Agile Analytics for Azure DevOps — Privacy Policy

Last updated: October 27, 2026

Overview

Agile Analytics (“the Extension”) is an Azure DevOps extension published by Baytek Software (“Baytek”, “we”, “us”). It processes Azure DevOps data inside the customer's browser to render dashboards and reports. This policy explains what data the Extension touches, where it goes, and what Baytek stores on its own systems.

1. Data the Extension reads from Azure DevOps

The Extension uses read-only Azure DevOps scopes (vso.project, vso.work, vso.graph, vso.build). With those scopes, the Extension reads, on demand:

• project, team, sprint, and iteration metadata
• work item fields and revision history needed for analytics
• build and pipeline metadata (runs, results, timings) whenever a DORA view, widget, or Configuration → DORA is opened; the opt-in deploy-linked measurement additionally reads the work items linked to each pipeline run
• group and membership info needed for Access Control

This data stays in the customer's browser. It is not sent to Baytek. If a user asks AGAN AI, the assistant inside the Extension, a question, only that question, a fixed set of counts and codes worked out in the browser and, on the views that show them, the numbers on that view are sent, never the data itself (section 13).

2. Data persisted in the customer's Azure DevOps tenant

Configuration and per-user preferences are persisted via Microsoft's Azure DevOps Extension Data Service. This storage is hosted by Microsoft and scoped to the customer's organization. Baytek does not host or have access to it.

This includes:

• extension configuration (workflow mappings, WIP limits, sprint alerts, notifications, ACL)
• per-user UI preferences
• GitHub organization name and Personal Access Token for the GitHub Copilot Metrics integration (org admins only — see “AI integrations” below)
• License activation token and license summary (cached locally so the Extension can revalidate)

3. Data Baytek stores on its own systems

Baytek operates a backend at https://ado-analytics.baytekdev.com that handles licensing and a small set of contact-form / telemetry events. The following data is stored on Baytek-controlled systems:

