Privacy Policy

Effective date: 2026-04-27 Last updated: 2026-06-09 Version: 1.0.4

1. Introduction

This Privacy Policy describes how CT Core (operated by Viktar Martavitski as a sole proprietorship registered with the Polish Central Registration and Information on Business — CEIDG) collects, uses, stores, and discloses Personal Data in connection with the Threadmaker product ("Threadmaker", the "Service"), which provides bidirectional synchronization of comments between Atlassian Jira Cloud and Slack workspaces.

This document is issued in accordance with Regulation (EU) 2016/679 ("GDPR"), the Polish Act on the Protection of Personal Data of 10 May 2018, and other applicable data protection laws.

2. Data Controller

CT Core acts as an independent Data Controller for account administration, billing, security, fraud prevention, operational telemetry, support, and compliance-related processing described in this Policy.

For customer content transmitted through the Service on behalf of customer organizations, and for customer-content synchronization metadata (including comment-mapping records) insofar as such metadata is required to provide the synchronization functionality requested by the Customer, CT Core generally acts as a Data Processor under the applicable Data Processing Addendum (see threadmaker.dev/dpa).

3. Categories of Data Subjects

Depending on how the Service is used, we may process Personal Data relating to the following categories of individuals:

• administrators of Slack workspaces and Atlassian Jira sites who install, configure, or manage the Service;
• end users whose messages, comments, or other content are processed through the Service;
• individuals communicating with us for support, operational, or business purposes;
• visitors to threadmaker.dev and related websites.

The specific categories of Personal Data processed may vary depending on the nature of the interaction with the Service and the applicable processing context.

This Policy does not apply to data processed by Slack, Atlassian, or other third-party platforms except to the extent that data is transmitted to CT Core for processing.

4. Personal Data We Collect

4.1 Data collected at installation

Threadmaker does not store Jira API tokens. All Jira operations are executed by the Forge plugin running inside Atlassian's runtime under the customer's licensed tenant using api.asApp().requestJira(). CT Core never receives, holds, or transmits long-lived Jira credentials.

4.2 Data processed in transit (content)

When end users post messages in mapped Slack channels/threads or comments on mapped Jira issues, the Service temporarily processes:

• Message text (including formatted rich text);
• Attachments up to 2 MB each, maximum 5 per comment (files are relayed binary and are not intentionally retained after delivery completion, except for temporary retry/recovery handling);
• Author identity (Slack user ID / Jira account ID);
• Timestamps and thread references.

Retention of content — message content is processed transiently for synchronization purposes and is not intentionally retained beyond the period reasonably necessary to complete delivery, retries, incident handling, or short-term operational recovery:

Attachments are not persisted after delivery completes; failed deliveries drop the file reference after 30 days.

4.3 Operational logs

Cloudflare Workers produce request logs (source IP, user agent, response code, path) used for security and abuse detection. These logs are retained by Cloudflare for up to 7 days and are not cross-referenced with content.

5. How We Use Personal Data

We do not, and do not permit any sub-processor to, use Customer Data, content messages, or attachments for AI / ML — including to train, fine-tune, or evaluate foundation models, retrieval indexes, or recommender systems — or for advertising, profiling, automated decision-making, or any purpose other than synchronization.

5.1 Operator-side data minimization (v1.4.1)

The tm-admin portal applies pseudonymization at the display layer for personal data shown to CT Core internal staff:

• Pseudonymous identifiers (Slack user IDs U…, Jira account IDs 557058:…) are masked by default in the /triage audit timeline. Operator must explicitly click 👁 to reveal a specific row; the reveal action is recorded as a distinct debug.reveal_actor entry in admin_audit_log so a subsequent customer access request under GDPR Art. 15 can answer precisely which identifiers a staff member viewed and when.
• Debug-logging toggles are per-tenant, namespace-scoped (operator picks specific code paths, e.g. mentions.resolve, rather than fleet-wide), and TTL-capped at 60 minutes (hard limit enforced server-side). When the TTL expires, debug emission stops automatically — no operator action required, no possibility of "left on overnight" exposure.
• All operator portal accesses (page views, toggle flips, reveal clicks) write rows to admin_audit_log, retained for 2 years per § 4. Customers exercising their Art. 15 access right can request the subset of these rows that referenced their workspace.

These controls are defense-in-depth measures, not anonymization in the GDPR sense — the underlying data remains in scope of this Policy and the customer's DPA. They reduce the blast radius of an operator account compromise and the temptation of casual staff browsing without legitimate need.

