Privacy policy

Last updated 4 November 2026

This policy explains what happens to the information you give when you join the TeamWing waitlist or use the service (application, Business space, forms and share pages).

Who is responsible

TeamWing is run by Paul Fagniard, sole trader (EI), SIREN 881 991 350, Toulouse, France (see the legal notice). For any question about your data, write to privacy@teamwing.app.

What we collect and why

Information	Why
Your work email	To tell you when your seat in the beta is ready, and to send a few updates about the launch.
Team size and the tools you use today (optional)	To decide which teams to invite first and what to build next.
Date of sign-up, browser language and the site you signed up from	To invite teams in the order of the list and write to you in the right language.

We process this information because you agreed to it when you ticked the box (consent, article 6(1)(a) of the GDPR). You can withdraw your consent at any time.

What we don't do

We don't sell or rent your information, and we don't share it for advertising.
This site sets no cookies and uses no analytics or advertising trackers.

Where it is stored

The waitlist is stored in Google Cloud Firestore, operated by Google for TeamWing, in a data centre located in the European Union. The site is served by Firebase Hosting. Its fonts are loaded from Google Fonts, which receives your IP address when the page loads.

How long we keep it

Until you unsubscribe, or at most 12 months after the public launch of TeamWing if you don't create an account.

The beta application

If you are invited to the beta and sign in at teamwing.app/app, we also process:

Information	Why
Your Google account name, email address and profile photo	To sign you in and show your colleagues who did what on a shared board.
The boards, tasks, notes and settings you create	To provide the service. Tasks on a shared board are visible to its members, according to the role the board owner gives them.
Your private notes, daily check-ins and preferences	To show them to you. Nobody else can read them, including the members of your boards.
The Google Tasks lists you choose to link to a board: title, notes, due date and status of each task	To show them on the board and keep both sides in sync. TeamWing only reads the lists you link, and writes back only the changes made on the board.
If you turn on Google Calendar: the events of your calendars (title, time, place, link) for the dates shown in TeamWing	To show your meetings next to your tasks and let you link a meeting to a task. Events are read on demand and not stored by TeamWing.
If you turn on publishing to Google Calendar: a dedicated calendar created by TeamWing in your account	To place your dated tasks in it. TeamWing can only change that calendar, never your other calendars.
If you turn on automatic sync: an encrypted Google Tasks access key	To keep your linked lists in sync in the background, even when TeamWing is closed. It is encrypted (AES-256) and deleted when you turn automatic sync off.
Automatic rules you create, and a log of what each rule did	To run the rules on the server and let you undo what a rule changed.
If you subscribe: your billing details	To take payment. Card details are entered on Stripe's page and never reach TeamWing; we keep the subscription status and invoice references.

Access to Google Tasks and Google Calendar is requested only when you turn these features on, through Google's own permission window. The access token used in your browser is not stored on our servers; if you turn on automatic sync, a long-lived Google Tasks access key is stored encrypted, used only for that sync, and deleted when you turn it off or revoke it. TeamWing's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: this data is used only to provide the board features you see, never for advertising, and is not sold or shared. You can revoke the access at any time at myaccount.google.com/permissions.

Gmail and Google Calendar add-on. If you install the TeamWing add-on, it reads only the email or meeting you have open and only when you open the TeamWing panel: the sender, subject, date and short preview of that email, or the title and times of that meeting. TeamWing never reads the rest of your inbox or calendar. These details are stored only in the task you choose to create or link, and are deleted with it. The add-on’s access ends when you uninstall it.

Artificial intelligence features

When you use an AI feature (creating tasks from a text or your voice, splitting a task, asking a question about a board, a weekly summary, a rule written in plain language, or an AI action in a rule you created), TeamWing sends the information needed for that request to an AI provider and shows you the result. Nothing is changed on a board without your validation, except by rules you created yourself.

What is sent: the text you typed, and when the request needs it, the titles, statuses, due dates, priorities, categories and short descriptions of the board's tasks. Members are identified by their first name only; email addresses are never sent.
Providers: Google (Gemini, through Google Cloud, processed in the European Union) by default; on Pro and Business boards the owner may choose OpenAI (ChatGPT), Anthropic (Claude) or Mistral AI (France), or connect the organisation's own key. These providers process the data on our behalf through their business APIs, which do not use it to train their models.
Information received from Google APIs (such as Google Tasks) may be part of a request you make, only to provide that feature. It is never used to develop, improve or train generalised AI or machine-learning models.
We keep a log of each AI request (who, when, which feature and provider, without its content). The board owner can turn AI off for a board at any time.

