← Back to IK Lab

Privacy Policy

Borsch — AI Backlog Quality for Azure DevOps and Jira — Effective April 3, 2026 | Last updated: July 24, 2026
Developer: Ihor Kosheliev | Publisher: IK Lab

Overview

Borsch is a Marketplace app for Azure DevOps and Jira that refines backlog items — generating test cases, sharpening bug reports, and enriching user stories — using AI. This privacy policy explains what data is accessed, how it is processed, and what is stored.

We are committed to minimal data collection. Borsch does not collect personal information, does not use cookies, and does not track individual users.

1. Data We Access and Process (Not Stored)

When you generate, Borsch reads the following data from the current work item (Azure DevOps) or issue (Jira):

• Title and description
• Acceptance criteria
• Discussion comments (human-authored comments only)
• Azure DevOps Wiki page content (only for pages you explicitly configure or select)

This data is sent to our backend service for AI processing. It is processed in real-time and not stored on our servers. Once the AI response is returned, the input data is discarded.

2. Data We Store

Data	Where	Purpose	Retention
Organization ID	Azure Table Storage (West Europe, Netherlands)	Usage tracking	Deleted with the usage row it belongs to — 60–95 days
Monthly usage count	Azure Table Storage (West Europe, Netherlands)	Plan limit enforcement	Counts toward your limit for its own month; the row is deleted automatically after 60–95 days
Subscription info	Azure Table Storage (West Europe, Netherlands)	Billing management	Until canceled
Project settings	Azure DevOps Extension Data Service	AI context	Controlled by you

We do not store: work item / issue content, wiki content, generated output, or any personal user data.

3. Data We Do Not Collect

• Personal information (names, emails, profile data)
• Authentication credentials or access tokens
• Browser cookies, local storage, or session data
• Analytics or telemetry about individual users
• IP addresses or device information

4. Third-Party Services

OpenAI API — Work item content is sent to the OpenAI API to generate the requested output (test cases, story scoring and enrichment, bug reports). Data sent via the API is not used to train models. OpenAI API Data Policy

Microsoft Azure — Backend and storage hosted in West Europe (Netherlands), inside the EEA. Azure Privacy

Stripe — Payment processing for paid plans. Stripe handles all payment data. Borsch never sees or stores credit card numbers. Stripe Privacy

Azure DevOps — Project settings stored within your own Azure DevOps organization via the Extension Data Service.

Atlassian (Jira) — On Jira, Borsch runs on Atlassian Forge; project settings are stored in Forge storage within your own Atlassian site. Borsch requests no Confluence permissions and reads no Confluence content.

5. Data Flow

1. User generates on a work item (Azure DevOps) or issue (Jira).
2. Borsch reads the item's fields and, on Azure DevOps, any Wiki pages you selected.
3. Content is sent over HTTPS to our Azure Function backend (West Europe).
4. Backend forwards content to OpenAI API for generation.
5. The generated output is returned to the extension.
6. Extension creates Test Case work items in Azure DevOps.
7. Usage counter is incremented. No content is retained.

6. Data Security

• All data in transit encrypted via HTTPS/TLS
• No work item content stored at rest
• Azure Table Storage uses built-in encryption at rest
• Access tokens used in-transit only, never persisted

7. GDPR Compliance

• Data minimization: Only organization ID and usage count stored
• Purpose limitation: Data processed solely to produce the backlog output you requested — test cases, story scoring/enrichment, or bug reports
• Data location: EEA — Azure West Europe (Netherlands). AI processing is performed by OpenAI in the United States under Standard Contractual Clauses.
• Storage limitation: Usage records are deleted automatically by a daily job once they fall outside a three-month window, so an organization ID survives an uninstall by 60–95 days at most. No request is needed.
• Right to deletion: Contact us to remove your organization's data sooner

8. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by updating the date above. Continued use constitutes acceptance.

9. Contact

Ihor Kosheliev
Email: [email protected]