6. Data Sharing and Sub-processors

Access to Customer Data is limited to authorized personnel and contractors who require such access for support, security, maintenance, operational, or legal-compliance purposes and who are bound by written confidentiality obligations consistent with GDPR Art. 28(3)(b) and appropriate security measures.

We share data with the following sub-processors strictly as required to deliver the Service:

The table below distinguishes parties engaged by CT Core as Sub-processors (we contract them, instruct them, and pay them) from host platforms that the Customer is independently contracted with (Slack, Atlassian) — these are listed for transparency and to disclose the data flow, but CT Core does not engage them as Sub-processors and the Customer's primary contract with each platform governs.

Threadmaker does not sell, rent, or exchange Personal Data with any other party. We do not use third-party analytics, advertising networks, or trackers on the public site.

Cookies. The public website and the Service use only a single strictly-necessary cookie: a short-lived (10-minute), HttpOnly CSRF-protection token set during the Slack OAuth installation flow and scoped to that callback path. We set no analytics, advertising, profiling, or cross-site tracking cookies, and we use no third-party tracking technologies. Because the only cookie is strictly necessary to perform a security function you request (secure installation), no consent banner is required under the ePrivacy Directive as implemented in Polish law (Prawo telekomunikacyjne).

The current list of sub-processors is mirrored at threadmaker.dev/privacy/subprocessors and updated at least 30 days before a change takes effect.

7. International Data Transfers

The Controller acknowledges that Stored Operational Metadata, authentication artifacts, and limited diagnostic data may be transferred to and processed in the United States by CT Core's infrastructure and monitoring Sub-processors, including Cloudflare, Inc. and Functional Software, Inc. d/b/a Sentry. The primary Cloudflare D1 database region is wnam (Western North America, United States); EU and UK customer data therefore leaves the European Economic Area.

For such transfers, the parties rely on the following layered mechanisms:

1. EU-US Data Privacy Framework. Where the relevant Sub-processor maintains an active certification under the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, or the Swiss-US Data Privacy Framework, the parties rely on that certification to the extent applicable (Commission Decision C(2023) 4745 of 10 July 2023; GDPR Art. 45).
2. Standard Contractual Clauses. Where the Data Privacy Framework is unavailable, invalidated, challenged, or insufficient for a particular transfer, Module Two of the EU Standard Contractual Clauses is incorporated by reference and completed as set out in the DPA.
3. UK data. For transfers subject to the UK GDPR, the UK Addendum to the EU Standard Contractual Clauses applies.
4. Swiss data. For transfers subject to the Swiss FADP, the Swiss-specific modifications to the EU Standard Contractual Clauses apply.

Technical measures additionally protect transferred data: encryption at rest (D1 storage encryption), encryption in transit (TLS 1.2+), HMAC-signed internal service-to-service calls, and least-privilege OAuth scopes. Customers who require EU-resident data processing may contact us; bespoke regional deployment is available on enterprise terms.

8. Data Retention

See Section 4.2 for category-level retention schedules. At a glance:

• Transient content: deleted within minutes (message_origins) to days (retry_queue).
• Audit log: 90 days. Operational metrics: 30 days.
• Mapping and account data (workspaces, comment_map, issue_threads, channel_project_map): deleted immediately on Slack workspace uninstall (app_uninstalled event) or DSR erasure request. A small tombstone row in workspace_deletions (workspace ID, deletion timestamp, DSR ticket reference if any) is retained as compliance evidence and to support a brief reinstallation window (typically <5 minutes during which the same admin can reinstall under the same Slack team_id without losing any in-flight integration state). The tombstone holds NO content or PII beyond the workspace ID and operator email of the requesting admin.
• Cloudflare edge logs: 7 days (out of our direct control; governed by Cloudflare DPA).
• Cloudflare R2 backup snapshots: 90-day rolling retention in production / 30-day in staging. Encrypted at the application layer with AES-256-GCM. Article 17 erasure requests are satisfied within the rolling window per GDPR Recital 65.
• Billing records: 7 years (Polish accounting and tax law — Ustawa o rachunkowości Art. 74 § 2 pkt 1 (księgi rachunkowe) and Ordynacja podatkowa Art. 86 § 1 (ewidencja podatkowa); the 7-year retention is the conservative envelope of the dual statutory windows).

9. Your Rights under GDPR

Data subjects in the EU/EEA/UK have the following rights. Customers outside the EU/EEA/UK should consult their local data-protection regulator; we apply the same operational measures globally.

We will respond to a verified DSR within one calendar month. Complex or multiple requests may be extended by two further months with notice.