• License records: Azure DevOps organization name, ADO organization ID, plan, expiry, status, activation tokens issued by Baytek
• Organization verification: the dates your organization first and most recently confirmed its identity to our backend. No Azure DevOps token is kept
• Seat roster (organizations using assigned-seat access control only): opaque Azure DevOps identity descriptors of the users assigned a seat. No names or email addresses — the descriptor format we accept cannot decode to one. Used only to enforce seat assignments
• Org install / heartbeat events: organization name, ADO organization ID, extension version, event type (INSTALLED / HEARTBEAT / UNINSTALLED), and timestamps. Used to count active installs and identify orgs whose extension stops loading
• Licence server request data: our licence server records the IP address and browser user agent of licence and installation requests, for licence security and rate limiting, kept up to 13 months
• Usage and error telemetry (opt-out available): ten event types — view_opened (which view was opened), feature_used (which feature was used; when a team has sub-teams, we record that it has them and roughly how many: 1, 2-3, 4-7 or 8+, and no team names; for an AGAN AI Setup advisor change, only the settings area and whether a fixed rule or AGAN AI prepared it; for AGAN AI, which of its parts were used (its first-time note, how the panel was opened, which quick question, the feature finder) and why an AI answer was refused, as codes from our own list; on the screen shown after a trial ends, which link was pressed, and a press of “I want Agile Analytics back”, whose count of distinct people over the last 30 days is shown on that screen to everyone in the organisation from 3 people up, never who pressed it; for a few internal checks, a short reason or the kind of settings document involved, from our own list), error_observed (a graded error category, with a short code from our own list and which of our views or stored settings it concerns, never the error text itself), session_started (a session-start marker), config_event (a configuration change), license_activated, purchase_flow_opened, team_count_reported, trial_day_milestone, and workflow_mapping_completed (how many item types were mapped, whether the mapping was set up automatically, and how many workflow states it could not place, never the state names) — plus extension version, your Azure DevOps organization ID, and a pseudonymous user identifier — your Azure DevOps user GUID, never your name or email — used to count distinct active users per organization and, on seat-limited plans, to enforce seat limits. An extension admin can turn this off for the whole organisation (Configuration → Privacy); doing so does not affect the org-installation heartbeat above, which is required for licensing to keep working. Never work item content
• Administrator contact (captured automatically): the organisation administrator's Azure DevOps sign-in name, which is an email address, recorded once per organisation the first time they open the hub, plus the org name and ADO organization ID. The hub shows this in a banner with a short window to undo it before it is sent, and you can ask us to delete it at any time. Kept while the extension is installed and deleted 90 days after we learn it was uninstalled. Used for trial reminders and service notices about the extension you installed; every such email carries a one-click opt-out link
• Ask Henry contact-form submissions: if you use the Ask Henry form on this website, we store your message, your email address, your answers to the form's questions, and — when you arrive from a link that carries them — your Azure DevOps organization name and extension version. Used only to reply to you; never for marketing. Screenshots you attach are delivered to us by email and are not stored on our systems
• Quote and invoice requests: if you use the Request a quote form on our pricing page, we store what you enter: your name and work email, your company's legal name and billing address, and, if you give them, a VAT or tax ID, your Azure DevOps organization name, purchase-order details, a preferred start date and notes. Used only to prepare your quote, invoice and license; never for marketing. When we create the quote, the same billing details go to Stripe (sub-processor)
• AGAN AI monthly usage (Extension): if users in your organization ask AGAN AI questions inside the Extension, a total per ADO organization ID and calendar month of the number of answers, token counts, an estimated cost and the plan used to size the monthly AI allowance. No question, answer or user. Deleted 400 days after the month ends (section 13)
• Payment metadata via Stripe (sub-processor): Stripe holds payment instrument data; Baytek never receives raw card numbers
• Anonymous website metrics (this website only): six counters — a pricing-page view, a view of any other marketing page on this site, a checkout start (with the plan chosen), a click on a link to our Agile Analytics listing on the Azure DevOps Marketplace, opening the AI assistant, and clicking Ask Henry inside it. Each stores at most the referring site's hostname and a timestamp (the two assistant counters store only the timestamp). When a link arrives with no referrer but carries a utm_source value that is itself a hostname (how links shared by AI assistants usually arrive), that hostname is stored instead. We record where a visit came from, never which page was viewed, and never the rest of the address: no paths, no query strings. No cookies, no IP address, no user or organization identifier, and no third-party analytics service is involved
• Workflow auto-discovery diagnostics (added v6.14.0, opt-out at Configuration → Privacy): four new event types help us measure how well auto-discovery classifies the Azure DevOps workflow state names a customer's organization uses. All payloads are PII-free counts, enum-valued bucket labels (one of seven workflow buckets: new, queued, in_progress, test, review, done, waiting), and the detected locale code (en, es, pt, it, de, fr). Workflow state names themselves are never sent.
  • workflow-auto-discovery-inference-failed — fires when auto-discovery ran against the org's real Azure DevOps state names but couldn't classify one or more of them. Payload: { unmatchedStateCount, totalStateCount, extensionVersion, possibleLanguage }.
  • workflow-keyword-auto-learned — fires when an admin drags a previously unrecognised state into a workflow bucket on the Workflow Mapping tab, so future auto-discovery on this org respects that choice. Payload: { bucket } only — never the state name itself.
  • workflow-mapping-rediscovery-prompted — fires once per organisation when an existing customer is shown the one-time opt-in re-discovery prompt (no mapping changes are made until the customer confirms). Payload: { unmatchedStateCount }.
  • workflow-mapping-rediscovery-confirmed — fires once per organisation if the customer accepts the re-discovery prompt. Payload: { delta } (count of states the new inference reclassified).
• Peer benchmarks (optional, opt-in, off by default): if an org admin turns on Industry Benchmarks, the Extension sends Baytek a small snapshot of aggregate delivery metrics — cycle time, throughput, and sprint-completion percentage as rounded numbers — together with a coarse team-size bucket (e.g. 6–15) and methodology (Scrum / Kanban). The snapshot is linked only to your organization ID so it can be updated or deleted; it is not anonymous. We never receive work-item titles, IDs, descriptions, names, project or team names, or your raw team head-count. Snapshots are pooled into peer groups; a group's benchmark is only ever shown once at least five organisations contribute, and only rounded percentile ranges are shared back — never another organisation's individual numbers. You can turn Benchmarks off at any time on the Benchmarks panel, which deletes your contributed snapshot.

