Privacy Policy

1. Who we are

Backlog Whisper is a product of Backlog Whisper, Sverrigsgade 4A, 3rd floor, 2300 Copenhagen S, Denmark, CVR DK-46671074. We are the data controller for information collected through this website (backlogwhisper.com).

For the Backlog Whisper Jira app, your organisation is the data controller for the Jira content it processes, and we act as a processor on your instructions. Section 3 explains what the app does with that content.

Contact: hello@backlogwhisper.com

2. This website

Website analytics

If you consent to analytics, we use Cloudflare Web Analytics to count page views and understand which countries our visitors come from. It is cookieless and sets no identifier on your device. Country is derived from your IP address at the moment of the request and the IP is not retained. No cross-site tracking takes place, and you can withdraw consent at any time using the Cookie settings link in the footer.

• Data: page views, country (derived from IP, not stored)
• Purpose: understanding how the site is used
• Legal basis: consent (Art. 6(1)(a) GDPR)
• Retention: aggregated, no personal-level retention

Newsletter and waitlist

If you join our waitlist or subscribe to our newsletter, we store your email address and the date you submitted it. We use Brevo (Sendinblue SAS, France), which processes and stores this data inside the EU. We are pre-launch and send nothing today: the address is simply held until we have something worth telling you. Every email we do send will carry an unsubscribe link, and you can ask us to delete your address at any time.

Your IP address is used momentarily, in memory, to rate-limit the signup form against abuse. We do not store it and we do not send it to Brevo.

• Data: email address, submission date
• Purpose: telling you when Backlog Whisper launches, and sending product updates and sprint planning tips
• Legal basis: consent (Art. 6(1)(a) GDPR)
• Retention: until you unsubscribe, via the link in any email

Cookies

This website sets no tracking or marketing cookies. Your analytics consent preference is stored in your browser's localStorage, which stays on your device and is never transmitted to us.

3. The Backlog Whisper Jira app

This section covers the app itself rather than the website. It is a summary. The full policy is provided in-product and takes precedence where the two differ.

What the app processes

To generate insights, Backlog Whisper processes the content you make available to it. Depending on which features you enable, that can include the summary, description and acceptance criteria of your Jira issues; the content of sub-tasks and of comments added to stories in an active sprint; the standing context, jurisdiction and team rules you configure; the technologies, versions and compliance cadences you record in Tech Tracer; excerpts of Confluence pages if you integrate Confluence; and the titles and descriptions of other stories in the project, used to surface risks that span more than one story.

Content is sent to an AI provider

Backlog Whisper sends that content to the AI provider you choose: Anthropic, Google, OpenAI or Mistral, using an API key you supply. Your content is not routed through our servers. We do not control how an AI provider processes data on its side; refer to that provider's privacy policy. Anthropic, OpenAI and Google operate outside the EU and we rely on Standard Contractual Clauses for those transfers; Mistral is EU-based.

Masking before content leaves Atlassian

Before anything is sent to an AI provider, embedding endpoint or document classifier, Backlog Whisper automatically replaces common structured personal data with neutral typed placeholders: email addresses, telephone numbers, payment card numbers, IBANs, national identification numbers such as a Danish CPR number, IP addresses, and the display names of the Jira users on the issue. The provider receives only the placeholder and its type; the real value is restored solely in the result shown back to you in Jira. This is automatic and needs no configuration, but it is a best-effort pattern match, not a guarantee.

You can also add the label pii to any story. Backlog Whisper then withholds that story's description and acceptance criteria entirely and sends only its title.

The content listed above is authored by you and may itself contain personal data that no pattern can catch. You control what it contains and remain responsible for having the right to submit it.

Storage and usage statistics

Analysis results are stored in Atlassian Forge storage within your Atlassian environment for as long as the app is installed. We also collect pseudonymised usage statistics (interaction metadata with hashed identifiers, never issue titles, URLs or content) via PostHog, which is EU-hosted. Usage analytics are retained for 2 years.

4. Automated decision-making and AI output

Backlog Whisper uses AI to generate suggestions about your backlog. It does not make automated decisions that produce legal or similarly significant effects concerning any individual, within the meaning of Art. 22 GDPR. Its output is advisory: a person reviews each suggestion and decides what to do with it.

5. Data processors

We share data with the following third-party processors under contractual data processing agreements:

SCCs = Standard Contractual Clauses, a valid transfer mechanism under GDPR for transfers outside the EU/EEA.

6. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15): request a copy of the data we hold about you.
• Erasure (Art. 17): request deletion of your data.
• Portability (Art. 20): receive your data in a machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Restriction (Art. 18): ask us to limit how we use your data.
• Withdraw consent: at any time, with no effect on processing already carried out.

To exercise your rights, email hello@backlogwhisper.com. We respond within 30 days. If your request concerns Jira content processed by the app, please raise it with your own organisation first. They are the controller for that content.

7. Supervisory authority

If you believe we have not handled your data correctly, you may lodge a complaint with the Danish Data Protection Authority:

Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
dt@datatilsynet.dk · datatilsynet.dk

8. Changes to this policy

We may update this policy from time to time. Material changes will be noted at the top of this page with a revised date. We encourage you to review it periodically.