Page Comparison

Play SQL is located in France, Europe, which is famous for protecting the consumer's rights and privacy. On the other hand we want to provide a good service to customers, and that means understanding how features are used.

CNIL

CNIL is the French regulatory body which ensures that personal data privacy laws are dutifully applied.

The following policy is covered by the norm NS-48 (see details) and the file has been declared to CNIL. For any enquiry, the contact person is Adrien Ragot (see details below).

What data we have

We have:

• Billing information: Information transmitted to us by Atlassian for the payment of the software licenses and the execution of the contract. It is mostly names, email addresses, phone numbers and license type. No credit card information.
• API information: Information provided to our software through the APIs of Atlassian products. Personally identifiable information includes user keys, emails, names, and IPs.
• In-App Analytics: Information we gather in our software about the usage of our online or offline apps. Personally identifiable information includes actions of users on our features, the number of users, the type of license, information the user explicitly provides (such as "Please enter the email address that Play SQL can use to contact you").
• Application data: Data created by the users in the application.
• Web Analytics: Information we gather about viewers of our websites, directly or through an analytics service (Google Analytics).
• Information you provide through the support, either by email or through a website (e.g. Atlassian Answers).

...

This is our privacy policy for all our apps and websites, as of January 29th, 2019.

Atlassian is not responsible for the privacy, security or integrity of Vendor-Collected End User Data.

What information we collect

We mostly gather information through support cases. We also receive information from Atlassian through licenses ("Atlassian-collected end-user data"), Jira support issues, and from Google Analytics which we use our websites.

We host data created by users in our Cloud apps.

We don't gather any data when apps are installed by the customers on their own server, with the exception of the "feedback job" in Play SQL Base, explained in the table below.

How we use information we collect

We use the information to:

• Provide the service,
• Provide support for the software,
• Explain features and develop engagement about the software,
• Balance the time we spend improving features which are used the most,
• We may use information in aggregated form (statistics, etc) for advertising,
• For accounting purpose, concerning billing information,
• For legal reasons, to protect the owner, the company, the software or when required by law.

This includes:

• Customers with a license are added to a mailing list to notify them about features of the product. They can unsubscribe from this mailing list.

What data is collected?

Data collected in the products

Atlassian defines:

• Atlassian-collected end-user data (basically, the license details)
• Vendor-collected end-user data, which we've split in 3 categories:
  • Data containing PII,
  • Other collected data, in normal usage (The free data that users create in the application - We only "collect" this data when you use Cloud products),
  • Data collected by the application when sending a support request (only for Requirement Yogi).

Atlassian is not responsible for the privacy, security or integrity of Vendor-Collected End User Data.

(1) As defined in Atlassian Marketplace Publisher Agreement, section §8.4. 

(2) Free data may contain PII if users have entered some.

(3) PII: Personally identifiable information (user names, email, phone number, etc).

The feedback job for Play SQL Base

In Play SQL Base and Play SQL Spreadsheets, there is a feedback job:

• The PII in this data is the Server ID and the server's default email.
• The administrator is requested whether they want to leave in on, during the installation.
• The administrator can later disable this option, in the "Privacy Policy" tab,
• The "feedback email" is sent every month to Play SQL, using Confluence's default mail feature,
• The other contents of the email can be seen in the "Privacy policy" tab,
• The other contents of the email are: the sender email (which is the default email of the Confluence server), the server ID, the Confluence and Play SQL Spreadsheets versions, the number and type of databases connected to Play SQL, the number of users on the instance, the count of usage of 4 features (queries, parameters, timeout, formulas).

If the administrator has deactivated this feedback job, then no information is sent to Play SQL.

What other data is collected?

• We have Google Analytics on our websites.
  • Google collects data about page views which is returned in a form that is not personally identifiable to us, notably aggregated by location, age, gender or demographic factors.
  • We do not engage in remarketing.
  • We have NOT enabled Advertising features in Google Analytics.
• We have mailing-lists, managed by MailChimp. Users can opt-in, out-out and manage their subscription by clicking on the link in emails.
• Users can get support through a Jira Cloud website, which is under Atlassian's privacy policy.
• Users can get support by email, in which case we manage our emails through FastMail.

How we share information we collect

Play SQL is currently a sole-trader company (titled company type "SASU" in France) with:

• The founder, Adrien Ragot,
• If any employee or intern is hired, they sign a contract stating that they are strongly forbidden from leaking any information,
• Temporary contractors, hired for a specific time or project.

...

Use and purpose of the information we collect

We use the information to:

• Provide the service,
• Provide support for the software,
• Explain features and develop engagement about the software,
• Balance the time we spend improving features which are used the most,
• We may use information in aggregated form (statistics, etc) for advertising,
• For legal reasons, to protect the owner, the company, the software or when required by law.

This includes:

• Customers who create an evaluation license are subscribed by default to an "Evaluator Training" mailing list which explains how to use the product week by week,
• Accessing the user's data for to provide support.

