TickPax — Privacy Policy
Effective date: 26 September 2026 Controller for this policy: TickPax (https://tickpax.com) Contact: privacy@tickpax.com
This policy explains what personal data TickPax handles, why, and what rights people have.
1. Two different roles, and why the difference matters
TickPax handles personal data in two distinct capacities. Which one applies determines who you should contact about your data.
As a processor — engineering activity data. When a company installs TickPax into its Azure DevOps organization, that company decides what is collected and why. It is the controller; we act as a processor on its instructions, under the Data Processing Addendum. This covers everything TickPax reads from Azure DevOps about a company's engineers.
If you are an engineer whose activity TickPax processes, your employer — not TickPax — decides that TickPax is used and is your first point of contact for access, correction or deletion. We will support them in answering you, and you may also contact us at privacy@tickpax.com.
As a controller — our own business data. For website visitors, people who contact us, and the administrators who manage a TickPax account, we decide the purposes ourselves and act as controller. Sections 3 to 9 describe that role.
2. What TickPax reads from Azure DevOps (processor role)
The complete list. Nothing outside it is retrieved.
Read:
| Category | Detail |
|---|---|
| Identity | Display name, email address, Azure DevOps user ID, and Azure AD object ID of Authorized Users and of activity authors |
| Commit activity | Commit ID, author, committer, timestamps, push time. Commit message text is read in transit only — work item references such as #123 are extracted from it, and the text itself is discarded before anything is written to our database |
| Code change shape | Paths of changed files and change type (add / edit / delete) — never file contents |
| Pull requests | ID, title, author, reviewers, timestamps. Review comment text is read in transit only — how many comments there were and when is counted, the text itself is discarded and never stored |
| Work items | ID, type, state, assignee, iteration and area path, title, state-transition history. Description, acceptance criteria, repro steps and comment text are read in transit only — their length is counted as a measure of authored volume, and the text itself is never stored |
| Organization structure | Project list, repository list, and the organization's user list via the Azure DevOps Member Entitlement API |
| Generated in TickPax | Time logs, categories, AI proposals, approvals, settings, and an audit trail of user-management actions |
Never read: source code or file contents; line-level diffs; build, release or pipeline data; wikis, test plans or dashboards; anything in Microsoft 365 — TickPax requests no Microsoft Graph permission and holds no access to mail, files or the directory.
Text your engineers write is not retained. Commit messages, pull request review comments, work item comments, descriptions, acceptance criteria and repro steps are stripped at the moment a webhook is received — before the payload reaches our database — and are not sent to the AI provider on any path. What survives is countable: how many commits and comments there were, when they happened, how many files changed, how much text was authored, and any work item number that text referenced. Work item titles are the single exception: those are retained, because the Service displays them back to you on proposals, time logs and reports.
Personal data is unavoidable here: the entire product works by attributing activity to the individual who performed it.
3. What we collect as controller
| Category | Data | Why | Lawful basis |
|---|---|---|---|
| Account | Name, email, Azure DevOps organization name, role | Provide the Service, authenticate administrators | Contract |
| Billing | Company name, billing contact, subscription and seat records, invoice references | Take payment, meet accounting duties. Card details are handled by Dodo Payments and never reach us | Contract; legal obligation |
| Support | Correspondence you send us | Answer you and improve the product | Legitimate interests |
| Security & operational logs | IP address, timestamps, request paths, error diagnostics | Keep the Service secure and working; investigate abuse | Legitimate interests |
| Website | See §7 |
4. AI processing
Proposals are generated using Google Gemini, accessed over an API from our servers.