From the Extension, Baytek does not receive Azure DevOps work item content or AI provider API keys. Sprint data stays in your tenant. If a user asks AGAN AI, the assistant inside the Extension, a question, that question, a fixed set of setup counts and codes, and the numbers shown on the view you are on (percentages, day counts, item counts), never the items behind them, pass through our server to Anthropic to write the answer; we keep no transcript, and section 13 lists exactly what is sent. The Exec Report is built in your browser and shared by you (as a PDF, or as copied text you paste into your own email or chat); it is not sent to Baytek.

Organization check. To confirm which Azure DevOps organization a request comes from, the Extension sends our backend a short-lived Azure DevOps access token for the signed-in user. This happens each time the Agile Analytics hub opens and is refreshed about every 6 hours. It continues when usage telemetry is turned off. Our backend uses the token for exactly one call to Azure DevOps, which returns the organization's ID and the user's Azure DevOps ID. Then it discards the token. Neither the token nor the user ID is kept, and the token is never logged or used for anything else. To apply seat limits to AI answers, the organization check also creates a one-way code from your Azure DevOps identity. It stays inside your browser's 8-hour session pass (our server holds it in memory for at most 5 minutes while issuing passes); we never store it or your user ID. Our backend never uses it to read work items, projects, pipelines, or any other content. Like every token issued to the Extension, it carries only the Extension's read-only permissions listed in section 8.

4. AI integrations (optional, off by default)

AGAN AI, the AI assistant inside the Extension, is not one of these integrations; section 13 covers it.

If an organization admin connects the GitHub Copilot Metrics integration (Configuration → GitHub Copilot) with a GitHub organization name and a GitHub Personal Access Token:

• The GitHub organization name and token are stored in the customer's own Azure DevOps Extension Data Service (org-scoped). Baytek does not receive them.
• Copilot usage and seat data is read from the customer's browser directly against api.github.com. Baytek's backend is not in the request path.
• Aggregate suggestion and acceptance counts, plus the connected organisation's Copilot seat list — each seat's GitHub username and last-activity timestamp — are read into the browser. Never source code, file contents, or Copilot chat or suggestion text.

Copilot AI Metrics (separate free extension)

Baytek also publishes Copilot AI Metrics, a standalone free Azure DevOps extension. It follows the same rules as the integration above: the GitHub organization name and Personal Access Token stay in the user's browser storage, Copilot usage and seat data is read directly from api.github.com, and none of it passes through or is stored by Baytek.

From version 2.9.0 the extension sends basic usage telemetry to the endpoint described in section 3: the event name (session started, view opened, feature used, configuration change, error category), the name of the tab or feature, whether the workspace is in demo or live mode, the extension version, the Azure DevOps organization ID and name, and the pseudonymous Azure DevOps user ID. It never sends the GitHub token, the GitHub organization name, seat lists, usernames, error text, or any Copilot metric value. These events are retained for 90 days like other usage telemetry. Any user can switch this off for their browser in the extension's Settings → Usage Telemetry; the extension works the same either way.

5. Webhook integrations (optional)

If notifications are enabled, the Extension posts alert payloads from the customer's browser directly to the configured Microsoft Teams or Slack webhook URL. Hostnames are restricted to approved provider domains. Baytek's backend is not in the request path.

