ScrumDo Privacy Policy
Version: 2.1
Effective Date: January 1, 2019
Last Restated: October 12, 2026
This Privacy Policy (“Policy”) describes how ScrumDo, LLC (“ScrumDo,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information. This Policy applies to: (a) visitors to our websites; (b) registered users of the Services; (c) Customer Contributors who submit stories, responses, or cards; and (d) people who communicate with ScrumDo.
IF YOU DO NOT AGREE WITH THIS POLICY, DO NOT ACCESS OR USE THE SERVICES.
1. Key Concepts: Who Controls Data?
ScrumDo supports both organizational and individual use. Responsibilities and roles may differ by context.
1.1 Organization Accounts (Customer as Controller)
When an organization uses a Team, Business, or Enterprise Account, the organization (the “Account Owner” or “Customer”) typically determines the purposes and means of processing personal data within its Rooms, Boards, contribution routes, connected services, and reports. In those cases, ScrumDo generally acts as a processor/service provider under a Data Processing Agreement (“DPA”) where applicable.
1.2 Personal Plan and Direct Relationships
When you create a Personal Plan Account or otherwise interact with ScrumDo directly, ScrumDo generally acts as the controller for account, billing, support, security, and service-usage data processed to provide that relationship.
1.3 Customer Contributors and Authorized Users
If you use or contribute to an Organization Account, the Account Owner typically controls how your Content and related account or contribution data are collected and used. ScrumDo processes that information on the Account Owner’s behalf, subject to its settings and instructions and the DPA where applicable. Sensitive or regulated deployments may require a separate Enterprise agreement and review.
2. Information We Collect
We collect information depending on how you interact with the Services.
2.1 Website and Usage Information
pages viewed, actions taken, referrer URLs
device type, browser type, operating system, language
approximate location derived from IP address (general region)
cookie identifiers and analytics identifiers
session recordings of interactions on the public website (clicks, navigation, and on-screen content)
2.2 Account and Profile Information
name, email address, and organization (if provided)
account settings and preferences
authentication method (e.g., email/password, OAuth)
2.3 Work and Customer-Contribution Information
Depending on the Room, Board, contribution route, identity mode, and Account Owner settings:
cards, specifications, comments, tasks, attachments, work history, and related context
customer stories, responses to prompts, and contributor interpretations
contribution metadata, such as timestamps, route, completion indicators, and linkage to work records
identity handling that may be anonymous, pseudonymous, or identified, depending on configuration
2.4 Agent, Repository, and Verification Information
accepted specifications, proposed changes, plans, approvals, execution state, verification results, proof, and audit events
repository identifiers, branches, commits, pull-request links, and read-only repository snapshots when a configured feature requires them
agent-provider, connector, usage, cost, cap, and error metadata
2.5 Communications
emails and messages you send to support
support tickets and correspondence
newsletter subscription preferences (if applicable)
notification preferences, watches, required acknowledgements, configured destinations, and delivery status
2.6 Logs and Security Data
access logs, error logs, and security logs
audit-related events where applicable
fraud prevention and abuse detection signals
3. Cookies and Similar Technologies
We use cookies and similar technologies to: keep you signed in; remember preferences; analyze site usage; record public-website sessions so we can improve the site; and improve performance and reliability. Some cookies are essential to operate the Services.
You can manage cookies through browser settings. Disabling cookies may reduce or disable certain functionality.
Analytics and session recordings on the public website load when you visit. You can reject non-essential collection in the cookie banner, reopen cookie preferences from the footer, or send a Global Privacy Control signal.
4. How We Use Information
We use information to:
provide, operate, and maintain the Services;
authenticate users and enforce role-based access where applicable;
support Rooms, Boards, customer-contribution routes, sensemaking, planning, portfolio, notification, and governed agent features;
respond to inquiries and provide customer support;
secure the Services, detect and prevent abuse, and enforce our Terms;
improve features and user experience; and
comply with legal obligations.
5. Transcription, Translation, PII Redaction, and Third-Party Processing
Some features may use automated or third-party processing for transcription, translation, or PII redaction. When enabled:
Content may be sent to feature providers solely to perform the requested transcription, translation, or PII redaction;
outputs may contain errors and should be reviewed; and
processing is governed by our agreements with those providers and our subprocessors disclosures.
ScrumDo does not train a proprietary foundation model on Customer Content. AI in ScrumDo falls into three categories, and the data handling differs by category.
1. Bring-Your-Own-Agent (local agents). You may connect a coding agent (e.g., Claude Code, Codex, Grok, GitHub Copilot, Cursor) that runs on your own machine or infrastructure under your own provider account and keys. In this mode ScrumDo orchestrates the workflow and records the outcome, but does not transmit your Content to the model provider or authenticate the model call; your agent does, in an environment you control.
2. Customer-configured AI features ("Connected AI"). You may enable optional features that use the AI provider and API key you configure ("your Connected AI Provider"), such as spec-drift detection, behavior verification, cross-card consistency analysis, managed agent execution, or AI-assisted data transformation. When you enable one, ScrumDo transmits the relevant Content to your Connected AI Provider, on your behalf and authenticated with your key. Depending on the feature, that Content may include card specifications, related-card summaries, or a read-only snapshot of connected-repository files. The provider operates under your account and your agreement with it. For organizational use, the Customer is responsible for determining the parties' roles under applicable law, the lawfulness of the instruction, and any required transfer safeguards. ScrumDo processes this Content only on your instruction through your configuration of the feature. These features are off until you enable them.
3. ScrumDo operational AI. ScrumDo uses AI under its own provider account for limited operational features, currently support-ticket assistance (summaries and suggested replies). For these, the AI provider is ScrumDo's sub-processor, listed on our Sub-processors page, and processes only the relevant support content.