What is sent depends on the path:
| Path | Sent to the model |
|---|---|
| Primary work item estimation | Masked. Work item title is replaced with the literal token TASK-TITLE, description with TASK-DESCRIPTION, every comment body with COMMENT-1, COMMENT-2, …, and every user identity with USER-1, USER-2, …. Only timings, state transitions, event counts and file counts are sent as-is |
| Activity cluster estimation | Metadata only — durations, event counts, role signals, and structural event summaries (event type, timestamp, work item id, activity kind, a coarse content-volume bucket). No authored text |
| Fallback estimation, used when work item details cannot be retrieved | Timings, event counts and file counts only. No text |
| Untracked work matching | Nothing is sent — no model is used. An untracked commit or pull request is matched to a work item using only the reference its author wrote: a #249 recovered from the commit message at ingestion, or the number in the branch name. That matching runs on our own servers |
No text written by your engineers is sent to the model on any path — not commit messages, review comments, work item comments, titles or descriptions. What the model receives is timings, counts, file counts, work item state values, and opaque tokens in place of anything authored.
Your data is not used to train AI models. Content sent to Google Gemini is used solely to generate that customer's Proposals. No source code is ever sent, because TickPax never retrieves it.
No solely automated decisions. A Proposal has no effect until a person reviews and approves it. TickPax does not make automated decisions producing legal or similarly significant effects, within the meaning of Article 22 GDPR.
5. Where your data is held
| Purpose | Provider | Location |
|---|---|---|
| Application and database hosting | Hetzner Online GmbH | Falkenstein, Germany |
| Backups | Hetzner Storage Box | Germany |
| Secrets management | Microsoft Azure Key Vault | West Europe |
| AI inference | Google (Gemini API) | May be processed outside the EEA |
| Payments | Dodo Payments | Merchant of Record; see their privacy notice |
Customer Data is stored in the European Union. The only routine transfer outside the EEA is to Google for AI inference, made under the European Commission's Standard Contractual Clauses together with a decisive technical measure: no free text written by your people is transferred on any path. Titles, descriptions, comment bodies and user identities are replaced with opaque tokens before the request leaves our servers, and commit messages and review comments were already discarded at the point of receipt.
6. How long we keep data
| Data | Retention |
|---|---|
| Commit message, review comment and work item comment text | Never stored. Removed at the point of receipt, before the payload is written to our database |
| Raw Azure DevOps webhook payloads (metadata that remains after the above) | 7 days, then purged |
| Time logs, proposals, categories, settings | For the life of the account |
| Records marked deleted in the app | Soft-deleted immediately (hidden from all access), purged on our deletion cycle |
| Customer Data after account termination | Deleted or anonymised within 90 days, except where law requires retention |
| Billing and invoice records | As required by tax and accounting law |
| Security logs | Up to 12 months |
Backups age out on their own cycle after deletion.
7. Website
The TickPax marketing site is deliberately light. It sets no advertising cookies and runs no third-party ad trackers. Where we use analytics, it is configured without cross-site tracking, and any non-essential cookie is set only with your consent, which you may withdraw at any time.
8. Security
- OAuth access and refresh tokens are encrypted at rest.
- Card data never reaches our systems — Dodo Payments handles it.
- Access to production systems is restricted and authenticated; secrets are held in Azure Key Vault rather than in configuration.
- Every user's identity is bound to their verified Azure AD object ID, so one user cannot act as another. Requests that fail this check are rejected.
- Webhook deliveries are authenticated with a shared secret before being accepted.
- Data in transit is protected with TLS.
No system is perfectly secure. If we become aware of a personal data breach affecting Customer Data, we notify the affected customer without undue delay, as set out in the Data Processing Addendum.
9. Your rights
Where we act as controller, you may request access to your personal data, correction, deletion, restriction, portability, and may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time.
Contact privacy@tickpax.com. We respond within one month. We may need to verify your identity.
You may complain to your local data protection authority. Where we act as processor, please contact the company that operates the TickPax account — your employer or client — first.
10. Children
TickPax is a business product and is not directed at anyone under 16. We do not knowingly collect their data.
11. Changes
We may update this policy. Material changes will be notified by email to account administrators or by notice in the Service before they take effect. The effective date above always reflects the current version.
12. Contact
TickPax https://tickpax.com privacy@tickpax.com