Data Privacy

Data Privacy Statement

Last updated: 2 October 2026

1. Who we are

PlanningPokerBot is operated by the owner of this service. For contact details, see our Imprint.

2. What data we collect and why

2.1 Account data

When you sign in, we store your email address and, where applicable, your Microsoft Teams user and tenant identifiers. This data is required to provide the service (contract performance, Art. 6(1)(b) GDPR).

2.2 Usage analytics

We use Umami Analytics, a privacy-friendly, open-source analytics tool. The analytics instance runs on our own server (analytics.n1c.co) — no data is sent to third parties.

Umami collects the following information in aggregated, anonymised form:

• Pages visited and referrer URL
• Browser type and operating system
• Country derived from IP address (IP itself is not stored)
• Device type (desktop / mobile / tablet)

Umami does not use cookies, does not track users across sites, and does not store personally identifiable information. The legal basis is our legitimate interest in understanding how the website is used in order to improve it (Art. 6(1)(f) GDPR).

2.3 Infrastructure — Cloudflare

This website is served via Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA), acting as our CDN and reverse proxy. All HTTP requests to planning-poker.bot pass through Cloudflare's network before reaching our origin server.

In doing so, Cloudflare processes:

• Your IP address (used for DDoS mitigation, bot protection, and geolocation — not stored by us)
• HTTP request metadata (URL, headers, user-agent)

Cloudflare may also set a short-lived cookie (__cf_bm) for bot-management purposes. This cookie is strictly functional and does not track users across sites.

Cloudflare processes this data as our data processor under a Data Processing Agreement and has implemented Standard Contractual Clauses for international transfers. For details, see Cloudflare's Privacy Policy. The legal basis is our legitimate interest in operating a secure and performant service (Art. 6(1)(f) GDPR).

2.4 Payment data

Payments are processed by our payment provider. We do not store full card details. Please refer to the payment provider's own privacy policy for details.

3. Data storage and retention

Account data is stored in Google Firestore (EU region). We retain it for as long as your account is active and for a reasonable period thereafter to comply with legal obligations.

Analytics data is stored on our own server and is retained for 24 months before being automatically deleted.

4. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, as well as the right to data portability. To exercise these rights, please contact us via the contact page.

You also have the right to lodge a complaint with a supervisory authority.

5. Changes to this statement

We may update this statement from time to time. The date at the top of this page indicates when it was last revised.