Records of processing
Version 1
⚠️ Draft for legal review. The highlighted fields must be filled in before there are paying customers.
The GDPR (art. 30) asks whoever processes data to keep this list and show it to the supervisory authority if asked. We publish it for everyone.
1. As controller
Controller: [COMPANY NAME], tax number [TAX NUMBER], [ADDRESS]. Privacy contact: [PRIVACY EMAIL].
| Processing | People | Data | Legal basis (art. 6) | Kept for |
|---|---|---|---|---|
| Accounts | Users | Name, email, protected password, photo, preferences | Performance of the contract | While the account exists |
| Account security | Users | 2FA, sign-ins, device and network (only as a digest) | Legitimate interest (security) | 12 months |
| Service and security emails | Users | Email, name | Performance of the contract · legitimate interest | Sending record: 6 months |
| Acceptance of the terms | Users | Who, which version, when | Legal obligation · legitimate interest | While the account exists, plus 5 years |
| GDPR requests | Whoever makes the request | The request and the answers | Legal obligation (art. 12) | 3 years after they close |
| Error logs | Users | Where it failed, code, account, organization and browser (no content) | Legitimate interest | 90 days (what comes from the browser, 7 days) |
2. As processor (on behalf of the customer organizations)
| Processing | Data | Instructions | Kept for |
|---|---|---|---|
| Project management | Tickets, comments, pages, attachments, hours, activity log | Data processing agreement (DPA) | While the organization exists; 30 days after the contract ends |
| AI features (if the organization uses them) | The text of each AI request | DPA | Not kept by the provider for training |
| GitHub connection (if connected) | Commits, branches and pull requests linked to tickets | DPA | While connected |
| Notice emails | Name and email of the recipient, the ticket title | DPA | Sending record: 6 months |
3. Where the data is, and transfers
Database and files in Ireland (EU); application servers in Dublin (EU). Emails, AI and GitHub leave the EU, with the GDPR safeguards (art. 44 to 49). The full list, with the safeguards, is in «Subprocessors».
4. Security measures (art. 32)
- Encrypted connections and disks.
- Separation between organizations inside the database itself, with automatic tests.
- Two-step verification, which each organization can make mandatory.
- Passwords checked against known data leaks; request limits and CAPTCHA.
- Activity log; backups; an independent security review of every version.