Privacy Policy

Soverain s.r.o. Last updated: 3 August 2026 Effective: 3 August 2026

1. Who we are

Soverain s.r.o. ("Soverain", "we", "us") is a limited liability company registered in the Czech Republic.

Soverain is established in the European Union, so we have not appointed an Article 27 representative. We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not done so; privacy questions go to the address above.

2. What this policy covers

This policy covers all Soverain s.r.o. products, services and websites, including:

• the soverain.cz website;
• Kanban+, our Atlassian Forge app for Jira Cloud, distributed through the Atlassian Marketplace;
• Diagon, our desktop diagramming app for Windows and Linux (macOS in development), sold by subscription through the soverain.cz website;
• any future Soverain product, unless that product publishes its own policy.

Field-level detail for Kanban+ — exactly which fields the app touches and how long they are kept — is in the App Data Annex, which forms part of this policy. Diagon needs no such annex: it keeps your work on your own computer, and §5.2 covers the little we receive when you subscribe.

3. The two roles we play

Data protection law distinguishes the party who decides why data is processed (the controller) from the party who processes it on someone else's instructions (the processor). Soverain is in different positions depending on the data. Read both sections — they are not alternatives.

Diagon sits outside both buckets for the work itself. Your diagrams, your source files and the bundled AI all stay on your own computer — none of it is sent to us, so there is no role for us to play over it. The only personal data a Diagon subscription creates is what buying one creates, and there we are the controller. See §5.2.

We do not claim to collect no personal data. That claim would be false, and stating it would itself breach the fairness and transparency principle in Article 5(1)(a) GDPR. Section 5 sets out precisely what we receive.

4. Bucket A — data Kanban+ handles inside your Atlassian environment

Here Soverain is a processor. You are the controller.

4.1 Where it runs and where it stays

Kanban+ is a Forge app. Forge is Atlassian's own application platform. In practice this means:

• The app runs exclusively on Atlassian-hosted compute and storage. For Kanban+ Soverain operates no servers, no databases, no analytics pipeline and no data warehouse. (We do run soverain.cz and a licence endpoint for Diagon; neither is reachable from the Forge app, which makes no outbound calls at all.)
• The app declares no remotes and no external permissions in its manifest. It makes no outbound HTTP requests of any kind. There is no code path by which app data leaves the Atlassian environment.
• App data is written to Forge hosted storage, which sits inside your Atlassian installation.
• Consequently the app inherits your Atlassian data residency. If you have pinned your Jira Cloud site to a region, app data at rest follows that pinning.

Kanban+ is eligible for the Atlassian Runs on Atlassian programme, whose requirements are that apps use exclusively Atlassian-hosted compute and storage, support the host product's data residency, and give customers admin control over external egress.

4.2 What Runs on Atlassian does not mean

We would rather you hear the limits from us than find them in a security review:

• Residency covers data at rest, not every execution. Atlassian's Forge documentation is clear that residency pinning governs where data is stored, and that an app invocation may sometimes execute from a location other than the host region. We deliberately do not reproduce Atlassian's wording here — it is revised from time to time, and a stale quotation in our policy would be worse than none. The current text in Atlassian's own data residency documentation is the one that governs.
• It constrains plumbing, not permissions. Runs on Atlassian limits where data can go. It does not limit what the app is allowed to read inside your Jira. That is governed by the scopes you approve at installation, which are listed in the App Data Annex. Atlassian states plainly that these controls "do not prevent misuse of access granted to the app during installation".
• It is not a security certification. It is a platform-architecture programme. See our Security Statement.

4.3 What the app stores

Kanban+ stores board configuration and derived scheduling data. Some of it is personal data. The complete, field-level list is in the App Data Annex. In summary, the app durably stores:

• Atlassian account IDs and display names — for board administrators, team rosters, saved-view filters and automation "assign" actions.
• Retrospective content — free text written by your team members on retrospective boards, stored with the author's display name and account IDs for votes.
• Jira issue summary text — for cross-board blocker links only. Issue summaries can contain names and confidential project detail.
• Issue identifiers and status timestamps — used to calculate service-level metrics.
• Board names, automation rule names and audit entries — text your administrators write.

The great majority of Jira data the app displays — issue descriptions, comments, attachments, worklogs, changelogs, avatars — is read into your browser, rendered, and discarded. It is never written to app storage.

4.4 Purposes and legal basis

We process Bucket A data only on your documented instructions, which are given by your installation and configuration of the app and by our DPA. The purposes are: providing the board, timeline, reporting, automation and service-level features you configured.

The legal basis for that processing is yours to determine as controller — typically legitimate interests under Article 6(1)(f) in running your own project management. We do not select a legal basis on your behalf.

We do not:

• sell, rent or share your data;
• use your data to train machine-learning models;
• use your data for advertising or profiling;
• access your Jira data for our own purposes.

