Privacy notice
Provided by Sepenta Eğitim Danışmanlık Yazılım Turizm Ticaret Limited Şirketi. Last updated: 26 October 2026.
Draft. Highlighted items still need a value or a check before this page is published.
1. Who we are, and which hat we wear
Sepenta Eğitim Danışmanlık Yazılım Turizm Ticaret Limited Şirketi ("Sepenta", "we", "us"), Kuşadası, Aydın, Türkiye, tax ID 7611208267, provides Penta (turns business discovery into reviewed Jira epics and stories) and Magnesia (a delivery console that reads a customer's Jira and GitHub and analyses daily standups).
| What | Our role | Who decides why it is used |
|---|---|---|
| Customer content: what a customer's people add or connect (notes, documents, recordings, transcripts, Jira and GitHub data, results) | Processor | The customer (your organisation). The data processing agreement applies. |
| Account and security data: sign-in identity, roles, invitations, audit logs, technical logs | Controller for running, securing and supporting the service; processor where it is part of a customer's workspace | Us, and the customer for who has access |
| Contact and support data: messages you send us, business contact details, website visitors | Controller | Us |
If you use Penta or Magnesia through your employer or client, your organisation is the controller of the content, and you should ask them first about how your information is used. Contact: info@sepenta.io. [DPO OR PRIVACY CONTACT NAME, if you appoint one]
2. What we process
Both products
- Sign-in. Your email address and, from Google or Microsoft, your name. We never see or store a password. If you sign in with a one-time code, we store a keyed hash of the code (never the code itself) for up to ten minutes, and a record of recent requests for a day.
- Workspace data. Which workspace you belong to, your role or access level, who invited you, when you last signed in.
- Audit log. A record of sign-ins, invitations, role changes, connections and similar actions: who, what and when. In Penta it also records the IP address and a request id; Magnesia records a request id for sign-in events. It never holds secrets, codes, or the content of notes, files or transcripts.
- Email. Invitations and sign-in codes are sent through our email provider. They contain your address, who invited you and the workspace name, and a link to sign in; nothing from your content.
- Cookies. Only the ones needed to keep you signed in. See the cookie notice.
Penta
- Assessment content: notes, uploaded documents and images, audio recordings, transcripts, the analysis Penta produces, the epics and stories drafted, and your edits and approval decisions. This may include personal data about people mentioned in it.
- Your Atlassian connection: your Atlassian account id and display name, the Jira sites you can reach, and OAuth tokens that let Penta act as you in Jira. The tokens are encrypted (AES-256-GCM). You can disconnect at any time.
- What Penta creates in Jira: the epics and stories a person approved and sent, under that person's own Jira account.
Magnesia
- Jira and GitHub data the customer connects: issue keys, summaries, statuses, assignees' display names, links and history; pull requests, commits and workflow results (read-only). Magnesia does not change anything in Jira or GitHub.
- Standup recordings and transcripts: audio of people speaking, recorded in the browser or uploaded, the transcript with speaker labels, corrections, and the analysis (alerts and notes). A recording starts only after the person recording has confirmed that the customer's consent notice was shown.
- Reports built from the above and who they were shared with.
3. Why we use it, and our legal bases
| Purpose | Legal basis (UK and EU GDPR) |
|---|---|
| Provide the service the customer asked for, including analysing content with AI and transcribing recordings | As processor: the customer's instructions. For account data: performance of our contract with the customer, Art. 6(1)(b). |
| Keep the service secure: authentication, audit logs, abuse limits, fixing faults | Our legitimate interests in running a secure service, Art. 6(1)(f) |
| Support, invoicing, legal claims, meeting legal duties | Contract, legal obligation, and legitimate interests |
| Recording standups: the customer chooses the basis (often legitimate interests, or consent where appropriate) and tells its people | Decided by the customer as controller; see section 5 of our terms |
We do not use personal data for advertising, sell it, or use customer content to train our own models. We do not make decisions about people that have legal or similarly significant effects. AI output is a suggestion: in Penta a person reviews and approves every epic and story before anything is sent to Jira, and in Magnesia alerts are prompts for the team to discuss.
4. How AI is used
The full detail is on the page AI and your data. In short:
- Penta sends the content of an assessment (notes, extracted document text, images, audio) to OpenAI through its API to transcribe audio, describe images, analyse the context and draft epics and stories. It happens when someone runs an assessment.
- Magnesia transcribes recordings with Google Cloud Speech-to-Text (EU region). It sends a transcript to Anthropic only when an Admin or Delivery Manager asks for the analysis, together with the Jira work in flight (key, title, status, priority and assignee name), open actions and decisions. The optional report narrative is drafted from program numbers, objectives, risks and decisions, with no names or email addresses.
Customer content is never used to train models, by us or, under their API terms, by our AI providers. Providers keep API requests for a short time only (up to 30 days) as set out in AI and your data. AI output can be wrong or incomplete; treat it as a draft. [CONFIRM: signed OpenAI and Anthropic data processing terms are in place].
5. Who receives your data
Only the providers on the sub-processors page, and, inside a workspace, the people the customer has invited. Workspaces are kept apart: a person in one cannot see another's data, and our platform administrators can create a workspace and see how many people it has but cannot open it or read its content. Our staff do not look at customer content except to give support you ask for or to investigate a security problem, and any such access is recorded.
6. Transfers outside the UK and EEA
Customer content is stored in Google Cloud in the EU ([CONFIRM: Penta database and bucket europe-west1 (Belgium); Magnesia Firestore and bucket location]). Some providers may process data outside the UK and EEA, including OpenAI and Anthropic in the United States. Where that happens we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or the standard contractual clauses with the UK addendum, plus supplementary measures described in our security overview.
7. How long we keep it
| Data | How long |
|---|---|
| Customer content (notes, documents, recordings, transcripts, results, synced Jira and GitHub data) | Until the customer deletes it in the product or asks us to, and in any case deleted within [DELETION PERIOD, for example 30 days] of the end of the agreement. [CONFIRM: the retention setting in Penta records the intended period; automatic deletion is not switched on yet, so deletion today is on request] |
| Temporary audio copy made for transcription (Magnesia) | Deleted when the transcript is ready; a storage rule removes any leftover within a day |
| Sign-in codes and request records | Code: ten minutes or until used. Request records: one day |
| Sessions | 12 hours |
| Audit log | [AUDIT RETENTION, proposed 24 months]. It cannot be edited. [CONFIRM: pruning after the period is manual today] |
| Backups | [CONFIRM: backup schedule and retention for Cloud SQL and Firestore] |
| Contact and support messages | [SUPPORT RETENTION, for example 24 months] |
8. Your rights
You can ask for access to your personal data, correction, deletion, restriction, a portable copy, or object to processing based on our legitimate interests. If your data is in a customer's workspace, we will pass your request to the customer and help them answer it. Write to info@sepenta.io. We answer within one month. You can also complain to your data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or the authority in the EU country where you live or work.
9. Security
See our security overview. No service is perfectly secure. If we become aware of a breach affecting your information we will tell the customer without undue delay and the authorities as the law requires.
10. Children
The products are for working adults and are not intended for children.
11. Changes
We will post changes here and, for material changes, tell customer administrators by email before they take effect.
Questions: info@sepenta.io. Sepenta Eğitim Danışmanlık Yazılım Turizm Ticaret Limited Şirketi, tax ID 7611208267, Kuşadası, Aydın, Türkiye.