Privacy policy

1. Controller

The controller is DynaSoft Sàrl, 4a, op der Haart, L-9999 Wemperhardt, Luxembourg. Data protection contact: andreas.plumacher@dynasoft.lu.

2. Data processed

• Account and contact details, language and password hash
• Workspaces, memberships, roles and permissions
• Projects, tickets, documentation, time entries, comments and attachments entered by users
• Plan, usage, storage and recorded acceptance information
• Technical information strictly required for security, diagnostics and abuse prevention

3. Purposes and legal bases

• Account creation, service delivery and performance of a contract or pre-contractual steps
• Security, reliability and abuse prevention based on legitimate interests
• Compliance with legal duties, including accounting and tax obligations
• Consent only for clearly offered optional processing

4. Hosting and security

Production infrastructure and files are hosted with OVHcloud in Frankfurt, Germany. DynaSoft applies role-based access controls, encrypted transmission and safeguards against unauthorised access.

5. Artificial intelligence features

AI features use a self-hosted Ollama instance controlled by DynaSoft. Content is not sent to an external public AI provider.

6. Recipients and subprocessors

The list will be updated before any additional provider is activated. Stripe is not currently enabled for payments.

• OVHcloud – server, network and infrastructure hosting in Germany
• DynaSoft-operated Ollama instance – internal AI processing without an external AI subprocessor

7. Cookies

Only technically necessary authentication, security and language settings are used. Sprint.manager currently uses no analytics, marketing or tracking cookies, so no consent banner is displayed.

8. Deletion and retention

• Active data is processed while the account or workspace is in use.
• Self-service deletion is not yet available. A verified request can be sent to andreas.plumacher@dynasoft.lu and will be handled without undue delay.
• Workspace content and files are deleted or anonymised when no longer needed for the service or legitimate evidence purposes.
• Accounting documents may be retained for ten years from the end of the relevant financial year under Luxembourg requirements.
• Some data may be restricted for longer where required by law or for legal claims.

9. Your rights

• Access and a copy
• Rectification
• Erasure or restriction subject to overriding duties
• Data portability where applicable
• Objection to processing based on legitimate interests
• Complaint to the Commission nationale pour la protection des données (CNPD), Luxembourg

10. Changes

This policy will be updated for new features, providers or legal requirements. Its version and date are shown on this page.