Privacy Policy

1. Controller

The data controller responsible for your personal data is Tomasz Kowalewski, reachable at me@tkowalewski.pl.

2. What we collect

When you sign in with Atlassian, we receive and store your name, email address, and Atlassian account ID. We also store the time entries you create and any JIRA task identifiers you assign to them.

3. Legal basis for processing (GDPR)

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Contract — processing your name, email, and time entries is necessary to provide the Skedulu service you signed up for.
• Legitimate interest — storing your Atlassian account ID to authenticate you across sessions.
• Legal obligation — retaining billing records as required by applicable law.

4. How we use your data

We use your data solely to provide the Skedulu service — authenticating you, displaying your time entries, and connecting to your JIRA workspace. We do not sell or share your data with third parties for advertising purposes.

For paid purchases, we share your name, email address, and country with LemonSqueezy (our payment processor) in order to generate invoices and collect applicable taxes. We do not process or store your payment card details — these are handled exclusively by LemonSqueezy.

5. Atlassian integration

Skedulu connects to Atlassian via OAuth 2.0. We store an access token and refresh token for your Jira workspace in order to fetch tasks on your behalf. You can revoke this access at any time in Settings → JIRA.

6. Data storage and transfers

Your data is stored on servers located in the European Union. We do not transfer personal data to countries outside the EEA unless adequate safeguards are in place (e.g. EU Standard Contractual Clauses).

7. Sub-processors

We use a limited number of third-party services to operate Skedulu:

• Atlassian — OAuth authentication and JIRA task data
• LemonSqueezy (Lemon Squeezy, LLC) — payment processing and invoicing as Merchant of Record; receives your name, email, and country for tax purposes. LemonSqueezy Privacy Policy
• Hosting provider — infrastructure for the web application and database

Each sub-processor is bound by a data processing agreement.

8. Data retention

Your data is retained for as long as your account is active. When you request account deletion, your personal data is permanently removed within 30 days. Anonymised usage statistics may be retained longer.

9. Your rights (GDPR)

If you are located in the EEA, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email me@tkowalewski.pl. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (in Poland: UODO — uodo.gov.pl).

10. Cookies

We use a session cookie to keep you logged in to the web panel. We do not use tracking or advertising cookies.

11. Changes to this policy

We may update this policy from time to time. We will notify you by email at least 14 days before material changes take effect.

12. Contact

Questions about this policy? Email me@tkowalewski.pl.