How we keep our servers secure

We make our best to use state-of-the-art techniques to keep the data safe:

• We use SSH keys to access our servers,
• Our customer-facing activities use HTTPS and SSL certificates,
• We don't transfer data in clear-text over the network, except in situations where we display a warning,
• The hard drives of our personal computers are encrypted (for example with Apple's FileVault 2),
• Our backup drives are encrypted (for example with Apple's FileVault 2 / Time Machine).
• Whenever a leak affecting the software we use is published (for example Heartbleed or Shellshock), we halt the service in emergency and upgrade our systems.

We cannot guarantee that no leak will ever happen, but we make our best to keep your data safe.

How you can opt out

• Viewers can opt-out of Google Analytics for Display Advertising and customize Google Display Network ads using the Ads Settings.
• Users of Play SQL Spreadsheets for Confluence Server can opt-out of In-App Analytics inside the software.
• Keep your computers secure, using up-to-date software and higher settings for SSL certificates.

How the information is processed - and how we share with partners

The information is processed on servers around the world. This may include servers which are not in your country of residence. In most cases:

• The web servers are located in Europe and USA,
• The Atlassian servers are not under our control,
• The author is based in France, so your data may be downloaded and processed on personal computers.
• We process your information using partners' services. We never sell or provide partners with permission to collect, use or sell your information. Our partners include:
  • Hosting: Amazon, Digital Ocean, 1and1, OVH,
  • The mailing partner: MailChimp,
  • Marketplace platform: Atlassian,
  • Support: Twitter, Google Mail, FastMail,
  • Please see our "Providers" page for the details of our providers.

Deletion

Your information will not be kept longer than 2 years after the end of our commercial relationship. The data which may be used for legal reasons (in the event of a trial for example) will be kept as long as required by the law.

...

How we host and transfer data internationally

Security

Please see our Security Policy.

How long we keep information

We try to delete data as early as possible, except for backups which we keep a little longer. 

Our providers, where we keep information and how it is transferred internationally

Our products are generally hosted by Digital Ocean, except our website which is managed by OVH, France. The computers we use to create software and access your information are located in France.

Data	Product	Where it is hosted	Link	Data Processing Addenum
Cloud	Play SQL Spreadsheets	Digital Ocean, Amsterdam, Netherlands	https://www.digitalocean.com/legal/	Part of their ToS
Cloud	SQL Connector	Digital Ocean, Amsterdam, Netherlands
Cloud	CYO Create Your Own	Digital Ocean, Amsterdam, Netherlands
Cloud	Backups	Digital Ocean, Amsterdam, Netherlands
Web	Our website	OVH, France	https://www.ovh.com/fr/protection-donnees-personnelles/	Part 2 of their ToS
Mailing lists	All	MailChimp, USA	https://mailchimp.com/legal/privacy/	Signed (2019-01-29 MailChimp DPA.pdf)
Email	Fastmail	Fastmail, Australia / USA.	https://www.fastmail.com/help/ourservice/security.html	Part of their ToS
Desktop	Our computers, our company, etc.	Encrypted laptops and desktops, France.	-

We plan to use Amazon Web Services in the future for several of those services.

How to access and control your information

You have a right to access the personal information we collect and correct it. You may perform this right of access and correction by mail to:

Adrien Ragot
107 cours Gambetta
69003 Lyon

Most of the processes are automated:

• Concerning the "feedback job" of Play SQL Spreadsheets, you can disable it in the "Privacy Policy" tab of your add-on,
• Concerning the data that is sent for support cases, you are notified and you can send an email manually to us,
• Concerning the free data that you create in the Cloud apps, you can edit it in the application.
• Concerning backups, our Cloud products contain a "Backup" page which can be used to export your data.

If any process is not automated or you do not know how to exercise your rights, you may exercise them by contacting Adrien Ragot at:

How we update this policy

We may update this policy without notice, for the purposes of being more specific, reflecting a new practice or complying to legal requirements.

Change log:

• January 29th, 2018: Rewrite, to comply with Atlassian's request for updated policies, to have one policy for all products, to be specific on the location of your data, and to reflect up-to-date information.
• September 11th, 2015: Add sections "What data we have", "Who accesses the data", "How we keep our servers secure", "How you can opt out" - see page history.
• November 11th, 2013: Rewrite, to go from generic statements to specific ones.
• October 2nd, 2013: Original version.

Application

Our Privacy Policy applies to all of the websites and software offered by us and our affiliates, but excludes services that have separate privacy policies that do not incorporate this Privacy Policy. It excludes services offered by Atlassian or any other provider.

When we receive formal written complaints, we contact the person who made the complaint to follow up. In case of dispute, we seek the best amicable resolution. We may work with appropriate regulatory authorities to resolve complaints. The privacy policy is governed by the laws of France, and, subject to the following sentence, in case of dispute, the parties irrevocably and unconditionally submit to the exclusive jurisdiction of the courts of Lyon, France.

Our Privacy Policy may change from time to time. We will post any privacy policy changes on this page.