6. Sub-processors

7. Data retention

• License records: retained for the life of the customer's account plus 7 years for tax / contract reasons
• Payment notifications: Stripe notifies us of each payment and subscription change. The full content of that notification, which includes the billing email address, is erased after 13 months. A minimal record of the notification is kept after that (its type, our processing status and the timestamps, with no personal data) so that a notification Stripe re-sends is never acted on twice
• Seat roster: retained until the seat is unassigned or a deletion request is received
• Activation tokens: rotated on each successful re-validation (every ~12 hours of active use). Revoked tokens are retained for 90 days for audit
• Org install / heartbeat events: aggregated; raw events retained 13 months
• Usage and error telemetry: raw events retained 90 days
• Administrator contact (trial-contact email): kept while the extension is installed and deleted 90 days after we learn it was uninstalled, or sooner on request. If you opt out of emails we keep only the record of that opt-out, so we do not email you again
• Trial reminder records: the email address is removed 90 days after a reminder is sent. A record that the reminder was sent is kept so it is not sent twice
• Organization verification dates: deleted 90 days after the last check
• Licence server request data (IP address and browser user agent): kept up to 13 months, then removed. The license and audit records themselves are kept as described under license records
• Scheduled report subscriptions and recipients (feature retired in 2026): any that remain are deleted when the subscription is deleted, and also 90 days after we learn the extension was uninstalled, but only when the organization has no active paid subscription
• Scheduled job history (our own operational records, no customer content): deleted after 90 days
• Ask Henry form submissions: retained so we can reply and keep context for follow-up questions; deleted after 24 months, or sooner on request (email support)
• Quote and invoice requests: deleted after 24 months, or sooner on request (email support)
• AI assistant on this website and inside the Extension (section 13): no conversation is stored. Usage counters (per conversation, per IP address and, in the Extension, per organization per day) expire within 24 hours and are deleted nightly; the website's daily usage and cost totals, and thumbs up/down feedback (a random answer ID and the choice only), are deleted after 90 days; the Extension's monthly usage total per organization is deleted 400 days after the month it covers ends
• Benchmark snapshots: one current snapshot per opted-in org, linked only to its organization ID; deleted immediately on opt-out, and automatically within a day after we learn the extension was uninstalled

8. Security controls

• HTTPS is required for all outbound traffic
• Read-only Azure DevOps scopes (vso.project, vso.work, vso.graph, vso.build) — the Extension cannot modify work items, pipelines, or repository content
• The GitHub Personal Access Token for Copilot Metrics is stored as a password-type field and never logged
• License activation tokens are bearer credentials and are not logged
• Azure DevOps access tokens used for the organization check are held in memory for a single HTTPS call to dev.azure.com and are never logged or stored
• Content-Security-Policy on the Extension's iframe restricts outbound connections to known endpoints

9. Your rights and choices

You can:

• disable optional AI integrations and notifications
• switch off usage telemetry in Copilot AI Metrics (Settings → Usage Telemetry)
• request deletion of any trial-contact email, Ask Henry form submission, or license-related contact data by emailing support. We can also export or delete your organization's data on request
• uninstall the Extension; this removes it from the ADO tenant. License records are retained per the retention policy above

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the “Last updated” date above. Continued use of the Extension after changes constitutes acceptance.

11. Contact

For privacy-related questions, deletion requests, or data-protection rights:

• Support: https://ado-analytics.baytekdev.com/support/
• Email: support@baytekdev.com
• Company: Baytek Software

12. Data protection rights (GDPR / CCPA)

If you are in the EU / EEA, UK, or California, you have rights under GDPR, UK GDPR, and CCPA, including access, rectification, erasure, restriction, portability, and objection. Most of these rights can be exercised by:

• uninstalling the Extension (clears the customer-tenant data); or
• emailing support@baytekdev.com for deletion of any Baytek-held license or trial-contact records

Baytek responds to verified requests within 30 days as required by applicable law.

13. AI assistant on this website and inside the Extension (AGAN AI)

AGAN AI is an AI assistant, not a person. It answers questions about Agile Analytics on this website and inside the Extension. Our server passes each question to Anthropic, PBC, our AI provider, which writes the answer. Anthropic deletes these inputs and outputs within 30 days; content its safety systems flag for abuse may be kept for up to 2 years. Anthropic processes this data under its Data Processing Addendum, which includes the EU Standard Contractual Clauses (and the UK addendum) for transfers to the United States. We do not store conversations, and our logs hold numbers, outcome codes and a random answer ID, never the text of a question or an answer.

