Privacy Policy
Last updated: 27 August 2026
1. Data Controller
Wadman Information Technologies AB, hereafter "Dependra" ("we", "us", "our"), is the data controller for personal data processed through the Dependra platform (dependra.io).
- Company: Wadman Information Technologies AB (Dependra)
- Country: Sweden
- Contact email: privacy@dependra.com
2. What Personal Data We Collect
We collect and process the following categories of personal data:
| Category | Examples | Purpose |
|---|---|---|
| Account data | Full name, email address | Account creation and authentication |
| Credentials | Password hash (bcrypt) | Secure authentication |
| Usage data | IP address, browser type, pages visited, timestamps | Operational analytics and security |
| Billing data | Payment method details, invoices | Payment processing (via Mollie) |
| Audit logs | User actions within the platform | Security and compliance |
| Copilot usage metrics | Token counts, daily usage aggregates, cost accounting per tenant (no prompts, responses, or conversation content) | AI usage metering and billing (managed Copilot mode only) |
| Integration connection data | The Atlassian account ID of the administrator who connects a Jira or Confluence integration, plus installation and site identifiers | Linking a connected Atlassian installation to your organisation (only when you enable the integration — see Section 5) |
| Website measurement data | Page addresses, referring page, browser, operating system, device type, approximate country, screen size, named link-click events | Understanding how our website and signup flow are used — cookieless, self-hosted, no third party (see Section 11) |
We do not collect any special categories of personal data (e.g., health, biometric, or political data).
3. Lawful Basis for Processing
We process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):
- Contract performance (Article 6(1)(b)): Processing necessary to provide you with the Dependra platform, including account management, authentication, and core application features.
- Legitimate interest (Article 6(1)(f)): Operational analytics to improve service reliability and security, fraud prevention, and protecting our systems; and cookieless measurement of our website and signup flow to understand how they are used. We have conducted a balancing test to ensure our interests do not override your rights.
- Legal obligation (Article 6(1)(c)): Retention of billing records as required by Swedish and EU accounting regulations.
4. How We Use Your Data
Your personal data is used to:
- Provide, maintain, and improve the Dependra platform
- Authenticate you and manage your account
- Process payments and manage subscriptions
- Send transactional communications (e.g., password resets, account notifications)
- Monitor and ensure the security and availability of our services
- Comply with legal obligations
5. Data Processors and Third Parties
We share personal data with the following third-party processors who act on our behalf:
| Processor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Mollie (Mollie B.V.) | Payment processing | Billing data, email address | Netherlands (EU) | EU-based, GDPR compliant, PCI DSS certified |
| bunny.net (BunnyWay d.o.o.) | CDN and authoritative DNS for the marketing site dependra.com only — it does not serve, terminate TLS for, or provide DNS for the dependra.io application | All data in transit; connection metadata (IP address, request URL) | Slovenia (EU) | EU-based, GDPR compliant; EU-only routing enabled |
| Clever Cloud | Application hosting and database | All Customer Data and account data | France (EU) | EU-sovereign, GDPR compliant, ISO27001 certified, NIS2 aligned |
| Lettermint | Transactional email delivery | Email address, name | Netherlands (EU) | EU-based, GDPR compliant |
| Mistral AI (Mistral AI SAS) | AI model inference for the managed Copilot feature | Prompts and responses are transient (processed in-flight, not stored by Dependra); only token counts and cost metrics are retained | France (EU) — EU data partition only | EU-based, GDPR compliant; data processing confined to EU partition |
All processors are bound by data processing agreements (DPAs) that comply with GDPR Article 28. We maintain an internal register of all DPAs.
Integrations you choose to connect
Some Dependra features connect to systems that you control. These are not Dependra sub-processors: you already hold the relationship with the provider, Dependra acts only on your instruction, and you can disconnect at any time.
Atlassian (Jira and Confluence). When one of your administrators connects the Dependra apps for Jira or Confluence:
| Direction | Data | Purpose |
|---|---|---|
| Atlassian → Dependra | The Atlassian account ID of the administrator performing the connection, plus installation and site identifiers (installation ID, cloud ID, site URL) | Linking the Atlassian installation to your Dependra organisation, and verifying that requests genuinely originate from Atlassian |
| Atlassian → Dependra | An app authentication token issued by Atlassian | Allowing Dependra to call Atlassian on a schedule. Stored encrypted at rest and never returned in any API response |
| Atlassian → Dependra | Aggregate figures from Jira issue searches you define (for example, the number of matching issues) | Calculating the value of a Jira-driven Key Result. Only the resulting numeric value is retained |
| Dependra → Atlassian | Architecture documentation pages generated from your own landscape model | Publishing your architecture into the Confluence space you select. These pages may include contact details you have recorded in Dependra, such as an application's support contact name, email address and phone number |
Where your Atlassian data lives. Your Atlassian site is operated by Atlassian under your own agreement with them. Its hosting location is determined by your Atlassian plan and settings — not by Dependra. If your Atlassian site is hosted outside the EU/EEA, content published there by the Confluence integration will reside outside the EU/EEA, and may be subject to the laws of that jurisdiction. This occurs only because you enabled the integration and chose the destination space, and it is outside Dependra's control.
6. Data Sovereignty
Dependra is built EU-first. Your architecture data, your team's account information, and your operational logs are stored and processed within the European Union. Data may only be accessed from outside the EU when you or your authorized users initiate such access.
