Privacy Policy

1. Who We Are

MyStatement, Inc. ("we", "us", "our") is the provider of the Estimation Poker for Jira app (the "App") listed on the Atlassian Marketplace. This Privacy Policy explains how we process personal data in connection with the App and our website.

2. Role Under GDPR

When an organization installs and uses the App in its Atlassian Cloud site, that organization is the Data Controller. We act as a Data Processor (or service provider) and process personal data only on the Controller's documented instructions.

3. Data We Process via the App

To provide the App's functionality, the App processes the following categories of data:

• Votes: for each work item being estimated, the Atlassian account identifier (accountId) of each person who voted, the card they chose and when. Votes are hidden from other users until they are revealed, and they are deleted when the round ends (when the agreed estimate is saved or someone starts the vote again).
• Estimation history: when an estimate is saved through the App, the card saved, the votes that were revealed for it (accountId and card), the accountId of the person who saved it and when. History entries are kept for the period a Jira administrator chooses in the App's settings (24 hours, 30 days, 90 days by default, 1 year, or until deleted) and are then deleted; expired entries are purged by the Forge platform, which may take up to 48 hours.
• Estimation sessions: the list of work items in a session, the work item on screen and the timer, kept for one day after the session was last changed; and the accountIds of the people who have the session open, held for at most 10 minutes after their browser last reported the session as open.
• Display names, work item keys, summaries and descriptions, boards and sprints. This data is read from Jira at the moment it is shown and is not stored by the App.
• Settings for the site, for a project and for a user (for example whether the App is on, the deck of cards, the estimation field, the suggested value rule, the timer length and how long the history is kept). These are stored in your Jira site as app, project and user properties.
• Technical logs and metadata necessary for security, support, and troubleshooting

The estimate itself is written to the work item's estimation field in Jira, as the user who saves it, so it is subject to Jira's own permissions and history. We do not store or have access to your Atlassian passwords. The App does not store the content of your work items, and it does not send any data to servers outside Atlassian.

4. Data We Process via Our Website

When you visit our website, we may collect basic technical information (such as IP address, browser type, and pages visited) to operate and secure the site. If you contact us, we process the information you provide (such as name, email, and message) to respond to your request.

5. Legal Bases

Where applicable, we rely on the following legal bases:

• Performance of a contract (providing the App to your organization)
• Legitimate interests (ensuring security, preventing abuse, improving reliability)
• Compliance with legal obligations

6. How and Where Data Is Processed

The App is built on Atlassian Forge. All processing and storage occur within Atlassian's cloud infrastructure, subject to Atlassian's security certifications. The App makes no connections to external servers, and we do not export App data to our own servers unless strictly necessary for support or troubleshooting, and then only with your consent.

7. Sub-processors

The primary sub-processor is Atlassian, which provides the Forge platform. Additional sub-processors (if any) used for monitoring or support will offer appropriate data protection safeguards and can be disclosed upon request.

8. Data Retention

Votes, sessions and presence records are temporary, and history entries are kept for the period chosen by your Jira administrator, as described in section 3. Settings remain in your Jira site until they are changed or removed. When you uninstall the App, we delete or anonymize related data within a commercially reasonable timeframe, typically within 30 days.

9. Data Subject Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data. As we act as a Processor, requests should generally be directed to your Atlassian site administrator (the Controller). We will support the Controller in responding to such requests where required.

10. International Transfers

Where data is transferred outside of your jurisdiction by Atlassian or our sub-processors, such transfers are protected by appropriate safeguards (such as Standard Contractual Clauses) as provided by those providers.

11. Security

We apply appropriate technical and organizational measures, including encryption and access control, to protect personal data processed by the App. For more information, see our Cloud Security Statement.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date indicates the latest version. Material changes will be communicated via our website or Marketplace listing.

13. Contact