Business space and ERP connectors

When a board owner adds a board to their organisation's Business space (business.teamwing.app), the organisation's admins and managers can see that board's tasks, due dates, assignees and hours in the portfolio, workload and time views. Organisation members only see their own tasks. The board owner can remove the board at any time.

If an organisation admin connects Odoo or Pennylane, TeamWing sends to the organisation's own account, after a preview and only on their request: task titles and hours (as timesheets in Odoo), or hours per board and hourly rate (as draft invoices in Pennylane).
The connection credentials (API key or token) are encrypted (AES-256) and never sent back to the browser. They are deleted when the connector is disconnected.

We process this information to provide the service you asked for (performance of a contract, article 6(1)(b) of the GDPR). It is stored in Google Cloud Firestore in the European Union. Service emails (invitations, notifications, weekly report) are sent through Brevo (France), and payments are handled by Stripe. You can delete a board at any time from its settings, and ask us to delete your account and all your data by writing to privacy@teamwing.app.

Forms, sharing, inbound email and notifications

Public request form: when someone fills in a board’s form, their answers (name, email, phone and the fields chosen by the owner) become a task on that board, and the owner is emailed. We briefly keep the IP address as a counter to limit abuse (one hour at most).
Client sharing: a read-only page shows a board’s progress, without emails or task descriptions; the owner can switch the link off at any time.
Inbound email: an email sent to a board’s address (…@in.teamwing.app) is received by Brevo and turned into a task (sender, subject, text and attachments up to 700 KB). Refused messages are not kept; a technical fingerprint prevents duplicates.
Push notifications: if you turn them on for a device, we store a device token provided by Firebase Cloud Messaging (Google) and the browser type, to send you your boards’ alerts. The token is deleted when you turn notifications off or when it stops being valid.
Morning recap and Friday report: sent only if you turn them on; the AI-written summary follows the rules in the previous section.
Timesheets: logged hours and their billing status are stored with the tasks; invoice drafts are produced in your browser.
Business space: the organisation’s objectives, budgets and settings, plus a log of the last 400 admin actions (who, when, what) that its admins can view.

Roles and legal bases

For your account, billing, security and service improvement, TeamWing is the controller. For the data you put in your boards (colleagues, clients, requesters), you are the controller and TeamWing acts as your processor, as set out in section 15 of the terms. Legal bases: performance of the contract (service, service emails, payment), legal obligation (invoices), legitimate interest (security, abuse prevention, admin log) and consent (waitlist, push notifications).

Sub-processors

Provider	Role	Location
Google Cloud EMEA Limited (Firebase, Cloud Firestore, Cloud Functions, Cloud Messaging)	Hosting, database, server processing, push notifications	European Union
Brevo (Sendinblue SAS)	Sending service emails, receiving inbound emails	France
Stripe Payments Europe, Limited	Payments and invoices	Ireland (EU)
Google (Gemini, through Google Cloud)	AI features, by default	European Union
Mistral AI · OpenAI · Anthropic	AI features, only if the board owner chooses them	France · United States · United States
Odoo · Pennylane	Accounting connectors, only if the organisation connects them (its own account)	Depends on the customer’s account

When data goes to a provider in the United States (only if you choose OpenAI or Anthropic), the transfer is covered by the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses.

How long we keep data

Account and content: for as long as you use the service, then erased within one month of an account deletion request.
Invoices and billing data: 10 years (French accounting obligation, article L. 123-22 of the commercial code).
Log of AI requests (without their content): 12 months. Business admin log: the last 400 actions.
Anti-abuse counters for forms and inbound email: one hour. Notification tokens: until turned off or expired.
Waitlist: as stated above.

Security

Connections are encrypted (HTTPS), data access is controlled by role-based rules checked on the server, access keys to third-party services are encrypted (AES-256) and never sent back to the browser, and the admin console is protected by two-factor authentication. The service is not intended for children under 15.

Your rights

You can ask to see, correct or delete your information, or to stop receiving emails, by writing to privacy@teamwing.app. Every email we send also has an unsubscribe link. If you think your rights are not respected, you can complain to the CNIL (cnil.fr) or to the data protection authority of your country.