Right to complain

You may lodge a complaint with your local data-protection supervisory authority. In Poland:

Prezes Urzedu Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warsaw https://uodo.gov.pl

9.1 Additional Information for California Residents

If you are a resident of California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), may provide you with certain rights regarding your Personal Information.

Your California privacy rights. Subject to applicable law and certain exceptions, California residents may have the right to:

• Right to know — request the categories and specific pieces of Personal Information we have collected, the sources, the purposes for collecting or disclosing it, and the categories of third parties to whom we disclose it.
• Right to access — request access to the Personal Information we maintain about you.
• Right to correct — request correction of inaccurate Personal Information.
• Right to delete — request deletion of Personal Information we collected from you, subject to certain exceptions.
• Right to data portability — receive a copy of certain Personal Information in a portable and, where technically feasible, readily usable format.
• Right to opt out of sale or sharing — we do not sell Personal Information as that term is traditionally understood, and we do not share it for cross-context behavioral advertising. If any use of analytics, advertising, or tracking technologies ever constituted a "sale" or "sharing" under California law, you may opt out by contacting us as below.
• Right to limit the use of Sensitive Personal Information — where we process Sensitive Personal Information as defined under the CCPA, you may request limits on certain uses and disclosures.
• Right to non-discrimination — we will not discriminate against you for exercising any privacy right under the CCPA.

Exercising your rights. Contact dpo@threadmaker.dev. We may need to verify your identity before processing your request, and you may designate an authorized agent to submit a request on your behalf, subject to applicable verification requirements.

"Shine the Light" (Cal. Civ. Code § 1798.83). We do not disclose Personal Information to third parties for their own direct-marketing purposes.

10. Security

We implement technical and organizational measures appropriate to the risk, including:

• Encryption at rest (Cloudflare D1 storage encryption, AES-256);
• Encryption in transit (TLS 1.2+ enforced everywhere; HSTS on threadmaker.dev);
• HMAC-SHA256 signed internal RPC between Slack worker and Forge plugin;
• Least-privilege Slack OAuth scopes — we request the following 13 scopes: channels:history, channels:read, chat:write, commands, files:read, files:write, groups:history, groups:read, im:write, reactions:read, users:read, users:read.email, metadata.message:read (per-scope rationale documented internally in docs/marketplace/SCOPE_JUSTIFICATIONS.md);
• No storage of Jira API tokens — we use Forge asApp authentication instead;
• Secrets managed via Cloudflare write-only Secrets (not readable post-set);
• Rate limiting per tenant to prevent abuse and noisy-neighbor impact;
• Automatic purge jobs to enforce retention (see Section 4.2);
• Connection token rotation available from the Slack App Home tab;
• Deletion on app_uninstalled / tokens_revoked Slack events;
• Audit logging of customer synchronization actions (audit_log) retained 90 days; operator/admin-portal access (admin_audit_log) retained 2 years.

No security model is perfect. In the event of a personal-data breach likely to result in risk to affected individuals, we will notify the competent supervisory authority within 72 hours (GDPR Art. 33) and affected data subjects without undue delay.

We maintain an internal Record of Processing Activities under GDPR Art. 30 and make a redacted version available to controllers under NDA on written request.

11. Eligibility

Threadmaker is a B2B service. Access is granted exclusively through a Slack workspace or Jira site administered by an employer or organisational entity that has agreed to the upstream Slack Customer Terms of Service or Atlassian Cloud Terms of Service. Those upstream agreements require the workspace administrator to be of majority age in their jurisdiction and to ensure that authorised end users are of working age. CT Core does not provide self-serve consumer signup, does not contract directly with end users, and does not perform separate age verification.

Where statutory age limits apply to data subjects' consent capacity (e.g. GDPR Art. 8 as implemented in Poland by the Polish Data Protection Act of 10 May 2018, Art. 4 — age 16), CT Core relies on the upstream platforms' admin onboarding and acceptable-use controls to enforce them.

12. Changes to this Policy

We will publish any material change to this Policy at threadmaker.dev/privacy at least 30 days before it takes effect. Trivial clarifications (typo fixes, contact updates) may be published without prior notice and will be reflected in the "Last updated" date above.

13. Contact

• Privacy contact / DSR / privacy questions: dpo@threadmaker.dev
• Security disclosure: security@threadmaker.dev
• Operational support: support@threadmaker.dev
• Legal notices: legal@threadmaker.dev
• Postal address: CT Core, ul. Hoza 86/410, 00-682 Warsaw, Poland
• Data Processing Addendum: threadmaker.dev/dpa

CT Core is the trading name of Viktar Martavitski, NIP 9512543228, a Polish JDG operating under Polish commercial law. This document does not create any rights not granted by applicable law.