Extension Privacy Policy
What the Inspektor does
with your data
This policy explains what the TrustTroiAI Inspektor browser extension collects, why, and who it is shared with. It supplements the general TrustTroiAI privacy policy at trusttroiai.com/datenschutz. Where a rule here is more specific, this policy prevails.
Single purpose
The Inspektor shows, inside a Jira ticket, which EU compliance obligations apply to the work described in that ticket. It covers the EU AI Act, the GDPR, and the EU Cyber Resilience Act, and it lets you attach evidence to those obligations. Every data practice below serves that single purpose.
What the extension collects
- Your email address and name from your Atlassian profile, received through OAuth 2.0.
- The Cloud ID and site name of your Jira instance.
- The ticket key, title, description, status, and assignee.
- The derivation of which compliance obligations that ticket triggers.
- A session token, valid for 30 days.
- A short profile: your email and the site name. This is disclosed even though it stays on your device and is not sent to a third party.
- Free text, URLs, and Git references (repository, commit, file).
- File uploads up to 20 MB, with the timestamp and signature of the user who created them.
How the data is used
We use the data only to provide the single purpose above: to determine and display the obligations that apply to your ticket, and to store the evidence you choose to attach. Reminder emails are sent only when you enable them.
The TrustTroiAI Inspektor's handling of user data adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell your data. We do not use or transfer it for advertising, profiling, or credit and lending decisions. We transfer data to third parties only where it is necessary to provide the single purpose, to comply with applicable law, or to protect against fraud and abuse.
Human access
No person reads your ticket content or your evidence through the Inspektor. The obligation matching is automated. If you use the separate expert validation feature on the TrustTroiAI platform, a qualified reviewer reads the relevant data only after you opt in and give explicit consent. That feature is governed by the main platform privacy policy.
Where the data is stored
All server-side data is held on Hetzner cloud servers in Germany, in Frankfurt and Nuremberg. File uploads are kept in TrustTroiAI's own object storage.
Security
Data is transmitted over encrypted connections using TLS, and stored at rest using AES-256. Authentication tokens are kept secure and are never exposed publicly. The extension requests only the access it needs to do its job.
Third parties
- Atlassian
- Sign-in provider through OAuth. Atlassian receives no ticket content from us.
- Mistral AI
- Classifies obligations from the ticket title, description, and champion text. France, EU.A data processing agreement under Article 28 GDPR is in place. Your data is not used to train models.
- Resend
- Sends reminder emails, only when you enable them. USA, under EU Standard Contractual Clauses.
How long we keep it
- Session token
- 30 days after last use.
- Ticket cache
- 90 days.
- Evidence
- Until you revoke it or the customer contract ends, plus 6 years for statutory retention.
Your consent
Before the Inspektor handles any data, it shows you which data it collects and asks you to agree. This disclosure and consent happen inside the extension at first sign-in. If our data practices change after you install, we will disclose the change prominently before it takes effect.
Your rights
Under Articles 15 to 22 GDPR you may request access to your data, and its rectification, erasure, restriction, portability, or object to its processing. Write to privacy@trusttroiai.com.
Revoking access
Open the gear menu and choose Sign out. This revokes the session token immediately.
In your Atlassian accountGo to account settings, then Connected apps, then remove TrustTroiAI Inspektor.
Controller
TrustTroiAI, represented by Earwin Wilfried Tchebtchou Tsobeng.
Grünewalder Straße 29-31, 42657 Solingen, Germany.
privacy@trusttroiai.com
Changes to this policy
The current version of this policy is always published at trusttroiai.com/extension-privacy. Material changes are disclosed there before they take effect.