Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Email: team@theprogrammanager.com

We have not appointed a data protection officer because we are not legally required to do so. For all privacy questions, write to the email address above.

We process personal data only where a legal basis applies. In short:

• Visiting the website or the blog: technical access data (server logs) for delivery and security.
• Using the web app: account, workspace and audit data needed to provide the service you signed up for.
• Connecting Jira, Asana or Slack: we read or send data only on your instruction and act as your processor for that data.
• Connecting an AI client through MCP: data you request is returned to that client.
• No analytics, no advertising, no tracking cookies and no consent banner, because we only use storage that is strictly necessary.

The website and the web app at theprogrammanager.com are built with Bolt.new (StackBlitz, Inc., USA) and served by Netlify, Inc. (USA) through its content delivery network. When you open a page, your browser sends technical data that the host processes and records in server logs:

• IP address
• date and time of the request
• requested URL and HTTP method
• referrer URL, if your browser sends it
• browser type and version (user agent) and operating system
• HTTP status code and amount of data transferred

Purpose: delivering the pages, keeping the service stable and secure, and detecting and defending against attacks. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. We do not combine log data with other data and do not use it to identify visitors. The logs are kept by the hosting provider for a limited period according to its retention settings and then deleted; logs needed to investigate a security incident are kept until the incident is resolved.

Netlify, Inc. is based in the USA. Where the provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). In addition, or where no certification applies, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) included in the provider's data processing terms.

Accounts, authentication, the database and the server functions of the web app run on Supabase (Supabase, Inc., USA): Supabase Auth, a Postgres database and Supabase Edge Functions. Supabase processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Depending on the project configuration, the servers may be located in the EU or the USA.

We process:

• Account data: full name, email address, password (stored only as a salted hash by Supabase Auth), user ID, sign-up and sign-in timestamps.
• Technical authentication data: session tokens and the IP address and user agent recorded by Supabase Auth when you sign up or sign in.
• Workspace data: workspace name and time zone, memberships and roles, and the content you create or sync, such as programs, projects, milestones, dependencies, blockers, risks, decisions, scenarios, approval requests and reports.
• Audit log: who performed which consequential action, on which resource and when.
• Integration metadata: which provider is connected, its status, the last four characters of a key, and sync timestamps and errors.

Account emails, such as the link to confirm your email address, are sent through the email service of Supabase Auth to the address you entered.

Purpose and legal basis: providing the service under our contract with you or your organization, Art. 6(1)(b) GDPR. The audit log also serves our legitimate interest in the security and traceability of the service, Art. 6(1)(f) GDPR.

Retention: account data is stored until you delete your account or ask us to delete it. Workspace data is stored until the workspace is deleted. Audit log entries are kept as long as the workspace exists. Authentication logs at Supabase are kept for a short period according to Supabase's retention settings. Where statutory retention periods apply (for example 6 or 10 years for business and tax records under German commercial and tax law), we restrict processing instead of deleting.

Supabase, Inc. is based in the USA. Where the provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). In addition, or where no certification applies, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) included in the provider's data processing terms.

Signup is currently invite-only. When you create an account, we check the access code you enter and store a redemption record (the code, your user ID, your email address and the time of redemption) to enforce usage limits and prevent abuse. Legal basis: Art. 6(1)(b) and (f) GDPR. The redemption record is kept as long as your account exists.

An administrator of your workspace can connect the following tools:

• Jira Cloud (Atlassian): projects, issues, status, assignees, due dates and issue links are read (read only).
• Asana: projects, tasks, milestones, assignees, completion and due dates are read (read only).
• Slack: escalation and status messages are posted to the channel you choose, and only after a person in your workspace has approved the exact message.

API keys and access tokens are sent once and stored server side in a database table that cannot be read from the browser; only our server functions use them to call the provider. We fetch data only on your instruction: when you or an AI client you authorized starts a sync, and through change notifications (webhooks) if you set them up. If you use the optional OAuth sign-in for Jira or Asana, the provider sends us an access token for the permissions you grant.

For the data in your connected tools, your organization is the controller and we act as its processor under Art. 28 GDPR. A data processing agreement is available on request at team@theprogrammanager.com. Your use of Atlassian, Asana and Slack is governed by your own agreements with those providers.

