assign2meAssign to mePLSign up

Documents

Privacy policy

What data we collect, why, who is responsible for it, who we share it with and what rights you have. Also if you are a guest in another company's project.

Version 1.1 · effective from 8 November 2026

This is an English translation provided for convenience. The Polish version is legally binding.

1. Data controller

  1. The controller of the personal data described in this policy is Trogon sp. z o.o., with its registered office in Rzeszów, ul. Króla Stanisława Augusta 33/7, 35-210 Rzeszów, Poland, entered in the register of entrepreneurs of the National Court Register by the District Court in Rzeszów, 12th Commercial Division of the National Court Register, under KRS number 0001277671, NIP (tax ID) 5170477258, REGON 546128668, share capital PLN 50,000.00 (“we”).
  2. For any matter concerning personal data, write to contact@assign2me.com.
  3. We process the data that companies using assign2me put into their projects, and the data of those companies' guests, as a processor, not as a controller. See sections 4 and 5.

2. What data we process

  1. Account data: first and last name, email address, language, time zone.
  2. Company billing data: name, address, tax ID or EU VAT number, contact person details.
  3. Technical data: IP address, browser information, event logs and sign-in history.
  4. Integration data: account identifiers in Slack, GitHub and GitLab and the names of connected AI assistants, if you enable these integrations.
  5. Task content: titles, descriptions, comments and files. This data belongs to the company using assign2me and is described separately in section 4.

3. Purposes and legal bases

  1. Providing the Service and running your account – Article 6(1)(b) GDPR (performance of a contract).
  2. Issuing invoices and bookkeeping – Article 6(1)(c) GDPR (legal obligation).
  3. Keeping the Service and sign-in secure, detecting abuse, establishing and defending claims – Article 6(1)(f) GDPR (legitimate interest).
  4. Replying to messages and requests – Article 6(1)(f) GDPR.
  5. Emails about your account and the trial (e.g. a reminder that the trial is ending) – Article 6(1)(b) GDPR. We do not send marketing emails.

4. Data in tasks

  1. The company that uses the Service is responsible for the content its team and guests put into tasks and is the controller of that data.
  2. We process that data solely on its behalf and on its instructions, under the data processing agreement (DPA), which is an annex to the Terms of service. We do not use it for any other purpose.

5. If you are a guest

  1. You are a guest when a company using assign2me (for example your software supplier) has invited you to its project. That company is the controller of your data in the project. We process it on the company's behalf, under the DPA.
  2. The company processes your data to run a joint project with you: to assign and share tasks with you and to collect your comments and files. The company determines the legal basis; usually it is the contract it has with your employer, or its legitimate interest.
  3. We process: your email address, your first and last name if you provide them, your language, your comments, files and changes to tasks, and the technical data of signing in with a link from an email.
  4. You see only the tasks assigned or shared with you, with their comments, files and subtasks. Members of that company's team who have access to the project see your comments, files and changes to those tasks.
  5. For requests about your data in a project, it is best to contact the company that invited you. If you write to us, we will pass your request on to that company.
  6. We also process sign-in security data (e.g. IP address, time of sign-in) as a controller, to protect the Service – Article 6(1)(f) GDPR.

6. Who we share data with

  1. Our subprocessors who run the Service: Render Services, Inc. – hosting of the application, database and sign-in, EU (Frankfurt, Germany); Cloudflare, Inc. (R2) – storage of attachments, EU (EU jurisdiction); Resend (Plus Five Five, Inc.) – delivery of email notifications, EU (Ireland); Functional Software, Inc. (Sentry) – application error monitoring, EU (Germany).
  2. The payment operator, the invoicing software provider and the accounting office, to the extent necessary for billing. We do not receive payment card data – payment takes place on the operator's page.
  3. Slack, GitHub, GitLab or the provider of your AI assistant – only when the company or you enable that integration, and only to the extent needed for it to work.
  4. Public authorities, where required by law.

7. Transfers outside the EEA

  1. We store the Service's data in the European Economic Area.
  2. Some of our subprocessors are based outside the EEA. With them, and with integrations with services based outside the EEA, data may be transferred outside the EEA. This is based on a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or standard contractual clauses.

8. How long we keep data

  1. Account and company data – for the duration of the agreement and 60 days after it ends, so you can download your data. After that we delete it; the organization's administrators receive an email 7 days before.
  2. A guest's data in a project – as long as the company that invited them keeps it, at the latest until that company's organization is deleted.
  3. Invoices and accounting documents – for 5 years from the end of the year in which the tax obligation arose.
  4. Event logs – up to 12 months.
  5. Data needed to defend against claims – until the claims become time-barred.

9. Your rights

  1. You have the right to access, rectify, erase, restrict the processing of and port your data.
  2. You have the right to object to processing based on legitimate interest.
  3. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

10. Cookies and traffic measurement

  1. We use cookies necessary for the Service to work: to sign you in, keep your session and remember settings such as the language or a collapsed sidebar.
  2. We do not use advertising or analytics cookies. We measure traffic on assign2me.com with a tool that sets no cookies and does not identify visitors, with data stored in the EEA.
  3. You can change cookie settings in your browser. Disabling necessary cookies will prevent you from signing in.

11. Security

  1. Connections to the Service are encrypted. We store integration credentials in encrypted form.
  2. Each organization's data is kept separate from every other organization's data.
  3. Only people who need access to data for their work have it, and they are bound by confidentiality.

12. Changes to this policy

  1. We will inform you by email in advance about significant changes to this policy. The current version is always available on this page.
  2. Version 1.1 of this policy is effective from 8 November 2026.