On this website

• What is sent: the text you type into the assistant, the earlier messages of the same conversation (so it can follow up), the language and address of the page you are on, and a random conversation ID created in your browser. No account, licence, Azure DevOps or payment data, and no cookies. It never sees your Azure DevOps organization or its data
• No transcripts: the conversation is kept only in your browser tab (session storage) and is cleared when you close the tab
• Usage counters: to prevent abuse we count messages per conversation (using a hashed conversation ID) and per IP address. These counters expire after at most 24 hours, and our nightly clean-up then deletes them. We also keep daily totals of usage and cost, with no content, for 90 days

Inside the Extension

No question or setup data is sent until a user types a question to AGAN AI. Opening the panel only asks our server whether AI answers are available for your organization, using the organization check in section 3. On plans with seat limits, our server can compare the one-way code in that check's session pass with the organization's seat roster (section 3) before it answers; the code is one-way, is never stored, and cannot be turned back into your identity. The panel's setup checks, quick questions and feature finder work in the browser and send no setup data. Like the rest of the Extension, the panel adds to the usage counts in section 3, which carry the organization ID and a pseudonymous user ID, never names, email addresses or work item content (an admin can turn these off): that the panel was opened, that a question was asked (never its text), and whether a Setup advisor change was applied, undone or hidden, with only the settings area and whether a fixed rule or AGAN AI prepared it. When a user asks a question, the Extension sends our server:

• the question and the earlier messages of the same conversation, a random conversation ID created in the browser, the hub language, the Extension version, which view is open and whether the question is about that view
• a fixed set of counts and codes about the setup: whether the user is an admin, whether they have a seat, setup flags and the number of unmatched workflow states, the Readiness check names that are not passing, the setup check codes, whether the current sprint has ended and how many days ago, counts of unreadable item histories and unavailable items, and the quick-question counts the browser has already worked out with the number of days they used
• on views that show them, the numbers shown on the view you are on (percentages, day counts, item counts), never the items behind them
• when the Setup advisor is used with AGAN AI, also the settings it looks at as numbers and codes: the WIP limit and the usual number of items in progress, whether weekends are excluded, SLE targets and cycle-time figures per work item type, the Epic forecast window and basis, whether deploy-linked lead time is on, the alert channel type and triggers, and for each workflow state its bucket, its Azure DevOps category, its board column type and item counts. Work item types and states are referred to by their position in a list, never by name

Never sent: work item titles, descriptions, comments, tags or ID numbers, people's names or email addresses, workflow state or work item type names, team, project or organization names, and area or iteration paths. To check where the request comes from, the Extension also sends its Marketplace app token and the organization check described in section 3, which tell our server the Azure DevOps organization ID. The organization ID is not sent to Anthropic.

• Who processes it: our server passes the question, the earlier messages, the hub language and view, the counts and codes and the numbers on the view to Anthropic to write the answer, on the terms above
• Monthly usage per organization: to apply each organization's monthly AI allowance we keep, per Azure DevOps organization ID and calendar month, a usage total: the number of answers, token counts, an estimated cost and the plan used to size the allowance. No question, answer or user. Our nightly clean-up deletes each month's total 400 days after that month ends
• Usage counters: per IP address, per hashed conversation ID and per organization per day. They expire after at most 24 hours and our nightly clean-up then deletes them
• Turning it off: an Extension admin can turn AI answers off for the whole organization in Configuration → Access Control (“AGAN AI answers for this organisation”). Each user can turn AGAN AI off for themselves with “AGAN AI: On / Off” in the account menu (their initials, top right). With AI answers off, the panel sends no question or setup data at all, not even the availability check; only the usage counts above, unless an admin has turned those off too

On both

• Feedback: if you click thumbs up or down on an answer, we store only a random answer ID, your choice and whether the answer came from this website or the Extension, for 90 days. Not your question and not the answer

Please don't type passwords, card numbers, work item text or other sensitive information into the assistant. If you would rather not use it, you can always reach a person through Ask Henry. Because we keep no transcript, there is no conversation for us to export or delete; the counters and totals above are deleted on the schedule stated.