This privacy policy covers Synketto, the web dashboard that puts Jira and Azure DevOps work items on the same board and keeps them in sync in both directions. It covers two things: the public website synketto.com, with its form to join the beta, and the Synketto application used by teams, available at prod.synketto.com.
Who processes the data, and in what role
The service is provided by Dekkosoft di Michele Laccone, a sole proprietorship based in Italy, VAT number IT11571141008. Contact: info@dekkosoft.it. I have not appointed a Data Protection Officer (DPO), as I am not required to.
Synketto is used by companies and teams (“Customer”) that connect their own Jira and Azure DevOps accounts. This means there are two roles:
- For the data contained in Jira and Azure DevOps work items (titles, descriptions, states, assignees, reporters, comments, attachments and other fields) and for the reports the service derives from them, including those on people’s workload and on application usage shown to the Customer’s administrators, the controller is the Customer. Dekkosoft is a processor under Article 28 of the GDPR: it processes that data only to provide the service and on the Customer’s instructions. The data processing agreement (DPA) is available on request at info@dekkosoft.it.
- For the synketto.com website, for the accounts of the application’s users and for the security of the service, the controller is Dekkosoft.
If you appear in the work items of a company that uses Synketto (for example as the assignee or reporter of a ticket), please contact that company first for information about your data and to exercise your rights. If you write to me, I will forward your request to the company and help it reply.
In short
- Synketto reads and changes Jira and Azure DevOps work items only with the credentials the user enters, and only to display and sync them.
- I do not sell data and I do not use application data for advertising or profiling.
- The server hosting the website is in the European Union.
- On the website, analytics and campaign measurement tools (Microsoft Clarity and Reddit Pixel) run only if you give your consent.
The synketto.com website
Beta access form. Name, email (required), team size (1-5, 6-15, 16-20, 21+) and a message (required) describing the problem you want to solve with Synketto. Along with the form, the date and time of submission, IP address, browser type and referring page are stored. I receive a copy of the request by email and send you a confirmation email. I use this data only to handle your beta access request and to contact you about the beta. I do not subscribe you to any newsletter.
Spam protection (Google reCAPTCHA). The form uses Google reCAPTCHA to check that it is filled in by a person and not a bot. To do this, Google receives your IP address, information about your browser and device and about how you interact with the page, and may set its own cookies. The service is provided by Google Ireland Limited and is governed by Google’s privacy policy.
Emails sent by the website. Emails (the copy of the request and the confirmation) are sent from the website’s mailbox through the email provider Aruba. The website keeps a copy of sent emails in a log for 12 months.
Analytics and campaign measurement. With your consent, the website uses:
- Microsoft Clarity, to understand how the website is used: it records pages visited, clicks, scrolling and mouse movements, including as an anonymised replay of the visit, and uses cookies and browser identifiers.
- Reddit Pixel, to measure visits coming from advertising campaigns on Reddit. It uses cookies and browser identifiers, and Reddit may link the visit to your Reddit account if you have one.
You can refuse or withdraw your consent at any time from the cookie banner, without affecting your use of the website.
Fonts. The website’s fonts are hosted on the website’s own server and are not downloaded from Google.
The Synketto application: what data it processes
User accounts. There is no public sign-up: accounts are created by an administrator. The service stores username, email, role (super administrator, administrator, operational user, read-only user), account status, date and number of logins, date of the last password change and the password, stored only in hashed form. When an account is created, the user receives a temporary password by email, to be changed at first login.
Integration credentials. To connect the boards, the user enters the Azure DevOps organisation and project with a Personal Access Token (PAT), the Jira domain with the Jira account email and API token, and the queries and filters to use. These credentials are stored in the service’s database and are used only to call the Atlassian and Microsoft APIs on the user’s behalf. I recommend creating tokens with only the permissions needed and with an expiry date, and revoking them in Jira and Azure DevOps when you stop using Synketto.
Work item data, processed on behalf of the Customer. To display and align the boards, the service reads work items and related data from Jira and Azure DevOps: title, description, state, priority, type, tags and labels, sprints, epics, versions, custom fields, names, emails and profile pictures of assignees and reporters, attachments. At the user’s request it creates or updates work items and copies content and attachments from one system to the other. This data is:
- kept in a cache on the server for a few minutes, to avoid repeating the same calls;
- stored as lookup lists (states, assignees, reporters, epics, sprints, labels and the like) to fill filters and menus;
- stored as daily snapshots for the analytics and audit pages (cycle times, workload per assignee, SLA compliance, bug trends);
- used for in-app notifications (title and state of changed work items).
Attachments copied between the two systems pass through the server only as temporary files. Reports on workload and times per assignee concern people: the Customer decides whether and how to use them, and must comply with the rules on employee monitoring that apply to it.
Security logs. The service logs login attempts (username used, IP address, date and time, outcome) and blocks access for 15 minutes after too many failed attempts. It also logs sessions: start, end, last activity, IP address and browser type. Password reset links expire after one hour.
Usage statistics. The service records actions taken in the application (pages visited, syncs, exports, button usage, with date, time and the resource involved) and produces daily summaries. They are used to run and improve the service and to show the Customer’s administrators how it is used.
