Privacy & Cookie Policy

This describes what Issuelane collects, why, and what you can do about it. Anyone can sign up, so it is written for you rather than for a procurement department.

Who is responsible

[TO BE CONFIRMED: registered company name and legal form], at [TO BE CONFIRMED: street and number], [TO BE CONFIRMED: postal code and city], [TO BE CONFIRMED: country], is the controller of your account data. The full company details are on the legal notice page.

• Privacy questions and requests: privacy@cublya.com
• Data protection officer: [TO BE CONFIRMED: data protection officer and their address, or that none is appointed]

There is a second half to this, and it matters for who you ask. Your account is ours to answer for. What a workspace puts into Issuelane, the tasks and comments and files, belongs to that workspace, and we handle it on the workspace’s instructions rather than our own. The data processing agreement page sets out that split.

What we collect

Four things, and nothing else.

• Your identity. The email address you sign in with and the account identifier we give you. You sign in with an email address and a password, of which we keep only a salted hash and never the password itself, or with a link sent to your address, or, if you choose it, with Google, in which case Google returns your name, your email address, whether Google has confirmed that address and a link to your profile picture. Sign-in runs on our own servers.
• Your work. The workspaces, teams, memberships, projects, tasks, labels and task history you create. This is the service; it is stored in a PostgreSQL database and scoped so that a workspace can only be read by its own members.
• A record of what you agreed to. Each time you accept the Terms of Service (at sign-up, or when we ask you to accept a new version), we keep which version of the terms and of this policy you were shown, how you answered, the time, your IP address, your browser’s user agent and your language setting. While you are signed in, your answers in the cookie choices banner are kept the same way: for each optional category, whether you allowed it and under which version of this policy, with the time, your IP address, your browser’s user agent and your language setting. It is there so we can show what was agreed and when, and it is kept for as long as your account exists.
• Operational records. Server logs and error reports, kept so the service can be run and debugged. They are written on our server and sent on to Grafana Labs, which collects them with the server’s metrics. They can contain request paths, request metadata including IP addresses, error messages and, in a few mail events, the address a message was for. The API and the background worker also send Grafana Labs a trace of each request and job: its timings, the route pattern rather than the full address, the status, request and job identifiers, and the type and code of an error, never its message or anything you wrote. Also rate limit counters: how many requests came from one IP address or account in a short window, stored under a hashed key rather than the address itself, so the service can refuse floods and password guessing.

Two more things reach us only if you send them or choose them: the messages you send through the contact form, described below, and, if you accept them, the visit statistics described under cookies.

We do not buy data about you from anyone, and we do not sell or share yours. There is no advertising in Issuelane and no profiling. Nothing here decides anything about you automatically.

You have to give us an address to have an account, because that is what an account is. Everything else is optional: a display name, a picture, signing in with Google, product update emails, and whatever you choose to write.

Cookies and local storage

Issuelane sets no advertising cookies and no analytics cookies. What the browser stores is:

• Your session. A cookie Issuelane sets so you stay signed in. Necessary; the service cannot work without it.
• Your preferences. Your theme, whether the sidebar is collapsed, and which workspace you last had open. Necessary in the sense that they are only about making the interface behave as you left it, and they never leave your browser.
• Your privacy choice. Stored in local storage under cublya-consent, with the policy version and the time you chose, so we do not ask again on every visit. It is valid for twelve months or until this policy changes, and then we ask again.
• That your privacy choice reached your record. When you are signed in and your choice has been saved on our server, local storage keeps a note under cublya-consent:recorded: followed by your account identifier, holding that choice, its policy version and its time, so the same choice is not sent again on every visit.

Those four are strictly necessary, which is the category the law does not require us to ask about. One more thing is optional, and it is the reason the banner asks:

• Visit statistics. Cloudflare Web Analytics, which tells us how many people visit and which pages they read. It loads only after you allow it in the cookie choices banner, and never before. It does not set cookies. While it runs, Cloudflare counts page views and reads the page address, the referrer, browser and device information and the country it derives from your IP address. If you reject, it does not load.

You can change your choice at any time from the cookie settings link in the footer, and changing it back to no is exactly as easy as saying yes was. If you withdraw, the page reloads so the script stops. If your browser sends a Global Privacy Control signal, we treat it as a refusal until you choose, and we do not ask; you can still override it by allowing visit statistics yourself, which is you changing your own mind rather than us ignoring you.

Messages you send us

The contact form sends what you type to the people who run Issuelane: your email address, your message and the topic you picked. The message goes by email through Resend to our support mailbox; until it has been sent, the job that carries it waits in our own queue, which is part of our database. We use it to answer you, on the basis of our legitimate interest in replying to people who write to us.

Why we are allowed to

• To provide the service. Your identity and your work are processed to perform the contract described in the Terms of Service.
• To keep it running and secure. Operational records are processed on the basis of our legitimate interest in a service that works and is not abused.
• To show what you agreed to. The record of your answers is kept on the basis of our legitimate interest, and our obligation, in being able to demonstrate that you agreed and what you agreed to.
• To answer you. Messages sent through the contact form are processed on the basis of our legitimate interest in replying.
• With your consent. Anything optional, which today is the Cloudflare visit statistics you allow in the cookie choices banner. You can withdraw it at any time from the cookie settings link in the footer, and withdrawing does not undo what was lawful before you did.

