BrekkoPrivacy policy
1. Who we are
Brekko is run by keram.it MAREK TOMCZYK (Marek Tomczyk), Jarzębinowa 126, 42-620 Nakło Śląskie, Poland, NIP 6452576701. Contact: privacy@brekko.eu. We have no data protection officer.
Brekko, not Atlassian, is responsible for the data Brekko processes, including the data it reads from or sends to Jira.
2. Scope and roles
This policy covers the website at brekko.eu and the Brekko app at app.brekko.eu.
Your organisation controls its Brekko workspace: its users, projects and plans. We process that data on your organisation's behalf. We are the controller for the website, for support emails and for the data we keep to protect the service.
The data comes from your organisation's admin (who invites you), from you, and from your organisation's Jira site when you connect it.
3. What we process and why
| Data | Why | Legal basis |
|---|---|---|
| Email, display name, role, password hash, and hashes of invite and password-reset links | Your account and sign-in | Art. 6(1)(b) GDPR |
| Session and sign-in cookies | Keep you signed in, protect forms | Art. 6(1)(b) |
| Email and IP address, kept 15 minutes in memory | Stop password guessing | Art. 6(1)(f) |
| Encrypted Atlassian tokens; Jira site, project key, epic key, summary and status | Read and write Jira on your behalf; show epic status in the plan | Art. 6(1)(b) |
| Projects, WBS and memberships | The service itself | Art. 6(1)(b) |
| Emails you send us | Answer support and privacy requests | Art. 6(1)(b) or 6(1)(f) |
When you create a Jira epic from Brekko, its description, labels and priority go straight to Jira. Brekko keeps only the epic's key, summary and status.
4. What we don't do
- No selling of data, no ads, no analytics and no tracking cookies.
- No profiling and no automated decisions about you.
- We don't store your Atlassian account id or profile.
- Brekko is not meant for anyone under 16.
5. Who receives data
These processors work for us under our instructions:
- Hostinger hosts the server (VPS) that runs the app and stores our nightly database backups, in a Hostinger data centre in Lithuania (EU).
- Neon (a Databricks company) hosts the app's database (managed PostgreSQL) on Amazon Web Services in Frankfurt, Germany (EU).
- Cloudflare runs our DNS, delivers the website and the app (Cloudflare Pages), and forwards email sent to our brekko.eu addresses (Cloudflare Email Routing). To deliver pages, Cloudflare handles visitors' IP addresses.
Google (Gmail) is an independent provider. Emails sent to hello@brekko.eu, support@brekko.eu and privacy@brekko.eu are forwarded by Cloudflare Email Routing to a Gmail mailbox, from which we also reply. Google processes these emails under its own terms and privacy policy.
Atlassian (Jira Cloud) is a third party. It receives data only when you connect Jira, and then only what Brekko needs to read your epics and create the ones you ask for. Atlassian handles that data under its own terms.
Authorities receive data only when the law requires it.
6. Transfers outside the EU
Our server and database are in the EU. Neon is a US company; transfers to it, for example for support or operations, rely on the Standard Contractual Clauses in its data processing agreement. Cloudflare, Inc. is a US company; transfers to it rely on the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses (Decision 2021/914). Google, which receives our forwarded email, is also a US company; it handles that email under its own terms. When you connect Jira, Atlassian transfers data under its own terms and safeguards.
7. How long we keep data
Today, deactivated accounts are kept and can't be deleted in the app. Write to privacy@brekko.eu and we'll delete your account by hand. Disconnecting Jira deletes Brekko's copy of your Atlassian tokens; the tokens are kept while an account is only deactivated. To revoke access fully, also remove Brekko in your Atlassian account settings.
- Sessions end after 8 hours without activity, or when you sign out.
- Sign-in throttle entries (email and IP address) are kept 15 minutes in memory.
- The hashes of used and expired invite and password-reset links are kept with the account.
- Projects, plans and memberships are kept, archived projects too, until your organisation asks us to delete them.
- Neon keeps the database's history for up to 6 hours, for restores. Our nightly database backups are kept for 14 days, and any off-site copies of them are also kept for at most 14 days.
- Server logs are rotated at 10 MB, keeping five files per service. The reverse proxy keeps no access log, but its error log can include a visitor's IP address, for example when the app can't be reached.
8. Your rights
You have the right to access your data, correct it, have it deleted, restrict its use, take it with you, and object to processing based on our legitimate interests (Art. 15–18, 20 and 21 GDPR). Ask your organisation's admin or write to privacy@brekko.eu; we reply within one month.
To revoke Brekko's access to Jira, use Disconnect in Brekko, then remove Brekko under Connected apps in your Atlassian account. Disconnecting in Brekko alone doesn't revoke the access at Atlassian.
9. Complaints
You can complain to the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa.
10. Security
- TLS encryption for every connection.
- Atlassian tokens encrypted with AES-256-GCM; passwords stored only as hashes.
- Jira access limited to the scopes Brekko needs.
- Hosting in the EU.
- If a breach happens, we notify the UODO within 72 hours, affected organisations without undue delay, and Atlassian within 48 hours.
12. Changes
We tell users about changes to this policy, and Atlassian about material ones. The date and version at the top of this page show which version applies.
Legal notice
Provider: keram.it MAREK TOMCZYK (Marek Tomczyk), Jarzębinowa 126, 42-620 Nakło Śląskie, Poland, NIP 6452576701. Email: hello@brekko.eu.