Since 2009
TELCOMA Global / Customers & Organizations Export / Privacy policy
What the app reads, what it keeps, and what it never changes.
This policy describes what Customers & Organizations Export for Jira Service Management does with your data.
1
What the app is
Customers & Organizations Export for Jira Service Management ("the app") is a free Atlassian Marketplace app that lists the customers and organizations of each service project on a Jira Service Management Cloud site, with their open and resolved request counts, and exports the lists to Excel or CSV. It runs entirely on Atlassian's Forge platform and is read-only.
2
What data the app processes
The app reads the following from your Jira site, using the permissions granted at installation:
- Service projects: the list of service projects on the site, with each project's ID, key and name.
- Customers and organizations: the customers of each service project, the organizations added to it, each organization's ID, name and members.
- User directory data: account IDs of customers and organization members while a scan runs; display name, email address (where the person's profile makes it visible to apps) and account type when a page is displayed and in the export an administrator downloads. None of these except the account ID are written to storage.
- Requests: for each request in a service project, six fields only: reporter, Organizations, resolution, resolution date, status category and created date. The app also reads the site's field list once for each project it scans, to find the Organizations field.
- Your permissions: whether the person using the app is a Jira administrator, or administers the project whose page they are on.
The app does not read request summaries, descriptions, comments, attachments or any text your customers or agents write in requests.
3
What the app changes
Nothing. The app has no write permission. It cannot change customers, organizations, requests, projects or any setting.
4
What data the app stores
The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:
- Scan progress (the projects in the scan, where it is, counters, timestamps and up to 20 error messages) and the account ID of the person who started each scan.
- For each project's scan: the project's ID, key and name; the account IDs of its customers and organization members; organization IDs and names; and, per account ID and per organization, the number of open and resolved requests and the dates of the last request and the last resolved request.
- Short-lived keys that stop two copies of a scan from running at once. They expire after 60 or 180 seconds.
- When the first result was shown, and when the review note on the page was closed.
Display names and email addresses are not stored; they are read from Jira each time a page is shown or an export is built.
5
Where data goes
Nowhere. The app makes no network requests outside Atlassian and has no servers of its own. Data does not leave your Atlassian site's hosting region. Exports are generated in the administrator's browser and saved to their device; what happens to them after that is under your control.
6
Legal basis and roles
You (the customer) are the data controller for the personal data on your site. TELCOMA Global is a data processor acting on your instructions, which consist of installing the app, running scans and exporting. Where the GDPR applies, the app's processing is performed under your instructions and on Atlassian's infrastructure.
7
Retention and deletion
The app keeps the 3 most recent finished scans of each service project. When a newer scan finishes, older scans of that project are deleted automatically, and so are scans that failed or were stopped. The progress record of a scan, with who started it, stays until the next scan of the same projects replaces it. When the app is uninstalled, Forge deletes all app storage for your site. We cannot reach this data from outside the app, so we cannot delete it for you on request.
8
Security
The app runs on Atlassian Forge, which enforces the app's permissions at the platform level, hosts its storage, and isolates it from other apps. Every permission it holds is read-only. Only Jira administrators, and people who administer a project (for that project only), can use the app, and this is checked with Jira on every request. Security issues may be reported to [email protected]; please do not post them publicly. See also our security policy for Atlassian apps.
10
Changes to this policy
We will update this policy when the app's data handling changes and note the effective date above.