Retention: synced data and credentials are stored until you disconnect the integration or delete the workspace. Disconnecting removes the stored key.

You can connect an AI client that supports the Model Context Protocol (MCP), for example Claude, ChatGPT, Claude Code or Cursor, with a workspace token created under Settings. We store only a SHA-256 hash of the token, its prefix, its name, who created it and when it was last used. The full token is shown once and never stored.

When the AI client calls a tool, we return the requested workspace data to that client. From then on, the data is processed by the AI provider (for example Anthropic or OpenAI) under your or your organization's own agreement with that provider. Changes proposed by an AI client are never executed directly: they wait in the approval queue until a person approves them in the web app.

The "Open in Claude" and "Open in ChatGPT" buttons open the provider's website in a new tab with a prepared question in the address. The question is transmitted to that provider only when you click the button.

Legal basis: Art. 6(1)(b) GDPR. Tokens are kept until you revoke them or the workspace is deleted.

The blog at theprogrammanager.com/blog/ runs on WordPress, hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Requests to /blog/ are passed through Netlify (see section 3) to this server. ALL-INKL.COM records server logs with the same kind of access data as listed in section 3. ALL-INKL.COM processes this data on our behalf (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR.

Comments: if you write a comment, we store your name, email address, optional website, the comment text, the time and your IP address. The email address is not published. Spam is filtered by the WordPress plugin Antispam Bee, which runs on our own server and does not send data to third parties. Profile pictures (Gravatar) are disabled, so no data is sent to Gravatar. Legal basis: Art. 6(1)(f) GDPR (running a comment function and preventing abuse). Comments are stored as long as the article is online or until you ask us to delete them.

WordPress may set cookies that are needed for logged-in authors and to remember your name and email address in the comment form, if you choose this option. These are strictly necessary or requested by you (§ 25(2) No. 2 TDDDG).

We do not use analytics, advertising or tracking cookies, and we do not use tracking pixels or social media plugins. The web app stores only the following in your browser's local storage:

• The Supabase sign-in session (key starting with "sb-"), so you stay signed in.
• Your active workspace and interface preferences, such as the theme (light or dark), the collapsed sidebar, connected AI clients and view settings (keys starting with "tpm-" or "pm-").

This storage is strictly necessary to provide the service you requested, so no consent is required (§ 25(2) No. 2 TDDDG). The subsequent processing is based on Art. 6(1)(b) and (f) GDPR. You can delete the entries at any time in your browser settings; signing out removes the session.

Fonts (Inter and JetBrains Mono) are delivered from our own domain. No connection to Google Fonts or other font services is made.

If you email us at team@theprogrammanager.com, we process your email address, name and the content of your message to answer you. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (our interest in answering inquiries). We delete the correspondence when the matter is settled, unless statutory retention periods apply.

Besides the operator, personal data is received by:

• Netlify, Inc., USA, and StackBlitz, Inc. (Bolt.new), USA: hosting and delivery of the website and web app.
• Supabase, Inc., USA: authentication, database, server functions and account emails.
• ALL-INKL.COM - Neue Medien Münnich, Germany: hosting of the blog.
• Atlassian, Asana and Slack: only if your workspace connects them, as described in section 6.
• The provider of an AI client you connect: only the data your client requests, as described in section 7.

We do not sell personal data and do not share it for advertising. We disclose data to authorities only where we are legally obliged to.

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21),
• withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

To exercise these rights, email team@theprogrammanager.com. If your organization controls the data (section 6), we will forward your request to it or support it in answering.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is the Sächsische Datenschutz- und Transparenzbeauftragte in Dresden (www.datenschutz.sachsen.de).

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Milestone impact is calculated with deterministic date rules, and actions proposed by AI agents are only carried out after a person approves them.

All connections use TLS encryption. Workspace data is isolated per organization by row-level security in the database, credentials are stored server side only, and consequential actions are recorded in an audit log.

You are not obliged to provide personal data. Without an email address and password, however, we cannot create an account for you.

We update this policy when the service or the legal situation changes. The current version is always available on this page.