Summary
- Content from Azure DevOps (work items, wiki, code, pull requests) and chat conversations are never stored by our backend.
- We store usage metadata with users as pseudonyms, your AI provider settings with the key encrypted, short-lived rate-limit counters, your organization's id and name, and your license state.
- The backend and database run in the EU (Frankfurt, Germany).
- AI requests go only to the AI provider your administrator configured.
- Payments are handled by Paddle; we never receive card details and do not store the buyer's name, email or address.
1. Who is responsible
Hardyson (Jesper Hardyson, sole proprietorship), Sweden ("Hardyson", "we"). Contact: support@hardyson.se.
- For content and personal data that pass through the Service on behalf of a customer organization (for example names in work items, or the users' identities used to call Azure DevOps), the customer is the controller and Hardyson is its processor. Our Data Processing Agreement governs that processing.
- For account, license and billing data about the customer organization, for support emails and for this website, Hardyson is the controller.
- Paddle is the Merchant of Record and reseller. For a purchase, Paddle is an independent controller of the buyer's payment, billing and tax data under Paddle's privacy policy.
- The AI provider your administrator connects is your organization's own supplier and processor, under your contract with it.
2. What is processed but not stored
- Azure DevOps content (work items, their history and comments, wiki pages, repository files, code and pull requests, people lists): read with the signed-in user's own Azure DevOps token, processed in memory in Frankfurt to answer the request, and sent to your AI provider as needed. It is not stored.
- Your Azure DevOps token: validated on each request and kept in memory for at most 5 minutes. It is never stored or logged.
- Chat conversations: kept only in your browser's session storage. Test questions that you choose to save are kept only in your browser's local storage.
- Short-lived caches in the server's memory (for example the decrypted AI settings for 30 seconds, lists of fields and work item types for up to 30 minutes, the license state for 60 seconds) disappear when the server instance stops.
3. What we store and for how long
| Data | Personal data | Retention |
|---|---|---|
| AI provider settings: provider, address, model, the API key encrypted with AES-256-GCM, the last test result, and a pseudonym of the administrator who saved them | A pseudonymized user id (HMAC) | Until an administrator removes them, or the organization's data is deleted |
| Usage statistics: one row per AI call or chat turn with time, project id, feature, provider type, model, token counts, latency, outcome and template id; chat tool names and counts; whether suggestions were approved or rejected | A pseudonymized user id (HMAC) | 183 days |
| Rate-limit counters per organization and per user per minute | A pseudonymized user id inside the counter key | 2 days |
| Open AI stream leases (an id and an expiry time) | None | Until the answer ends, at most 330 seconds |
| Organization directory: organization id, organization name, first and last seen | None (organization data) | Until the organization's data is deleted |
| Trial and license state: trial start and end, subscription status, tier, user limit, currency, billing period, scheduled cancellation and Paddle's customer id | Paddle's customer id (a pseudonymous reference to the buyer's details held by Paddle) | Until the organization's data is deleted |
| Paddle webhook events: event id, type, time, organization id, subscription id and outcome. The event contents are never stored | None | 90 days |
| Technical runtime logs with a pseudonymous organization reference, error names and counts | None directly; never content, tokens, keys, user ids or names | 1 hour |
Pseudonymized user ids are keyed hashes (HMAC) of the Azure DevOps user id; we do not store user ids, names or email addresses. Statistics show users only as counts. Database backups stay in the same region and expire with our database provider's restore window. Log lines after a deletion can no longer be linked to your organization without both our secret key and your organization id, and they expire within the retention above.
4. Purposes and legal basis
- Providing the Service (answering requests, applying approved changes, keeping your settings): performance of our contract with your organization (GDPR Article 6(1)(b)), and as processor on your instructions.
- Security and abuse prevention (rate limits, technical logs): our legitimate interest in keeping the Service safe and available (Article 6(1)(f)).
- Usage statistics shown to your organization's administrators: performance of the contract, and our legitimate interest in improving the Service.
- Licensing (the trial, the subscription state, counting active users against the tier): performance of the contract.
- Accounting and legal obligations: compliance with legal obligations (Article 6(1)(c)). Invoices are issued and kept by Paddle as the seller.
- Support: when you email us, we use your message and email address to help you, based on our legitimate interest in answering you.
5. Where the data is processed
Our backend runs on Vercel, pinned to the Frankfurt region (fra1), and our database is Neon Postgres in Frankfurt (eu-central-1). Requests pass through Vercel's edge network, where the encrypted connection terminates at the nearest point of presence before traveling to Frankfurt; they are not stored there. Vercel and Neon process data under their data processing agreements, including the EU Standard Contractual Clauses where data could be accessed from outside the EU. AI requests are processed wherever your administrator's chosen AI provider processes them.
6. Subprocessors and recipients
| Recipient | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting of the backend and this website; runtime and request logs | Frankfurt, Germany (functions); global edge network |
| Neon Inc. | Postgres database and its backups | Frankfurt, Germany |
| Paddle.com | Merchant of Record and reseller: checkout, payment, invoices, tax, refunds (independent controller) | See Paddle's privacy policy |
Microsoft (Azure DevOps) is your own platform, not our subprocessor. Your AI provider is your own supplier. We do not sell personal data and do not share it for advertising.
7. This website
This website sets no cookies, uses no analytics or tracking, and loads no external fonts or scripts, except the checkout page, which loads Paddle's checkout script from Paddle when you pay (see Paddle's privacy policy). Our hosting provider Vercel processes your IP address and request details to deliver the pages and protect against abuse.
8. Your rights
Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. Where your organization is the controller, we help it answer your request. Administrators can export usage statistics as CSV from the usage view at any time.
Deleting an organization's data. Uninstalling the extension does not delete what our backend keeps about the organization. Email support@hardyson.se with the organization's name or id (or the organization reference support gave you), and we delete all of it within 30 days. Deleting the data also resets the organization's trial.
You can complain to a supervisory authority, in Sweden the Swedish Authority for Privacy Protection (IMY), or the authority where you live or work. We would appreciate the chance to resolve your concern first.
9. Security
- Encryption in transit (HTTPS) and at rest; AI keys additionally encrypted with AES-256-GCM, bound to the organization.
- Every organization's data and caches are kept apart by its verified organization id.
- Every Azure DevOps call runs with the user's own token and permissions, through a fixed list of allowed operations.
- Calls to AI providers go through a guard that blocks private network addresses and redirects.
- No content, tokens or keys in logs.
10. Children
Boardmate is a business tool and is not directed at children.
11. Changes
We update this policy when what we process changes. The "Last updated" date shows the current version. For material changes we give at least 30 days' notice on this page before they take effect.
12. Contact
Questions about privacy: support@hardyson.se, Hardyson (Jesper Hardyson, sole proprietorship), Sweden.