Privacy Policy — Email2Trello
Last updated: September 2026
Email2Trello is operated by Icelabz Solutions Ltd, a company registered in England & Wales ("we", "us", "our"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have under the UK GDPR, the EU GDPR (where applicable), and the UK Data Protection Act 2018.
By installing or using Email2Trello, you acknowledge this policy. If you do not agree with it, please uninstall the add-in and contact us to request deletion of your data.
1. Who is the data controller?
- Data controller: Icelabz Solutions Ltd
- Email: b@icelabz.co.uk
As a small organisation, we do not employ a Data Protection Officer (DPO). Data protection queries can be sent to the email address above and will be handled by the company director.
2. What data do we collect?
We collect the minimum data necessary to operate the add-in. We do not collect analytics, tracking data, or advertising data, and we do not build profiles of users.
| Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Email address (Outlook) | Identifies your account and links it to your Trello authorisation | Contract performance |
| Email subject line | Used as the Trello card title when you send an email | Contract performance |
| Email message body | Used as the Trello card description when you send an email | Contract performance |
| Email attachments (optional) | Forwarded to Trello when you tick "include attachments" | Contract performance |
| Trello authorisation token | Allows the add-in to create cards on your behalf; stored encrypted (AES-256) | Contract performance |
| Sent-message log (message ID, timestamp, board) | Prevents duplicate cards; support/debugging | Legitimate interest |
| Billing email and transaction reference (Pro users only) | Processing subscription payments | Contract performance / legal obligation |
What we do NOT collect or store:
- We do not store email subject lines, message bodies, or email content on our servers. All message data passes directly through to Trello.
- We do not store attachments on our servers; they pass through directly to Trello over encrypted HTTPS connections.
- We do not read, scan, or store your personal inbox messages.
- We do not sell, rent, or share personal data with advertisers or data brokers.
- We do not use cookies or trackers on this website beyond those strictly necessary for the hosting platform.
3. How we use your data
Your data is used only to:
- Authenticate and link your Outlook account to Trello.
- Create Trello cards from emails you explicitly choose to send.
- Prevent duplicate submissions.
- Manage your subscription (Pro users).
- Respond to support requests.
We never use your data for marketing, profiling, automated decision-making, or any purpose not listed above.
4. Third-party processors
We use the following sub-processors, each of which processes data under their own privacy terms:
| Provider | Role |
|---|---|
| Microsoft (Outlook / AppSource) | Hosts and distributes the add-in; processes sign-in data under the Microsoft Services Agreement and Privacy Statement |
| Trello / Atlassian | Receives the card data (title, description, attachments) you choose to send |
| Payment processor (e.g. Stripe / Microsoft commerce platform) | Processes Pro subscription payments |
We remain responsible for data processed on our behalf. If we change sub-processors, we will update this policy.
5. International transfers
Some of our processors (Trello/Atlassian, Microsoft) may process data outside the UK/EEA. Where this happens, transfers are protected by appropriate safeguards recognised under UK GDPR (such as Standard Contractual Clauses, the UK International Data Transfer Agreement, or adequacy regulations). We take reasonable steps to ensure your data is protected to a standard equivalent to UK law.
6. Data security
- Trello authorisation tokens are encrypted with AES-256 before storage.
- All traffic between your browser, our servers, and Trello uses encrypted HTTPS/TLS connections.
- Access to production systems is restricted to the company director.
- Sent-message logs contain message IDs and timestamps only — no email content.
- We apply reasonable technical and organisational measures appropriate to the size and risk profile of the service.
No system is 100% secure, but we keep security measures under regular review.
7. Data retention
- Account & token data: retained while your account is active; deleted within 30 days of uninstallation or a deletion request.
- Sent-message logs: retained for a maximum of 90 days, then automatically deleted.
- Support correspondence: retained for up to 12 months for reference, then deleted.
- Billing records: retained as required by UK tax law (typically 6 years), limited to transaction references — no email content.
When retention periods expire, data is securely deleted or anonymised.
8. Your rights
Under UK/EU data protection law, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — ask us to delete your data.
- Restriction — ask us to limit how we process your data.
- Portability — receive your data in a structured, commonly used format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
You also have the right to complain to a supervisory authority:
- UK: Information Commissioner's Office (ICO) — ico.org.uk · 0303 123 1113
- EU/EEA: your local data protection authority.
To exercise any right, email b@icelabz.co.uk. We respond within one calendar month (extendable by two further months for complex requests, as permitted by law). You will never be charged for exercising your rights.
9. Data breaches
In the unlikely event of a personal data breach, we will assess the risk and, where required by UK GDPR Article 33, notify the ICO within 72 hours. Where the breach is likely to result in a high risk to your rights, we will notify affected users without undue delay.
10. Children
Email2Trello is a business productivity tool and is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects the latest version. For material changes, we will notify users via the add-in or by email where reasonably practicable. Continued use after an update constitutes acceptance.
12. Contact
Icelabz Solutions Ltd
Email: b@icelabz.co.uk
For all data protection requests, please include the email address associated with your Email2Trello account so we can verify your identity.