Privacy Policy
Information about the processing of personal data when using Consonus.
1. Controller
Municraft UG (haftungsbeschränkt) Balanstr. 76 81541 München Germany Email: contact@municraft.com
2. General information on data processing
We process data to provide Consonus, administer accounts and operate the service securely. Requested account and session functions rely on Art. 6(1)(b) GDPR; security and operational monitoring serves our legitimate interest in reliable and secure operation under Art. 6(1)(f) GDPR. We also generate anonymous monthly usage totals to measure and improve the service. Where personal data is processed to generate these totals, we rely on our legitimate interest under Art. 6(1)(f) GDPR. Sessions process participant identifiers, display names, configuration, presence, votes and supplied or imported story content, displaying them to the intended participants. Before reveal, the application returns only a participant’s own vote values; others see voting status. Revealing makes the values visible. Business customers may control the personal content placed in their workspaces, while we process it on their behalf to provide the functions. Customers’ responsibility for content does not remove our own data-protection obligations. For customer-configured Jira, GitLab or Azure DevOps connections, Consonus processes connection addresses, necessary credentials, queries and imported issue content. Imports and writing estimates back transfer data to the configured system. Recipients and server locations depend on the chosen provider or the customer’s own installation. Interface assets are served by Consonus; icons and SortableJS do not load an external CDN service.
3. Hosting
Consonus is hosted by Hetzner Online GmbH on servers in Germany. Technical connection and operational data, including IP address, time, browser information, request data, and error data, are processed to provide and protect the platform. We use self-hosted Grafana for operational monitoring. Application logs may contain request paths, technical request identifiers, response status, and execution times. Monitoring supports fault detection and investigation and secure operation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is operating a reliable and secure service.
Browser storage and usage statistics
Cookies support sign-in, language selection and protection of forms. Local browser storage holds theme and language preferences, authentication state, participant configuration and session-specific participant credentials. Those credentials identify a participant for their own votes and reconnections. To measure and improve Consonus, account creations, session starts, new regular user stories, saved estimates and participant joins are counted directly on the server as monthly totals. Counters contain only the month, action type and count; no account, user, participant or session identifiers, content or individual event timestamps. There are no individual usage histories or conversion profiles. Usage counting requires no analytics cookie, browser storage, device fingerprint or external analytics tag. Authentication and participant credentials are used for application functions, not as analytics identifiers.
4. Customer account
To manage teams and sessions, we process the email address, password hash, and account, permission, and licence data. Passwords are stored as hashes. Guests can participate in invited sessions without an account. Processing to provide the account and requested account functions is based on Art. 6(1)(b) GDPR. We send transactional emails through Brevo to confirm email addresses, reset passwords, and confirm account deletion. The recipient address and the relevant confirmation or recovery link are transmitted to the email service. These messages support the requested account functions.
5. Access and licence data
Consonus currently provides its full feature set free of charge. To manage access, we process the account association, permissions, licence type, and validity period. The trial licence and its free renewal do not create a payment obligation. Payment details are not required for free access. The legal basis for providing the requested access is Art. 6(1)(b) GDPR.
6. Planned payment processing
Consonus currently offers no paid ordering process and does not transmit payment data to Stripe for free use. Stripe is planned as the payment provider for future paid offerings. Before these launch, this privacy notice will be updated with the Stripe entity actually used, the data processed, purposes and legal bases, recipients, retention periods, and any international transfers and safeguards. Free users will not need to provide payment details for their free access after paid plans are introduced.
7. Storage period
Account data and stored team, session and story content are retained to provide the account and shared workspaces. Account deletion can be confirmed through an email link requested in settings; it also removes the teams, sessions and stories owned by the account from the application database. Statutory retention requirements and records necessary for legal claims may require limited further retention. Monthly usage counters are retained for the current month and twelve previous months. Older counters are excluded from reports and removed by hourly cleanup; following downtime, cleanup runs again at the next application startup. The previous identifiable analytics event history is removed from the active database during the privacy migration. This does not delete existing external backups. Technical logs, backups and data held by the email service have separate retention and deletion processes. Deleting an account in the application does not immediately remove all copies in those systems. Contact contact@municraft.com for information about particular data and deletion requests.
8. Rights of data subjects
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing, and data portability. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time. Any consent you have given may be withdrawn at any time with effect for the future. Contact contact@municraft.com for privacy requests. The user-story CSV export is a product feature and does not replace your statutory data-protection rights.
9. Right to lodge a complaint
A complaint may be lodged with a data protection supervisory authority.
10. Obligation to provide data
An email address and password are required to register; an account cannot be created without them. Guest participation does not require a separate account. Session features use a participant identifier and configuration. Users provide their own content and configure external integrations. Payment details are not required for the current free access.
11. Automated decisions
No profiling takes place.