Who else sees it

The other members of every workspace you belong to see the work you put in that workspace. Beyond them, only the providers that run the service: the server in Germany that runs the application and holds the database, Cloudflare, which serves the pages, carries requests to the server and stores files and database backups, Resend, which sends email, and Grafana Labs, which collects the server’s logs, metrics and traces. If you choose to sign in with Google, Google sees that sign-in too. Each is named, with what it does and what reaches it, on the subprocessors page. Apart from Google, which you bring in yourself, each processes data on our instructions and for no purpose of its own. We disclose data to anyone else only when the law requires it.

Data leaving Europe

Where each provider processes, and whether anything reaches a country outside the European Economic Area, is stated per provider on the subprocessors page, together with the mechanism that covers it. A transfer out of the EEA is only ever made under one of the mechanisms Chapter V of the GDPR allows: a European Commission adequacy decision for the country, or the Commission’s standard contractual clauses. If you want a copy of the clauses that cover a particular provider, ask at privacy@cublya.com and we will send it.

How long we keep it

• Your account and your work: for as long as the account exists. Deleting a task, a comment or a workspace deletes it. Deleting your account does what the next section describes.
• Database backups: a backup of the whole database is kept in Cloudflare R2 for about four to five weeks, then replaced. Anything deleted, an account included, stays in the backups until they rotate out, and is only ever read back to restore the service after a failure.
• Sign-in sessions: a session works until you sign out, when it is deleted, or until seven days after you last used it. One that ran out on its own is deleted from the database: [TO BE CONFIRMED: when expired sign-in sessions are deleted]
• Rate limit counters: deleted within about two hours after their window ends; the longest window is one day.
• Server logs: [TO BE CONFIRMED: how long server logs are kept]
• Error reports: [TO BE CONFIRMED: how long error reports are kept]
• An export you asked for: 7 days, after which the file is deleted automatically. The record that you asked, and when, is kept as the receipt.
• Your privacy choice: twelve months or until this policy changes, in your own browser.
• The record of what you agreed to: as long as your account exists. It is deleted with the account.

Getting a copy of your data

Profile settings has a button. Press it and we build one JSON file holding your profile, the workspaces and teams you are in, the tasks you created, the tasks assigned to you, the comments you wrote including the ones you retracted, your reactions, ideas and votes, your saved views, your notification settings, the notifications sent to you, the details of files you uploaded, and the invitations you sent. It takes a minute or two to build and then it is yours to download for 7 days.

The file says inside itself what it does not contain, so it still makes sense to whoever opens it a year from now. It does not carry other people’s tasks and comments, because those are their data and not yours; it does not carry the contents of uploaded files, only the list of them; and it does not carry your password hash, your sessions or your sign-in links, which exist only to sign you in.

A workspace admin can separately export the whole workspace, which is a different thing for a different reason: that one is the workspace’s data, and it comes out in the format an import reads.

Deleting your account

Also in profile settings, also a button, and it happens immediately. There is no waiting period and no way to undo it, so we ask you to type your address before it runs.

What is deleted:

• Your name, your address, your picture and your sign-in identifier, all cleared from the account row.
• Your sign-in records: the sign-in account, your password hash, any linked Google sign-in, every session, and any sign-in, confirmation or password reset link that was still waiting to be used.
• The record of what you agreed to and when, with the IP address, user agent and language setting it was given from.
• Everything addressed only to you: your notifications, your notification settings, your saved views, your votes and reactions, your workspace and team memberships, and any export files you had asked for.
• Any workspace where you were the last person in it. It goes with you, because a workspace nobody can reach is one nobody can ever ask us to delete.

What stays, and why:

• Tasks you filed, comments you wrote and files you uploaded in workspaces other people are still using. They are attributed to a former member rather than to you. Unpicking a colleague’s bug report because the person who filed it left would take their record away too, and the law allows us to keep it for that reason.
• The account row itself, emptied of you, so that those attributions still resolve to something. Being plain about it: this makes you unnamed, not untraceable. One former member’s contributions are still linked to each other. That is a deliberate trade and we would rather say so than call it erasure.

Two things will stop the deletion, and both are fixable in a minute. If you are the only owner of a workspace that other people are still in, we name those workspaces and ask you to make somebody else an owner first, so the people left behind are not locked out of their own work. If we hold no address for your account there is nothing to type, and support has to do it for you.

Deletion reaches the live database at once. The backups taken before it still hold the account until they rotate out, about four to five weeks later.

Afterwards you cannot sign back in. Signing up again, with the same address or the same Google account, gives you a new, empty account. Sign-in runs on our own servers, so nothing you signed in with is left behind on our side apart from what is listed above. If you used Google, your Google account is yours and is not touched; you can remove Issuelane from the apps connected to it in your Google account settings.

Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to anything we do on the basis of our legitimate interest, and ask for your data in a portable form. Correcting your name, exporting your data and deleting your account are all in profile settings and need nobody’s permission. For anything else, write to privacy@cublya.com and we will answer within one month. It costs nothing.

If you are unhappy with how we answered, you can complain to a data protection supervisory authority: the one where you live or work, or [TO BE CONFIRMED: lead supervisory authority and the address of its complaints page].

How it is kept safe

The security page says what protects your data and, just as plainly, what is not in place yet.

Changes

We may update this policy. The date at the top changes when we do, and a change that materially affects you will be told to you rather than left for you to notice.