IssueTraq does not sell personal information or use it for targeted advertising. Team content is shared only as needed to provide the collaboration features you choose to use.
1. Who we are
IssueTraq ("IssueTraq", "we", "us", or "our") provides a collaborative service for creating groups, tracking issues, assigning work, discussing progress, exchanging direct messages, and sharing related files. For personal information processed to operate the service, IssueTraq is the data controller.
For privacy questions or requests, contact [email protected].
2. Scope of this policy
This policy applies to the IssueTraq website, mobile applications, APIs, email and push notifications, and related services (together, the "Service"). It does not govern third-party websites or services that have their own privacy policies.
Groups are collaborative spaces. Group owners and administrators control membership, roles, and access within their groups. Depending on the circumstances, an organisation using IssueTraq may also have its own responsibilities for information its members place in a group.
3. Information we collect
Information you provide
- Account information: username, first and last name, email address, optional phone number, password in hashed form, profile image, account status, and email-verification information.
- Workspace information: groups you create or join, membership status, role, notification preferences, invitations and join requests.
- Content: issues, descriptions, priorities, deadlines, categories, assignments, comments, direct messages, replies, filenames, captions, and uploaded images or documents.
- Support communications: information you send when reporting a problem, requesting help, or exercising a privacy right.
Information collected automatically
- Authentication and device data: session and refresh-token records, push-notification tokens, login method, and security events.
- Technical data: IP address, device and browser type, operating system, request timestamps, diagnostic logs, and similar information needed to operate and secure the Service.
- Usage data: actions such as creating, updating, reading, or deleting Service content, where recorded for functionality, troubleshooting, abuse prevention, or audit purposes.
Information from other sources
- Google sign-in: when you choose Google authentication, we receive the verified email address and basic account details made available by Google.
- Other users: a member may invite you using your username or email address, assign work to you, mention you, or include information about you in team content.
Please do not upload highly sensitive personal information unless it is genuinely necessary for your team's work and you are authorised to do so.
4. How and why we use information
| Purpose | Typical legal basis |
|---|---|
| Create accounts, authenticate users, provide groups, issues, messaging, files, and notifications. | Performance of our contract with you. |
| Verify email addresses, recover accounts, deliver invitations, and respond to support requests. | Contract and our legitimate interest in providing reliable support. |
| Protect accounts, prevent abuse, investigate incidents, maintain logs, and enforce our Terms. | Our legitimate interests in security, integrity, and fraud prevention. |
| Send optional device notifications and apply your notification preferences. | Your choice or consent, where consent is required. |
| Comply with valid legal requests, preserve evidence, and meet regulatory obligations. | Legal obligation or legitimate interests. |
| Improve performance, reliability, accessibility, and product design using aggregated or diagnostic information. | Our legitimate interests in improving the Service. |
Where we rely on legitimate interests, we consider the impact on your rights. Where consent is the legal basis, you may withdraw it at any time without affecting earlier lawful processing.
IssueTraq does not use personal information to make decisions that produce legal or similarly significant effects through solely automated processing.
5. How information is shared
We may disclose information in these circumstances:
- Within the Service: profile details and content may be visible to members who have access to the relevant group, issue, or conversation. Group owners and administrators can manage members and may have broader visibility for moderation and administration.
- Service providers: hosting, database, storage, email-delivery, background-job, security, and technical-support providers process information for us under appropriate instructions and safeguards.
- Google and Firebase services: Google may process information when you use Google sign-in, and Firebase Cloud Messaging may process device tokens and notification-delivery data when push notifications are enabled.
- Legal and safety reasons: we may disclose information when reasonably necessary to comply with law, respond to lawful process, protect people or the Service, investigate fraud or abuse, or establish and defend legal claims.
- Business changes: information may be transferred in connection with a merger, financing, reorganisation, sale, or acquisition, subject to confidentiality and applicable law.
- With your direction: we share information when you request it or otherwise give valid consent.
We do not sell or rent personal information.
6. International processing
IssueTraq and its service providers may process information in countries other than your own. Where applicable law requires it, we use recognised safeguards for international transfers and assess whether the destination provides an adequate level of protection. You may contact us for information about safeguards relevant to your data.
8. Retention and account deletion
We keep personal information only for as long as reasonably necessary for the purposes described here, including providing the Service, maintaining security, resolving disputes, and meeting legal obligations. Retention depends on the record:
- Account and active workspace data is generally retained while the account or relevant group remains active.
- Authentication tokens expire or are revoked according to their purpose. Diagnostic and security logs are retained for a limited operational period unless an incident or legal obligation requires longer retention.
- Backups may retain deleted information temporarily until they rotate out of the backup cycle.
Deleting your account
You may request deletion from your profile. IssueTraq schedules deletion with a six-hour grace period. A successful login before the deadline cancels the request and restores the account.
After the grace period, IssueTraq permanently disables the account and removes or anonymises direct identifiers, including replacing the displayed identity with Deleted User and releasing the original email address and username for possible reuse. Session tokens, notification tokens, group memberships, invitations, and similar account-specific records are removed.
Some content and references created in shared team spaces may need to remain so that other members retain a coherent work history, satisfy security or legal needs, and avoid breaking group records. Where retained, the former account is represented by the anonymised Deleted User identity rather than its original profile details. A group owned by a deleted account may remain under that anonymised owner until an eligible active group administrator claims ownership.
Deletion may be blocked where an owned group has no other active administrator, or where deletion would remove the last active system administrator. The Service will identify the action that must be resolved first.
9. Security
We use administrative, technical, and organisational measures designed to protect information, including access controls, hashed passwords, token-based authentication, role-based permissions, and restrictions on sensitive operations. No internet service can guarantee absolute security. You are responsible for protecting your credentials, keeping devices secure, and promptly reporting suspected unauthorised access.
10. Your privacy rights
Depending on your location and applicable law, including the Nigeria Data Protection Act 2023, you may have rights to:
- be informed about our processing and obtain access to your personal information;
- correct inaccurate or incomplete information;
- request deletion, restriction, or data portability where applicable;
- object to processing based on legitimate interests;
- withdraw consent where processing relies on consent; and
- complain to the Nigeria Data Protection Commission or another competent supervisory authority.
To exercise a right, email [email protected]. We may need to verify your identity and may limit a request where permitted by law, including to protect another person's rights. We will respond within the period required by applicable law.
11. Children's privacy
The Service is intended for users aged 18 or older and is not directed to children. We do not knowingly collect personal information from a child without legally valid authorisation. If you believe a child has provided information improperly, contact us so we can investigate and take appropriate action.
12. Changes to this policy
We may update these Terms to reflect changes in the Service, law, security, or business practices. Revised Terms will be posted on this page with a new "Last updated" date. We may not always be able to notify every user individually, so you are responsible for reviewing these Terms periodically, particularly before continuing to use the Service after an update.
Where applicable law requires direct or advance notice of a material change, we will provide it through the Service, by email, or by another reasonable method. Unless a different date is stated or required by law, revised Terms take effect when posted. Your continued use of the Service after they take effect constitutes acceptance of the revised Terms. If you do not agree, you must stop using the Service.
13. Contact and complaints
Questions, complaints, and privacy requests can be sent to:
IssueTraq PrivacyEmail: [email protected]
You also have the right to contact the Nigeria Data Protection Commission or the data-protection authority responsible for your location.