Feedback. If you send feedback from the application, the service stores the text, the type of report, the page you sent it from, your username, your browser type and screen resolution, so that I can reply and fix the problem.
Service emails. The application only sends account-related emails: new account credentials and password reset links.
Purposes and legal bases
As a processor, on behalf of the Customer. I process work item data, snapshots and the reports derived from them only to provide the service: display them, sync them, compute analytics and audits, send notifications. The legal basis for this processing is determined by the Customer, as controller.
As a controller.
- Managing accounts, integration credentials and service emails, providing the service and support: performance of the contract with the Customer and of steps requested by the user (Art. 6(1)(b) GDPR).
- Handling beta access requests from the website: pre-contractual steps taken at your request (Art. 6(1)(b)).
- Protecting the website and the service (reCAPTCHA on the form, login and session logs, blocking failed attempts): legitimate interest in security and abuse prevention (Art. 6(1)(f)).
- Application usage statistics and feedback, to run and improve it: legitimate interest (Art. 6(1)(f)).
- Microsoft Clarity and Reddit Pixel on the website: consent (Art. 6(1)(a)), which can be withdrawn at any time.
- Tax and legal obligations, if and when the service becomes paid: legal obligation (Art. 6(1)(c)).
Providers and recipients
- Contabo GmbH (Germany), provider of the virtual server running the synketto.com website, in a data centre in the European Union. Application and application database: on the same Contabo server as the website.
- Aruba S.p.A. (Italy), email provider for emails sent by the website.
- Application email service, for credentials and password resets: Aruba, in Italy.
- Internal backups of the website and the application, stored in the European Union.
- Google, for reCAPTCHA on the website form and for the fonts loaded by some application pages.
- Microsoft (Clarity) and Reddit, for website analytics and campaign measurement, only with your consent. For data collected by Reddit Pixel, Reddit acts as an independent controller.
- Library providers for application pages (cdn.tailwindcss.com, jsDelivr, Cloudflare cdnjs): they receive your IP address when your browser downloads the resources.
- Atlassian (Jira) and Microsoft (Azure DevOps) are the services the Customer connects to Synketto. They are not Dekkosoft’s providers: the data held there remains governed by the Customer’s contract and privacy terms with them.
Data is not passed on to third parties for marketing. It may be disclosed to authorities only where required by law.
Where the data is and transfers outside the EU
The website is hosted on a Contabo server in the European Union. Some of the providers listed above (Google, Microsoft, Reddit, Cloudflare and the other library providers) may process data in the United States or other countries outside the EU. In those cases the transfer is based on the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the standard contractual clauses provided for in each provider’s terms. Where data is stored in Jira and Azure DevOps depends on the region the Customer chose with Atlassian and Microsoft.
How long data is kept
- Work item cache: a few minutes (5 minutes unless configured otherwise). Password reset links: one hour. Failed login attempts: deleted after a successful login or when the lockout expires.
- Accounts, integration credentials and settings: as long as the account is active. When an account is deleted: within 30 days settings, integration credentials and activity are permanently deleted and the account is anonymised.
- Work item data, daily snapshots, reports and usage statistics: for the duration of the contract with the Customer. At the end I delete or return them according to the Customer’s instructions.
- Login and session logs: 12 months.
- Beta access requests and emails sent by the website: until the end of the beta and for 12 months after that; emails sent by the website stay in the log for 12 months.
- Backups: at most 30 days.
- Data that must be kept by law, such as tax records: for the period required by law (usually 10 years).
Cookies, local storage and external resources
In the application. A technical session cookie keeps the user logged in and expires at the end of the session. The browser’s local storage (localStorage) only keeps the default field values the user chooses when creating work items in Jira or Azure DevOps, and stays in their browser. Some pages load fonts and libraries from external services (Google Fonts, cdn.tailwindcss.com, jsDelivr, Cloudflare cdnjs) and may display Jira users’ profile pictures from Atlassian’s servers: to download them, the browser sends these services its IP address and technical browser information. The application does not use profiling cookies or third-party analytics tools.
On the website. WordPress uses technical cookies to work and for the administrators’ area. Google reCAPTCHA uses its own cookies for spam protection. Microsoft Clarity and Reddit Pixel use analytics and marketing cookies only after your consent.
Security
Account passwords are stored only as hashes. After repeated failed logins access is blocked for a while, inactive sessions expire, and roles and permissions separate who can make changes, who can only view and who can access the settings. In the event of a data breach, I notify the Italian Data Protection Authority, the Customer and, where necessary, the people affected, as required by the GDPR.
Children
Synketto is a service for companies and professionals and is not directed at children.
Your rights
You have the right to request access to your data, rectification, erasure, restriction of processing and portability, and to object to processing based on legitimate interest. If you gave consent, you can withdraw it at any time, without affecting processing already carried out.
For work item data the controller is the Customer: please contact them, and I will help them reply. For data for which I am the controller, write to me at info@dekkosoft.it: I reply within one month. I do not take decisions based solely on automated processing that have legal effects on you.
You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it, or with the supervisory authority of the country where you live or work.
Changes
If the service changes significantly, for example with a new provider, I will update this policy and inform the Customers’ administrators. Last updated: 11 October 2026.