Introduction

StorPlan is offered as an add-on to Slack. When we process data while operating the app, we do so as an agent for you, as our StoryPlan customer, and are bound by your instructions. You as a StoryPlan customer are yourself responsible for processing the data in accordance with data protection law.

What data do we collect?

StoryPlan is a Slack app that you can use to conduct Planning Poker to estimate agile stories inside Slack. We can only offer this service if we store information about these stories, process and provide them. This includes:

• 1. Your Slack workspace name and ID - to uniquely identify your team
• 2. Your enterprise name (if you are using enterprise grid) - to uniquely identify your workspace in the organization
• 3. The title and description of agile stories you estimate with StoryPlan
• 4. Comments made on these stories using the comment function provided by StoryPlan
• 5. Both are required for the functions provided by StoryPlan app

When users intract with StoryPlan, we store certain information only the users who are interacting with the app. This includes:

• 1. User's name - so that StoryPlan can address you by name
• 2. Profile picture - used to show which of the users have voted
• 3. Email ID - used to get in touch when you ask for support / feedback
• 4. Time zone - In the case of asynchronous communicaiton, we don't send a message at an inappropriate time

Logs collected

We want you to enjoy using StoryPlan. In order to understand which functions you use regularly, we keep internal records of the features you use. These include:

• 1. An internal identifier of the function used
• 2. Date and time of use

We collect this data to ensure the security and availability of our offers. Repeated calls of our offers can be recognized and logged in order to recognize and prevent an abusive use of our offers in time. The collection of data is therefore required to offer our service. The data collected here is stored by us for a period of seven days and then deleted. This data will not be merged with other data sets. Form data such as passwords or application information is not saved in our records.

Information that we never store

Our app doesn't monitor your channels, or messages sent across by users unless they are specifically sent to StoryPlan app

We only store the iformation of the users interacting with our app. This means that if there are 700 users in your workspace, and only 10 of them are interacting with StoryPlan, then we store information about only the 10 of them.

Our external partners

We keep the number of partners with whom we work and who have access to your data to an absolute minimum. However, we cannot provide some services internally, so we work with the following partners:

• StoryPlan is hosted on servers of Heroku, with all storage and proccessing locations located inside the United States. Heroku is trusted by companies like Autodesk, Microsoft, Salesforce, Home Depot, New Relic, Atlassian, Financial Times etc.
• We use MongoDB Atlas for hosting our data. Atlas is trusted by big companies such as, Adobe, Google, Cisco, SAP, EA, Sega, 7-Eleven, KPMG for storing and processing their data
• When you use StoryPlan in your Slack workspace, we use interfaces provided by Slack Technologies, Inc. to record your stories and present them back to you. This requires thatt we share information about your stories, messages and StoryPlan users with Slack.
• Emails - for sending you emails, we use Twilio Sendgrid as our trusted partner. This requires us to send your data through Sendgrid's servers. The emails we send you may contain information like data export that you requested, or feedback messages.

Disclosure of personal information to third parties

We may disclose personal information to:

• third party service providers for the purpose of enabling them to provide their services, including (without limitation) IT service providers, data storage, hosting and server providers, ad networks, analytics, error loggers, debt collectors, maintenance or problem-solving providers, marketing or advertising providers, professional advisors and payment systems operators;
• credit reporting agencies, courts, tribunals and regulatory authorities, in the event you fail to pay for goods or services we have provided to you;
• third parties, including agents or sub-contractors, who assist us in providing information, products, services or direct marketing to you; and
• third parties to collect and process data

Your rights and controlling your personal information

Choice and consent: By providing personal information to us, you consent to us collecting, holding, using and disclosing your personal information in accordance with this privacy policy. If you are under 16 years of age, you must have, and warrant to the extent permitted by law to us, that you have your parent or legal guardian’s permission to access and use the website and they (your parents or guardian) have consented to you providing us with your personal information. You do not have to provide personal information to us, however, if you do not, it may affect your use of this website or the products and/or services offered on or through it.

Information from third parties: If we receive personal information about you from a third party, we will protect it as set out in this privacy policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person’s consent to provide the personal information to us.

Restrict: You may choose to restrict the collection or use of your personal information. If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by contacting us using the details below. If you ask us to restrict or limit how we process your personal information, we will let you know how the restriction affects your use of our website or products and services.

Access and data portability: You may request details of the personal information that we hold about you. You may request a copy of the personal information we hold about you. Where possible, we will provide this information in CSV format or other easily readable machine format. You may request that we erase the personal information we hold about you at any time. You may also request that we transfer this personal information to another third party.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details below. We will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading or out of date.

Notification of data breaches: We will comply laws applicable to us in respect of any data breach.

Complaints: If you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us using the details below and provide us with full details of the alleged breach. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take to deal with your complaint. You also have the right to contact a regulatory body or data protection authority in relation to your complaint.

Unsubscribe: You can opt-out from StoryPlan at anytime by deleting StoryPlan from your workspace. To unsubscribe from our e-mail database or opt-out of communications (including marketing communications), please contact us using the details below or opt-out using the opt-out facilities provided in the communication.

Payments

If may collect certain payment and billing information when you register for certain paid Services. For example, we ask you to designate a billing representative, including name and contact information, upon choosing a paid offering. You might also provide payment information, such as payment card details, which we collect via secure payment processing services.

Cookies

We use “cookies” to collect information about you and your activity across our site. A cookie is a small piece of data that our website stores on your computer, and accesses each time you visit, so we can understand how you use our site. This helps us serve you content based on preferences you have specified. Please refer to our Cookie Policy for more information.

Business transfers

If we or our assets are acquired, or in the unlikely event that we go out of business or enter bankruptcy, we would include data among the assets transferred to any parties who acquire us. You acknowledge that such transfers may occur, and that any parties who acquire us may continue to use your personal information according to this policy.

Limits of our policy

Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

Changes to this policy

At our discretion, we may change our privacy policy to reflect current acceptable practices. We will take reasonable steps to let users know about changes via our website. Your continued use of this site after any changes to this policy will be regarded as acceptance of our practices around privacy and personal information.

If we make a significant change to this privacy policy, for example changing a lawful basis on which we process your personal information, we will ask you to re-consent to the amended privacy policy.

StoryPlan Data Controller
Jai Pandya
support@storyplan.io

This policy is effective as of 4 September 2020.