5. Bucket B — data Soverain actually receives

Here Soverain is the controller. This is the section most self-written Forge privacy policies omit. It is the section reviewers check.

5.1 Marketplace licence and transaction records

When you buy or evaluate Kanban+, Atlassian is the seller of record. Atlassian bills you, collects any VAT, and pays us. We never invoice you and never see your payment card or bank details.

Atlassian does, however, give us partner reports about our own licences. From those reports we receive:

Atlassian sets the exact column set of these reports and revises it from time to time, so the table describes what they contain in substance rather than promising a fixed list of columns. We request nothing beyond what Atlassian provides to every Marketplace partner about its own licences.

The contact names and email addresses are personal data about your staff, not about your company. That is why this section exists.

Purposes: managing our licence and billing relationship with Atlassian; providing support; sending service-critical notices (security issues, breaking changes, end-of-life notices); understanding which editions are in use so we can plan development.

Legal basis: Article 6(1)(f) GDPR, legitimate interests — operating and supporting a software product we license to you, and communicating with the people you nominated as our contacts. We have balanced this against your contacts' interests: the data is limited to business contact details voluntarily nominated for exactly this purpose, and we use it only for the product they administer.

Marketing: we do not send marketing email to Marketplace contacts. If that ever changes it will be on a separate opt-in basis under Article 6(1)(a) — we will not quietly repurpose an address you gave us for administration.

5.2 Diagon subscriptions and licence keys

Diagon runs on your computer. Your diagrams, your files and the bundled AI stay there; none of it reaches us. For 30 days from first run you can use the whole app without an account, an email address or a card — during the trial we receive nothing at all.

When you subscribe, Paddle is the seller of record. Paddle.com Market Limited (Paddle.com Inc. for buyers in the United States) sells you the subscription, takes the payment, calculates and remits the tax, issues your invoice and handles refunds. Your card or bank details go to Paddle, never to us: we cannot see them and store nothing of them. Paddle decides for itself how it processes what you enter at checkout, as its own controller, and its privacy notice governs that part.

What Paddle passes on to us is deliberately small:

We use it for two things: minting your licence key and supporting you afterwards. The key is a short signed string that embeds your email address, the transaction reference and an expiry date. Your address is inside it on purpose — it is what makes a key traceably yours, and a shared key obvious. The key is delivered by email through Azure Communication Services (Microsoft, EU data location), sent from noreply@soverain.cz; replies reach hello@soverain.cz.

We keep no customer database. When your copy of Diagon checks that the subscription is still running, our endpoint asks Paddle in that moment and mints a fresh key from the answer — nothing about you is stored on our side to make that work. What does persist is a server log line for each licence mint, recording the buyer email, the transaction reference and the key issued, so that support can re-send a key that went astray.

Purposes: delivering and renewing the licence you paid for, and supporting you. Legal basis: Article 6(1)(b) GDPR, performance of our contract with you — a licence key cannot be issued or delivered without an address to put in it and send it to. The mint log line rests on Article 6(1)(f), our legitimate interest in being able to re-send a key and match it to a payment. Retention: see §8.4.

Cancelling, updating a card and downloading invoices all happen in Paddle's customer portal, reachable from any Paddle receipt email. Refunds are covered by our Refund Policy.

5.3 Kanban+ application logs

This one is easy to overlook, so we state it explicitly.

Forge apps write diagnostic log lines. Atlassian collects them and makes them available to the app developer. Per Atlassian's documentation, log access is enabled by default when a customer installs an app, a site administrator can disable it, and logs are retained for 30 days and then deleted. Retention is set by Atlassian and we cannot extend it.

Kanban+ writes log lines for its scheduled jobs and automation runs. These deliberately record counts, dates, identifiers and Jira issue keys. Error handlers log only the error's message (err?.message), not the whole error object, so an error that carries request or response context cannot place Jira issue content or a user display name into logs. One honest limitation remains:

• Some log lines still include customer-authored names — board names and automation rule names. In practice such names sometimes contain a person's name (for example a board called "Adam's sprint board").

Why that limitation is still here. Atlassian's own logging guidance says names and user-generated content should not be logged, and we agree. An earlier and worse problem — whole error objects being logged, which could drag Jira content along with them — has been fixed: the scheduled-job and automation code now logs only the error message. The board and rule names are what is left, and we intend to remove them too. Until they are gone this paragraph stays as written, because we would rather over-disclose than describe a cleaner app than the one you installed.

Purpose: diagnosing faults and keeping the app working. Legal basis: Article 6(1)(f), legitimate interests in operating reliable software. Retention: 30 days, enforced by Atlassian. We do not export logs to any external system.

If you would rather we saw no logs at all, your Jira site administrator can disable app log access in the Atlassian admin console. The app continues to work; we simply lose diagnostic visibility.

