Legal
Charter privacy policy
What data Charter handles, and how it is protected.
This policy describes what data the Charter extension for Azure DevOps handles.
What Charter does with your data
Charter runs entirely inside your Azure DevOps organization, in the browser, as a collection administration hub. It calls the Azure DevOps REST APIs on behalf of the signed-in administrator to read and write:
- projects and project metadata
- processes, work item types, layouts, states, and rules
- environments and environment checks (including Azure Function check configuration)
- service hook subscriptions and their consumer inputs
- pipeline resources and service connections
This data stays within your Azure DevOps organization. Charter does not copy your Azure DevOps content to servers operated by Meridian Software.
Data stored by the extension
Extension settings are stored using the Azure DevOps extension data service, which keeps them inside your Azure DevOps organization under Meridian Software's extension namespace. You can export the full settings model to JSON, and delete it by uninstalling the extension.
Configuration you enter — such as Azure Function URLs, function keys, webhook delivery URLs, and request headers — is stored the same way. Treat these as secrets and use Azure DevOps permissions to restrict who can reach the Charter hub.
Licensing data
Charter is licensed per Azure DevOps organization, and how a license is checked depends on how it was bought.
Licenses issued by Meridian Software (invoiced and enterprise customers). These are verified entirely inside your browser against a cryptographic signature built into the extension. No network request is made, and no data about your organization leaves it. Your license key and the trial start date are stored using the Azure DevOps extension data service, inside your own organization.
Subscriptions bought online. Payment and license issuing are handled by Polar (see Third parties below). When you activate a subscription key, Charter sends that key to Polar to confirm it is valid and which plan it covers. No work item content, source code, pipeline data, or personal profile information is sent. Your payment details are handled by Polar and are never seen by Charter or stored by Meridian Software.
What Meridian Software retains. For invoiced customers, Meridian Software holds the organization name and ID a license was issued to, together with the invoice reference, for the duration of the subscription plus the period required by accounting and tax law. For online subscriptions, the customer record is held by Polar as merchant of record.
Charter counts the number of projects in your organization to apply the plan limits described on the pricing page. That count is evaluated in the browser and is not transmitted anywhere.
Telemetry
Charter does not collect usage analytics or behavioural telemetry.
Third parties
Meridian Software does not sell or share your data.
Polar (Polar Software Inc.) acts as merchant of record for online subscriptions. Polar processes the purchase, handles VAT and sales tax, issues the license key, and appears as the seller on your invoice and card statement. Polar therefore holds the billing details and contact address you enter at checkout, under its own privacy policy. Meridian Software does not receive or store your card details.
No other subprocessor receives data from the Charter extension.
Legal basis and retention
Meridian Software is established in the Netherlands, so the EU General Data Protection Regulation (GDPR) applies to the personal data it holds.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Organization name and ID, invoice reference, contact address (invoiced customers) | Issuing and supporting a license | Performance of a contract, Art. 6(1)(b) | Duration of the subscription, then as required by Dutch tax law |
| Support correspondence | Answering your request | Performance of a contract, Art. 6(1)(b) | 24 months from the last message |
| Billing records for online subscriptions | Payment, invoicing, tax | Held by Polar as merchant of record under its own policy | Per Polar's policy |
Data Charter stores inside your Azure DevOps organization — settings, license key, trial start date — is held by Microsoft under your own agreement with them, not by Meridian Software.
Your rights
Under the GDPR you have the right to access the personal data Meridian Software holds about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. To exercise any of these, contact [email protected]. Meridian Software responds within one month.
Data held inside your own Azure DevOps organization is under your control and can be removed by uninstalling the extension.
If you believe your data has been handled improperly, you may lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own country.
International transfers
Meridian Software processes personal data within the European Economic Area. Polar, as merchant of record, may process billing data outside the EEA under its own safeguards; see Polar's privacy policy for details.
Changes
Material changes to this policy are announced on the extension's Marketplace page and at https://meridian-software.net/privacy/charter.