Privacy Policy
Last updated 8 November 2026
BackstopSync is a Jira Cloud app, distributed through the Atlassian Marketplace, that syncs
Intercom conversations to Jira issues. This policy explains what the app and its backend at
api.backstopsync.com process, where, for how long, and how to have it deleted. It
also covers this website.
Who is responsible
Parim Suka (BackstopSync)c/o Ben Kahla
Uhlandstraße 111
10717 Berlin
Germany
Email: support@backstopsync.com
Our two roles
Your synced content. The conversations, notes and issue updates that pass through BackstopSync belong to the organisation that installed the app (“you”). We process them only to provide the sync, on your instructions, as your processor under Article 28 GDPR. The data processing terms are part of our End User Terms. If you are a person whose conversation was synced, the organisation you contacted is responsible for your data; please contact them first.
Account and operational data. For the small amount of data we need to run the service itself — connection details, alert settings and server logs — we are the controller.
What we process
| Data | Why | How long |
|---|---|---|
| Events received from Intercom and Jira: conversation messages and notes, with the names and email addresses Intercom includes in them, and Jira issue keys and statuses. Each event is limited to 256 KB. | To create the Jira issue, append the comment or post the status note. | Deleted 30 days after it was processed successfully. An event that failed stays in your failed-items list until you retry it successfully or its data is deleted (see below), so that you can see and retry it. |
| Sync history: each run of the sync, its counts, and the error details of failed attempts, which can quote the event's content. | To show you the run history and why an item failed. | 90 days. |
| Links between Intercom conversations and Jira issues (IDs only). | So that one conversation never creates two issues. | While the app is installed; deleted with the rest of your data. |
| Connection details: your Jira site's ID and address, your Intercom workspace ID, the name and ID of the Intercom admin who connected it, and the access tokens for both. | To call Jira and Intercom on your behalf, and to show who connected Intercom. | Until the app is uninstalled and your data deleted. Disconnecting Intercom revokes its token immediately. |
| Settings: the Jira project and issue type, the trigger tag, and the alert email address and webhook URL an admin enters. | To run the sync as configured and to send failure alerts. | Until changed, or until your data is deleted. |
Server logs: IP address, time, requested path (with sign-in codes removed),
response status and browser type for requests to api.backstopsync.com.
Application logs record internal IDs and outcomes, never message content or
tokens. |
To operate the service, find faults and protect it against abuse. | Kept in size-limited files of at most 50 MB per service; the oldest entries are overwritten as new ones arrive. |
We look at synced content only when we have to, to operate the service or to investigate a problem, such as a failed item you ask us about. We do not sell data, show advertising, use analytics or tracking, or use your content to train AI models.
Where it is processed
The backend and its database run on servers of Hetzner Online GmbH in Nuremberg, Germany. We do not transfer your synced content outside the EU. The app's screens inside Jira are hosted by Atlassian as part of its Forge platform, and Jira and Intercom handle your data under your own agreements with them.
Subprocessors
| Company | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database and backups | Germany |
| Cloudflare, Inc. | DNS for backstopsync.com and hosting of this website. Synced content does not pass through Cloudflare. | Global network |
We will give at least 30 days' notice on this page, and by email if you have set an alert email address, before adding a subprocessor that handles synced content.
How it is protected
- All traffic is encrypted in transit (HTTPS).
- Access tokens are encrypted at rest with AES-256-GCM.
- Every request from Jira and Intercom is verified before anything is stored, and every database query is restricted to one customer's data.
- The database is not reachable from the internet. The server accepts SSH keys only, never passwords.
- Security updates are applied automatically.
Deleting your data
Email support@backstopsync.com from an address of your organisation at any time and we will delete all of your organisation's data from the live database. If you uninstall the app, we delete it 90 days after we detect the uninstall, so that reinstalling within that time picks up where you left off. Backups are kept for up to 30 days, so deleted data disappears from them within 30 days of its deletion.
Legal basis
We process account and operational data to provide the service you installed (Article 6(1)(b) GDPR) and, for server logs, for our legitimate interest in running a secure, reliable service (Article 6(1)(f) GDPR). Synced content is processed on your instructions under Article 28 GDPR.
Your rights
You can ask us for access to, correction, deletion or restriction of your personal data, for a copy of it, and you can object to processing based on legitimate interest. Write to support@backstopsync.com. You also have the right to complain to a data protection supervisory authority, for example the one where you live.
This website
This website is a set of static pages served by Cloudflare. It sets no cookies and has no analytics. Cloudflare processes your IP address to deliver the pages and protect them against attacks.
Changes
If we change this policy, we update the date at the top. We announce material changes on this page, and by email if you have set an alert email address, at least 30 days before they take effect.