5.4 Support correspondence

If you email support@soverain.cz we receive your email address, your name if you give it, and whatever you put in the message — which may include screenshots, Jira extracts or Diagon files you choose to attach.

Purpose: answering you. Legal basis: Article 6(1)(f), legitimate interests in supporting our customers; and Article 6(1)(b) where you are contracting with us directly. Retention: we keep a support thread while it is still useful — while the question is open, while the same problem may come back, and while a claim arising from it could still be made — and delete it when it is not. We do not copy support mail into any other system, and you can ask us to delete a thread sooner.

5.5 The soverain.cz website

The pages you read are statically rendered. The site sets no advertising or tracking cookies, embeds no third-party analytics, and shows no consent banner because there is nothing non-essential to consent to. The one thing it puts in your browser is a single sessionStorage flag remembering that you have already seen the site's opening animation; it names nobody and it is gone when you close the tab.

The site runs on Microsoft Azure App Service in the EU. Like any web server it records standard access logs, including visitor IP addresses, which we use for security and reliability.

If you start a Diagon purchase, the checkout is Paddle's. Clicking a buy button loads Paddle.js from cdn.paddle.com and opens Paddle's checkout overlay — that script is not loaded until you click, so reading the site involves no third party at all. Once you are in the checkout, Paddle's own privacy notice and cookies apply to it.

If we ever add analytics, we will ask for consent first, as §89(3) of Czech Act No. 127/2005 Coll. on Electronic Communications requires, and this section will say so before the code ships.

6. Who else sees your data

6.1 Sub-processors (Bucket A)

One: Atlassian.

That is the entire list. Kanban+ engages no analytics provider, no error-tracking service, no CDN of our own, no email provider that touches app data, and no AI or machine-learning service.

Diagon has no sub-processors either, for the simplest possible reason: the app does its work — including the AI — on your own machine, so there is nothing for a sub-processor to be given. The providers involved in buying Diagon are recipients of purchase data, and they are named in §6.2.

An earlier version of Kanban+ included an optional AI assistant that called an external API. It has been removed in its entirety — the feature, the code that could store an API key, and the outbound network permission. The app now makes no external calls.

We maintain the sub-processor list in the Security Statement and will notify customers before adding a new one, as required by our DPA.

6.2 Recipients (Bucket B)

• Atlassian — as the seller of record for Kanban+ and the source of our licence reports.
• Paddle — Paddle.com Market Limited, or Paddle.com Inc. for buyers in the United States — as the seller of record for Diagon subscriptions. Paddle holds the payment details, issues the invoice and handles refunds; we receive from it only what §5.2 lists.
• Microsoft — Azure hosts the soverain.cz website and the licence endpoint, and Azure Communication Services (EU data location) delivers licence emails.
• Our mailbox provider — support and privacy correspondence sits in our @soverain.cz mailboxes.
• Our accountant and tax advisers — for statutory bookkeeping. What reaches them are the payout and settlement statements we receive from Atlassian and Paddle; we do not hand them customer contact lists.
• Public authorities — where we are legally obliged to disclose.

We do not sell personal data and have never done so.

7. International transfers

App data (Bucket A) stays within the Atlassian environment and follows your Atlassian data residency configuration. Soverain does not transfer it anywhere. Diagon's own data never leaves your computer, so there is nothing to transfer.

For Bucket B, both Atlassian and Paddle are global companies and our commercial relationships with them may involve transfers outside the EEA. Those transfers run on the providers' own transfer mechanisms, including Standard Contractual Clauses, set out in the data processing terms each of them publishes. Website hosting and licence email delivery are on Microsoft Azure in the EU.

8. How long we keep things

8.1 App data (Bucket A)

You control this. The app also enforces its own retention:

Why issue status timestamps are not aged out. Each record holds the moment an issue entered its current status. That is the input to every service-level calculation. A long-running issue legitimately has a months-old timestamp, so deleting records by age would silently produce wrong service-level reporting rather than reclaim dead data. We judged silent corruption of your reports to be worse than retaining a small identifier record. The records contain an issue ID, an issue key, a status ID and a timestamp. They name no person.

Deleting a board now removes that board's audit log, its snapshots and its cross-board blocker records as well as the board itself. Earlier versions removed only the board row.

8.2 What happens when you uninstall

We want to be precise, because the honest answer is that Atlassian performs this deletion, not Soverain. We hold no copy to delete.

• Atlassian documents that Forge hosted storage retains data for 28 days after uninstallation, during which the data is first soft-deleted and then disposed of in line with Atlassian's retention and disposal policy as described in its SOC 2 report.
• If you reinstall, Atlassian treats it as a new installation — but if you ask within 21 days of uninstalling, Atlassian can relink the new installation to your old data.
• If your Atlassian site is permanently deleted, all associated app data is deleted with it.

