RetroTeam

GDPR overview

GDPR is handled in a structured way but never claimed in so many words. The privacy statement, last updated in March 2024, devotes section 4 to the legal bases for people in the European Economic Area, listing performance of a contract, consent, legitimate interest, payment processing and legal obligation. Section 9 sets out the rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent, plus the right to lodge a complaint with a supervisory authority. Roles are qualified: controller for individual users, processor for organizational customers. Transfer and processing of data in the United States is announced explicitly for users located outside the US. What is missing is just as clear: no standard contractual clauses, no Data Privacy Framework, no named transfer mechanism, no Article 27 EU representative, no data protection officer and no published DPA.

Who owns the data?

RetroTeam states plainly on its security page that you own your data and that it neither sells nor rents customer data to anyone. The terms grant the publisher a non-exclusive, fully paid, royalty-free license to process your content solely to operate and maintain the application. Private content stays private and is not shared with third parties or accessed by the publisher without the user's explicit consent. You alone are responsible for what you post, as nothing is filtered or moderated, while the publisher keeps the intellectual property rights over the application itself. Under GDPR it acts as controller for individual users and as processor for organizational customers, whose employees must address requests to their own organization rather than to RetroTeam.

Reuse rights

Inside the tool you are free to reuse your own material without asking permission. The security page says you may export data from RetroTeam's servers to CSV or text at any time, and the privacy statement adds a portability right to receive personal data in a structured, commonly used and machine-readable format. Deletion is equally self-served, by removing the account or contacting support. Nothing published restricts what you then do with your own cards, action items and exports. The product itself is another matter: the terms forbid reproducing, duplicating, copying, selling, reselling or exploiting any part of the application or the service without prior written permission, and prohibit any automated extraction or scraping of application content. Everything on the application that is not user content is marked all rights reserved.

Data retention & training

Hosting summary

RetroTeam hosts its data on Google Cloud Platform, using Firebase services, and the security page states that the data lives in the US central region. No alternative region and no EU data residency option are offered. For anyone located outside the United States, the privacy statement says plainly that data, including personal data, is transferred to and processed in the United States. Traffic is protected by 256-bit SSL in transit and AES256 encryption at rest, and passwords are stored through Firebase Authentication, which uses a modified version of scrypt. Payments run through Stripe, with PCI compliance claimed and no billing data stored on RetroTeam's own servers. Backups are built into the deployment process and taken regularly, with only the most recent copies kept. A runtime application protection layer is described as blocking OWASP Top 10 and business logic attacks, alongside security headers. What is not offered is just as clear: no data processing agreement and no certification such as SOC 2 or ISO is mentioned anywhere on the site.