Privacy and Security Policy

Privacy Policy

1. Who we are

Controller / Provider: Software Dirk Sandhorst (“we”, “us”)
Contact: privacy@itc-sandhorst.de
Address: Wendlohstr. 185B, 22459 Hamburg, Germany

If you have privacy questions, contact us at the email above.

2. Scope

This Privacy Policy explains how Fast Estimate (“App”) processes data when installed and used in Jira Cloud via the Atlassian Marketplace.

It covers both the standard estimation functionality running on Atlassian Forge and the optional AI-supported estimation functionality (“Fast Estimate AI”). The AI functionality is only used when a user actively invokes it.

3. Data we process

Depending on how you use the App, we may process the following categories of data from your Jira site:

A) Jira project and issue data (read-only unless you explicitly trigger creation features)

• Project key and project identifiers
• Issue identifiers (issue id, issue key)
• Issue fields used for display or selection (e.g., summary, issue type, status, hierarchy level, parent references)

B) Estimation data entered by users in the App

• Work package titles
• Estimation values (e.g., min/max/guess, uncertainty percentages, derived/calculated values)
• Configuration settings (e.g., activity factors, calculation method, units, hours-per-point)

C) Data processed for the optional AI estimation feature (“Fast Estimate AI”)

• Issue summary / title
• Issue description
• User answers to AI follow-up questions during the estimation workflow
• The consolidated prompt generated from the issue content and user answers for estimating effort
• Optional project description entered by the user
• Estimation preferences and settings entered by the user, for example whether output should be in story points or time duration

D) Technical and operational data (minimal)

• Timestamps (e.g., last saved time)
• App-internal identifiers needed to store and retrieve records
• Basic logs for troubleshooting (if enabled)

We do not intentionally collect sensitive personal data. Please do not enter sensitive personal information into free-text fields.

4. Purposes of processing

• Provide the App’s functionality (create, display, and store effort estimates)
• Load and present selected Jira issues for estimation
• Generate AI-supported effort estimates when a user explicitly uses the optional Fast Estimate AI feature
• Save and retrieve estimation configurations for your project
• Maintain security, prevent abuse, and troubleshoot issues

5. Legal basis (GDPR)

Where GDPR applies, we process data:

• To perform the contract (providing the App’s requested functionality), and/or
• Legitimate interests (operating, securing, and improving the App), and/or
• Your consent where required (e.g., optional features you enable).

Your organization is typically responsible for ensuring it has the right to use Jira data with Marketplace apps.

6. Data storage and location

Fast Estimate runs on Atlassian Forge. Data entered into the App is stored using Forge storage associated with your Jira site and the App installation. We do not operate our own separate external database for this App.

For the optional Fast Estimate AI feature, certain data required to generate an estimate is transmitted to the OpenAI (https://api.openai.com) API for processing. This may include the issue summary/title, issue description, user answers to AI questions, the consolidated prompt, an optional project description, and selected estimation settings. This transmission occurs only when a user invokes the AI estimation feature.

Unless separately stated in the App or agreed otherwise, the App itself is not designed to persist such AI request content in an external database operated by us outside Atlassian Forge. However, data sent to third-party providers is processed on their systems in order to provide the requested response and is subject to their applicable service environment and terms.

7. Data sharing

We do not sell your data. We disclose or make data available to third parties only as necessary to provide the App and related services, for example:

• Atlassian, as the platform provider for Forge and Jira Cloud services;
• OpenAI (https://api.openai.com), as a service provider / processor for the optional Fast Estimate AI feature, solely for the purpose of generating the requested estimate when that feature is used; and
• Other service providers strictly necessary for operating our business (e.g., email or support tooling), where applicable.

Processing by third-party providers is subject to the contractual, technical, and organizational arrangements applicable to the respective service.

8. Data retention

We retain stored estimation data in Forge until:

• You delete it via the App (if available), or
• The App is uninstalled, or
• Your organization requests deletion (see “Your rights”).

We may retain minimal logs for a limited period for security and troubleshooting.

Where data is sent to the OpenAI (https://api.openai.com) API for the optional Fast Estimate AI feature, retention on third-party systems, if any, is determined by the applicable provider configuration, contractual terms, and technical service environment rather than by a separate storage system operated by us.

9. Security

We implement appropriate technical and organizational measures to protect data, taking into account the nature of the App and the services used. However, no method of transmission or storage is 100% secure.

10. Your rights

Where applicable, you may have rights to access, correct, delete, or restrict processing of personal data. To exercise rights, contact us at privacy@itc-sandhorst.de. We may need information to verify the request and the relevant Jira site.

11. International transfers

If data is processed outside your country (for example through Atlassian’s cloud infrastructure or through the OpenAI (https://api.openai.com) API used for the optional Fast Estimate AI feature), such transfers take place under the safeguards and transfer mechanisms made available by the relevant service providers, where applicable.

12. Changes

We may update this policy from time to time. We will update the “Last updated” date above.

13. Contact

For privacy questions or requests: privacy@itc-sandhorst.de