Kanban+ deliberately implements no uninstall-time cleanup hook. That is a decision, not an oversight. Atlassian already deletes the data; the only available hook (preUninstall) is documented as non-blocking, so any promise built on it would be one we could not keep; and eagerly wiping storage would destroy your 21-day relink window.

8.3 Erasure on request, without uninstalling

Atlassian provides no way for a site administrator to clear an app's storage while keeping the app installed. We built that missing control ourselves: Kanban+ contains a full-purge function that deletes every record the app holds for your site. It requires Jira site-administrator rights and an explicit confirmation.

Current limitation, stated plainly: the purge exists in the app backend, refuses to run for anyone who is not a Jira site administrator, and requires an explicit typed confirmation — but no user interface for it has shipped yet. Today, a customer who wants a full erasure without uninstalling should email support@soverain.cz and we will walk your site administrator through running it. We intend to ship a self-service control, and this paragraph will change on the day it exists, not before.

8.4 Data we control (Bucket B)

9. Where our information about you came from

(Article 14 GDPR — required where we did not get the data from you directly.)

If you are named as a technical or billing contact for a Kanban+ licence, we did not get your name and email address from you. We received them from Atlassian, drawn from the contact details recorded against your organisation's Marketplace licence. The categories are set out in §5.1.

If you bought a Diagon subscription, we received your email address from Paddle, the seller of record, because you gave it at Paddle's checkout rather than to us. The categories are in §5.2.

Likewise, personal data appearing in app storage (account IDs, display names, retrospective text) originates from your employer's Jira instance, not from you directly. For that data your employer is the controller and Soverain is a processor.

10. Automated decision-making

We carry out no automated decision-making producing legal or similarly significant effects, and no profiling, within the meaning of Article 22 GDPR.

Kanban+ generates board insights and forecasts. These are deterministic calculations over your own Jira data — rule-based, not machine learning — and they inform your team, not us. Since the removal of the AI assistant the app contains no model inference of any kind.

Diagon does bundle an AI model, which turns a description you type into diagram code. It runs on your own computer, on your own text. We never see the prompt or the result, it makes no decision about you, and it is not used to profile anyone.

11. Your rights

Where Soverain is the controller (Bucket B), you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase data ("right to be forgotten");
• restrict processing;
• data portability;
• object to processing based on legitimate interests — including an absolute right to object to direct marketing;
• withdraw consent at any time, where we relied on consent, without affecting prior processing.

Email privacy@soverain.cz. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We do not charge for this unless a request is manifestly unfounded or excessive.

Atlassian also operates a "right to be forgotten" flag for Marketplace contacts. Where a contact exercises it with Atlassian, the contact fields in our reports are replaced with an RTBF marker.

Where Soverain is a processor (Bucket A), address your request to your own organisation — your employer or the Atlassian customer whose Jira site you use — because they are the controller. If you contact us directly we will forward the request to them and assist as our DPA requires.

Complaints

You can complain to your local supervisory authority. Ours is:

Úřad pro ochranu osobních údajů (Office for Personal Data Protection) Pplk. Sochora 27, 170 00 Praha 7, Czech Republic +420 234 665 111 · uoou.gov.cz

We would appreciate the chance to resolve it first, but you are not required to come to us before going to the ÚOOÚ.

12. Security

Summarised here, detailed in our Security Statement: Kanban+ runs on Atlassian infrastructure and inherits its security controls, has no external network access, and stores no credentials; access to our Marketplace partner account is protected by multi-factor authentication. On the Diagon side, our Paddle credentials are held in Azure Key Vault rather than in the application, licence keys are signed server-side with a key that is never shipped to the desktop app, and the licence webhook accepts only signed requests from Paddle's own addresses.

We will notify affected customers and, where required, the ÚOOÚ, of a personal data breach within the timeframes set by Articles 33 and 34 GDPR. Our processor-side breach obligations are in the DPA.

13. Children

Our products are business tools sold to organisations. They are not directed at children and we do not knowingly process children's data.

14. Changes to this policy

We will update this policy as our products change. The "Last updated" date at the top always reflects the current version.

For material changes we will give notice before the change takes effect — by email to the technical and billing contacts on record and to Diagon subscribers, and by a notice on this page. Where a change materially affects how a Marketplace app handles end-user data, we will also notify Atlassian, as the Atlassian Developer Terms require.

From the next version onwards we will list dated changes at the bottom of this page. Any superseded version is available from privacy@soverain.cz on request.

15. Contact

Soverain s.r.o. Chabařovická 1324/21, Kobylisy, 182 00 Praha 8, Czech Republic Privacy: privacy@soverain.cz · Support: support@soverain.cz IČO 29693144 · DIČ CZ29693144 · File C 450889, Municipal Court in Prague

Related: App Data Annex · Data Processing Agreement · Security Statement · Refund Policy · Support