Compliance and data protection
Nythrex GDPR and compliance: EU hosting and subprocessors
What Nythrex does with personal data, where it stores it, who it shares it with and how to delete it. Short and to the point here; the full legal text is in the privacy policy.
Roles under GDPR
Account data — Nythrex as controller
Email, password hash, onboarding answers, workspace settings. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).Source data — on behalf of the workspace owner
Records from repositories, trackers and cloud, including the names and emails of people in them. The workspace owner determines the basis, usually a legitimate interest in analysing their own development.Protecting the service
Lockout after failed sign-ins, rate limiting, CSRF protection — legitimate interest (Art. 6(1)(f)).Emails
Email confirmation and invitations — performance of a contract; the weekly digest — legitimate interest, with one-click unsubscribe.
Where data is stored and who processes it
| Service | Purpose | Location |
|---|---|---|
| Azure App Service | the app and the site | Poland Central (EU) |
| Azure SQL Database | database | Poland Central (EU) |
| Azure Key Vault | encryption keys and integration secrets | Poland Central (EU) |
| Azure Functions | the weekly recommendations digest | Azure |
| Azure Communication Services | emails: confirmation, invitations, digest | data location — Europe |
| Azure OpenAI (optional) | plain-language wording of recommendations | Global Standard, may be processed in another region |
| Cal.com | demo booking, only after you click | per Cal.com’s policy |
Retention and deletion
- account and workspace data — for as long as the account or workspace exists;
- records from a source — for as long as the source is connected; deleted after it is disconnected;
- sign-in session — 12 hours;
- data of closed Atlassian accounts is erased within the next 7-day reporting cycle;
- database backups — until the Azure SQL backup retention period ends.
Data subject rights
Access, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interest. We respond to requests within one month.
If your data reached Nythrex from a source your employer connected (for example, you authored commits), the fastest route is the owner of that workspace. We will also pass your request on and help fulfil it.
Provider requirements
For Jira, Nythrex follows Atlassian’s personal data requirements: every 7 days it reports the accounts it stores, erases the data of closed accounts and updates changed ones.
Preguntas frecuentes
Is the data stored in the EU?
Yes. Application data is stored in Microsoft Azure, Poland Central region. The exception is optional plain-language wording of recommendations through Azure OpenAI (Global Standard): Microsoft may process such a request in another region, but the model receives only the facts of one recommendation, with no records and no code, and with names replaced by placeholders.
Are you a data controller or a processor?
For your account, Nythrex is the controller. For data that comes from the sources connected to a workspace, the workspace owner makes the decisions; Nythrex processes that data on the owner’s behalf and only to provide the service.
How do I delete data?
Disconnecting a source deletes its tokens and all records from it. To delete an account or a whole workspace, write to us — the data is deleted within one month, with confirmation.
Do you sell data or show ads?
No. Data is not sold and is not shared for advertising or marketing, and nythrex.com uses no analytics, ad pixels or first-party cookies.
Sigue leyendo
Deja de adivinar.
Empieza a ver.
Sin tarjeta y sin suscripción: los planes de pago aún no se han lanzado.