is automatically deleted or anonymized under our retention procedures when it is no longer required.
Canceling a subscription or locking a workspace does not itself request deletion of its content. Removing an integration or revoking a key prevents future access through that connection but does not necessarily erase activity or content previously created.
Contact support@rindma.com to request deletion or information about retention. Requests concerning an organization's workspace may need to be handled with that organization's administrator, subject to applicable law.
When your account is deleted, we immediately and permanently delete its associated data. Account deletion cannot be undone, and deleted account data cannot be recovered.
7. Security and international processing
We use technical and organizational safeguards appropriate to the information and risks. These include access controls and server-side encryption of Private Note content. No system is completely secure. Keep account access, Agent keys, and integration permissions secure.
The application servers and database are hosted by Render in Frankfurt, Germany. Other providers may process information in other countries. Hosting in Frankfurt does not establish the processing locations of every provider, support operation, or backup. Any transfer must meet applicable data-protection requirements.
8. Your rights
Subject to applicable law and its conditions, you may request access, correction, erasure, restriction, or portability of your personal information, object to certain processing, and withdraw consent where consent is the legal basis. We may need proportionate identity verification to handle a request.
Email support@rindma.com. You may also update available profile settings and revoke Agent access in the product. We will respond within the time limits required by applicable law.
You may lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina or another competent supervisory authority where applicable. This policy does not limit rights under applicable data-protection law, including the GDPR where it applies.
9. Children
Rindma is intended for professional use and is not directed to children under 16. If you believe a child has supplied personal information improperly, contact us so we can investigate and take appropriate action.
10. Changes
We may update this policy to reflect changes in the service or legal requirements. We will update the date and provide additional notice where required. An update to this policy does not replace consent where the law requires it.