ScopeProfit — Privacy notice

Effective 20 September 2026.

Responsibility and contact

The provider named in the Legal Notice is responsible for its own processing of enquiries, support correspondence and business records. Customers ordinarily determine the purposes of processing their Jira project information; for that processing the provider acts on their documented instructions under the DPA. Atlassian and other providers can also process information independently for their own account administration, security, billing and legal purposes.

Contact support@profitsignallabs.dev for privacy questions. Provide only enough information to identify the relevant site and request; do not send passwords, API tokens, bank details or unnecessary issue content.

What the app processes

The app reads project identifiers and names, issue keys and summaries, original estimates, status categories, due dates and version identifiers. It stores project configuration, entered contract values and hourly rates, baseline snapshots and history, scope events, change orders, decision timestamps and explicit Atlassian account identifiers for recorded decisions. Free-form issue summaries may contain personal data entered by customers.

Jira reads run as the signed-in user. Financial actions additionally check project permissions on the server. App records are stored in Atlassian Forge-hosted storage for the installation. The current manifest declares no external network destination. The app does not intentionally log issue content, account identifiers or financial records; platform operational logs and identifiers may still exist.

Purposes and legal bases

Customer project information is processed to provide scope comparisons, commercial forecasts, records, support and security under the customer's instructions. For the provider's own records, enquiries and service communications are processed to take requested steps or perform the service; proportionate security and support administration rely on legitimate interests; required business records are retained to meet applicable legal obligations. These purposes do not authorize unrelated marketing.

Providers and transfers

Atlassian provides Jira, Forge execution, storage and platform services. Atlassian's applicable Forge terms, data-processing arrangements and transfer safeguards govern its processing for the provider. Support correspondence is handled separately through the provider's Porkbun-hosted mailbox and its underlying email service providers. The public product website's hosting provider also receives the technical information needed to deliver the website. Project data is not routinely copied to the website or support mailbox.

Data may be processed outside the customer's country in accordance with the applicable provider arrangements. Customer project records in Forge KVS and Custom Entity Store inherit the Jira host data-residency location through Atlassian Forge. This covers stored app records, not all transient compute, platform logs, account administration, the informational website or support correspondence. No EU-only processing guarantee is made for those ancillary services. The informational website is hosted through OpenAI Sites on Cloudflare infrastructure. The app does not transmit Jira project records to that website or to the support mailbox. The general mailbox is for minimal enquiries, not customer project records. A channel covered by appropriate processing terms must be agreed before those records are accepted for support. We do not represent Porkbun as an authorized recipient of customer project records under the app DPA.

Our support portal uses Atlassian Jira Service Management. It processes the contact details, request text, status history and any attachments you provide so we can investigate and track your request. This is separate from the Jira data processed by the app: the app does not automatically copy project records into support tickets. Use minimal, redacted examples; do not submit credentials or private issue exports. Atlassian provides the ticketing platform under its applicable service and data-processing arrangements. Support correspondence retention and rights described in this notice also apply to tickets.

Retention and deletion

Project app records remain available while the installation is retained unless erased through Data controls or another verified support process. Authorized project administrators can permanently erase app records for a project; this leaves Jira issues unchanged. An interrupted erasure can be resumed. A non-personal revision counter may remain for concurrency protection.

Atlassian currently documents 28 days of Forge hosted-storage retention after uninstall. Recovery requires customer consent and a request within 21 days. Uninstallation is governed by Atlassian's hosted-storage lifecycle, including platform retention and recovery windows. It is not represented as immediate destruction of every platform backup. Data remaining in platform retention is subject to applicable contractual protections.

The app periodically reports explicit account references and their oldest stored timestamps to Atlassian's privacy API and removes those references when instructed. It does not send issue summaries to that endpoint. A resumable maintenance record temporarily holds identifiers until the cycle completes. This process does not identify names or other personal information typed into free-form issue summaries; the customer or support must handle those records separately.

Support correspondence is retained only for the enquiry, follow-up and any applicable legal need. Retention is reviewed when an enquiry closes and when an erasure request is received; records no longer needed for follow-up or a documented legal purpose are removed through a manual process. No automated mailbox deletion or immediate backup erasure is promised.

Rights

Where applicable, individuals may request access, correction, erasure, restriction, portability or object to relevant processing. Requests about a customer's project data should normally be directed to that customer; the provider will assist under the DPA. The provider may verify identity proportionately. Individuals may complain to the competent supervisory authority, including Spain's Agencia Española de Protección de Datos (AEPD). No solely automated decision producing legal or similarly significant effects is offered by ScopeProfit.

Website and updates

The current static website code contains no advertising or analytics tracker. Hosting infrastructure may still handle requests and security logs. Any future non-essential tracking will be disclosed before activation. Material policy changes will be communicated as required by applicable law and the agreement.

Provider: Jon Ander Irazusta Iribar, trading as ProfitSignal Labs. See the Legal notice for the postal address. Customer processing terms and security measures appear in the Customer terms linked above.