- Hosting and database: Clever Cloud, France (EU)
- Email delivery: Lettermint, Netherlands (EU)
- Payment processing: Mollie, Netherlands (EU)
- AI Copilot inference (managed mode only): Mistral AI, France (EU) — EU partition; used only when tenants opt into Dependra-managed Copilot (not applicable to BYO LLM configurations)
- No US cloud infrastructure: We do not use Amazon Web Services, Google Cloud, or Microsoft Azure for any core services. Data held in Dependra is not subject to the US CLOUD Act or similar foreign government access provisions.
All personal data, including billing information processed by Mollie, is stored and processed within the European Union (see Section 7 below).
Integrations you connect are the one exception. The guarantees above describe Dependra's own infrastructure and processors. If you connect an external system that you control — such as Atlassian Jira or Confluence — then data you direct Dependra to send to that system is stored wherever that system is hosted, under that provider's terms and jurisdiction, which Dependra neither controls nor can guarantee. See "Integrations you choose to connect" in Section 5.
7. International Data Transfers
Dependra does not transfer personal data outside the European Union. All processors — including our payment processor (Mollie B.V., Netherlands), hosting provider (Clever Cloud, France), CDN and DNS provider (BunnyWay d.o.o., Slovenia), email delivery (Lettermint, Netherlands), and AI Copilot inference provider (Mistral AI, France; EU partition only) — are EU-based and process data within the EU (see Section 6).
Should any processing ever require a transfer outside the EU/EEA, it will be safeguarded by an appropriate transfer mechanism under GDPR Chapter V (such as EU Standard Contractual Clauses), and this policy will be updated accordingly.
This section describes transfers by Dependra. It does not cover data you instruct Dependra to send to an external system you control through an integration you have enabled — for example, publishing documentation into your own Confluence site. Where that system is hosted, and any resulting transfer, is governed by your agreement with that provider. See "Integrations you choose to connect" in Section 5.
8. Data Retention
We retain your personal data for the following periods:
| Data type | Retention period | Reason |
|---|---|---|
| Account data | Active account period + 30 days after deletion | Allow account recovery and fulfil contractual obligations |
| Application logs | 90 days | Operational troubleshooting and security monitoring |
| Billing records | 7 years | Legal requirement under Swedish Bookkeeping Act (Bokföringslagen) |
| Audit logs | Duration of tenant subscription + 30 days | Security and compliance |
| Website measurement data | 25 months | Year-over-year comparison of how the website and signup flow are used |
After the retention period expires, data is securely deleted or anonymised.
9. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Article 15): Request a copy of the personal data we hold about you.
- Right to rectification (Article 16): Request correction of inaccurate personal data.
- Right to erasure (Article 17): Request deletion of your personal data, subject to legal retention requirements.
- Right to data portability (Article 20): Receive your data in a structured, machine-readable format. Dependra provides an in-app landscape export feature for your architecture data.
- Right to restriction (Article 18): Request that we limit how we process your data.
- Right to object (Article 21): Object to processing based on legitimate interest.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at privacy@dependra.com. We will respond within 30 days as required by GDPR.
10. Data Portability
Dependra includes a built-in data export feature that allows you to export your entire landscape model (applications, components, dependencies, capabilities, and audiences) in a structured format. This feature is available from within the application.
11. Cookies and Website Measurement
Dependra uses session cookies only for authentication and maintaining your login state. We do not use:
- Third-party tracking cookies
- Analytics cookies
- Advertising cookies
- Social media tracking pixels
The session cookie is strictly necessary for the operation of the service and does not require consent under the ePrivacy Directive.
Website measurement
We measure how our website (dependra.com) and our signup flow are used, so that we can see which pages are read and where people give up on signing up.
This measurement is cookieless. It stores nothing on your device and sets no identifier that you carry between visits, so it does not require consent under the ePrivacy Directive either. It runs on software we host ourselves, on our own infrastructure: the data is not shared with, sold to, or processed by any third party, is never used for advertising, and is never combined with data about you from other websites.
What is recorded: the page address, the referring page, the type of browser, operating system and device, the approximate country, the screen size, and named events for links you click (for example, starting a trial). Your IP address and browser identification are used to derive an irreversible identifier that groups requests into a single visit; that identifier is rotated regularly so it cannot follow you between visits, and your IP address itself is not stored.
This covers our website and the signup flow only — including the step you return to after verifying a card. It is not used anywhere else inside the Dependra application.
12. Security Measures
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit: All data transmitted between your browser and our servers uses TLS (HTTPS).
- Tenant isolation: Each organisation's data is logically isolated through our multi-tenant architecture. Data access is strictly scoped to the tenant to which it belongs.
- Role-based access control (RBAC): Access to data within each tenant is controlled by roles (owner, admin, editor, viewer).
- Secure credential storage: Passwords are hashed and salted using bcrypt and never stored in plain text.
- Audit logging: Administrative actions are recorded for security and compliance purposes.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via email using the address associated with your account.
We encourage you to review this page periodically for the latest information on our privacy practices.
14. Supervisory Authority
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):
- Website: https://www.imy.se
- Address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden
You also have the right to lodge a complaint with the supervisory authority in your own EU/EEA member state.
15. Contact Us
For any questions or concerns about this privacy policy or our data processing practices, please contact:
- Email: privacy@dependra.com
- Company: Wadman Information Technologies AB (Dependra), Sweden