Your Content, your responsibility. You control what Content you place in ScrumDo. For Customer-configured AI, ScrumDo does not independently select or add personal information to the Content you direct to the provider; it transmits the Content and feature inputs you configure. You are responsible for the Content you submit, including any personal or sensitive information you include even inadvertently, and for the decision to route it to an AI feature. ScrumDo is not responsible for personal information a customer places in the platform that a feature the customer enabled then transmits.
5.1 Notifications and Connected Destinations
ScrumDo keeps in-product notification records, preferences, watches, acknowledgement state, routing decisions, and delivery status as part of operating the Services. If you or an Account Owner enables email, SMS, WhatsApp, Slack, Microsoft Teams, push, or webhook delivery, selected notification content and routing metadata may be transmitted to the configured provider or destination. External messages may contain a summary and link rather than the full work record, depending on policy and configuration.
Account Owners are responsible for authorizing destinations, maintaining recipient and workspace mappings, choosing which categories may leave ScrumDo, and obtaining any consent required for the selected channel. Customer-configured providers operate under the Customer's agreement with that provider. Providers engaged by ScrumDo are identified on the Subprocessors List.
No guarantees. AI-assisted and automated outputs across all three categories are provided "as is," may be inaccurate or incomplete, are not a substitute for human review, and you remain responsible for decisions made using them. Whether your Content is retained or used to improve a model is governed by your agreement with the relevant provider; for ScrumDo operational AI, we contract for no training on your content where the provider offers it.
6. How We Share Information
We may share information:
with subprocessors and service providers (e.g., hosting, analytics, messaging, and feature processors) to operate and deliver the Services;
with the Account Owner, Authorized Users, and Customer Contributors as permitted by their roles and the configured Room, Board, or contribution route;
with law enforcement, regulators, courts, or other parties when required by law or to protect rights, safety, and the integrity of the Services; and
in connection with a corporate transaction (e.g., merger, acquisition, financing, or sale of assets), subject to appropriate safeguards.
We do not sell personal information in the manner prohibited by applicable law.
7. International Transfers
ScrumDo may process information in the United States and other locations depending on service configuration, enabled features, subprocessor operations, and applicable customer agreements. Where required for cross-border transfers (including EU/EEA/UK), ScrumDo uses appropriate safeguards such as Standard Contractual Clauses (SCCs), UK addenda, and additional technical and organizational measures, consistent with the DPA and applicable law.
For projects involving Australia, New Zealand, or other jurisdictions with additional cross-border, hosting-region, notice, retention, or public-sector requirements, project-specific review may be addressed through the applicable order form, DPA, proposal, or security review process. Public legal pages summarize ScrumDo's posture; deployment-specific requirements are scoped with the customer.
8. Data Retention
Retention depends on context, plan, Account and Room settings, connected-service behavior, and legal obligations:
Website analytics and logs: retained for limited periods appropriate to security and analytics needs.
Account information: retained for the life of the Account and as necessary for billing, dispute resolution, and legal compliance.
work and contribution Content: generally controlled by the Account Owner’s configuration and contractual arrangements, subject to legal requirements.
Support communications: retained as needed to support continuity, resolve issues, and maintain operational records.
Where you request deletion, we may retain limited information if required to comply with legal obligations, resolve disputes, enforce agreements, or protect platform integrity.
Extended retention windows, controlled-purge timing, and post-termination export concessions are available to Accounts in good standing on a paid plan. Legacy free, trial, expired, suspended, or delinquent Accounts may be subject to ScrumDo's standard purge timelines, subject to applicable law and any BAA, DPA, or Order Form.
8.1 De-identified Data for Service Improvement
(Restating practice in effect since January 1, 2019.)
For Content not designated as private or confidential by the Account Owner, not subject to a Business Associate Agreement (BAA), and not otherwise restricted by an Order Form or DPA, ScrumDo may create and use de-identified, aggregated, or obfuscated data for troubleshooting, debugging, quality assurance, security analysis, and improvement of ScrumDo's own platform features.
ScrumDo will not:
- use Customer Content to train third-party AI or large-language models;
- use BAA-covered Protected Health Information for these purposes;
- use Content designated as private or confidential for these purposes; or
- re-identify or attempt to re-identify de-identified data.
De-identification will be performed consistent with industry standards, and where PHI may otherwise be in scope, consistent with HIPAA Safe Harbor (45 CFR §164.514(b)) or expert-determination methods.
9. Your Rights and Choices
Rights vary by jurisdiction and by whether ScrumDo is the controller or processor.
9.1 If ScrumDo Is the Controller
You may request access, correction, deletion, or portability, subject to legal limits. Contact: privacy@scrumdo.com
9.2 If an Organization Is the Controller
For an Organization Account, the Account Owner is typically the controller. You should direct requests concerning work or contribution Content to the Account Owner. ScrumDo will assist the Account Owner as required under the DPA and applicable law.
9.3 Website Visitors
You may manage cookies and request deletion of identifiable information ScrumDo controls, subject to legal requirements.
10. Security
We use reasonable technical and organizational measures to protect information, including access controls and monitoring. No system is perfectly secure. You are responsible for safeguarding your credentials and devices.
11. Children’s Privacy
The Services are intended for individuals who are 18 or older, unless a separate written project contract signed by ScrumDo and the applicable Account Owner expressly permits under-18 participation for a specific project. We do not knowingly collect personal information from individuals under 18 outside such contractually authorized contexts. If you believe a minor has provided personal information, contact privacy@scrumdo.com and we will take appropriate steps consistent with applicable law.
12. Changes to This Policy
We may update this Policy from time to time. If changes are material, we will post the updated Policy with a new effective date and, where appropriate, provide additional notice.
13. Contact
Questions or requests: privacy@scrumdo.com