Since 2009
TELCOMA Global / Group & Permission Usage for Jira / Privacy policy
What the app reads, what it keeps, and what it never changes.
This policy describes what Group & Permission Usage for Jira does with your data.
1
What the app is
Group & Permission Usage for Jira ("the app") is a free Atlassian Marketplace app that shows a Jira Cloud administrator where each group is used, who can browse each project and why, and what one person can reach. It runs entirely on Atlassian's Forge platform and is read-only.
2
What data the app processes
The app reads the following from your Jira Cloud site, using the permissions granted at installation:
- User directory data: account ID, active status and account type while a report is built; display name and email address (where the user's Atlassian profile makes it visible to apps) when a page is displayed and in the export an administrator downloads. None of these except the account ID are written to storage.
- Groups and product access: every group on the site, its members, and which groups give access to each Jira product.
- Projects and permissions: every live project with its key, name, type, lead, permission scheme and project role members; every permission scheme with its grants.
- Sharing settings: for shared filters and dashboards, their names, owners and who they are shared with. The app does not read what a filter or dashboard shows.
- Issue security and notification schemes: their names, levels, and the groups, roles and people in them.
The app does not read issues, comments, attachments or any text your users write in issues.
3
What the app changes
Nothing. The app has no write permission. It cannot change groups, permissions, schemes, projects, filters, dashboards or any setting.
4
What data the app stores
The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:
- Report progress (cursors, counters, timestamps) and who started each report and when.
- For each report: group IDs and names, member counts, product names, project IDs, keys and names, project leads and role members as account IDs, permission scheme grants, which groups, roles and projects filters and dashboards are shared with, issue security and notification scheme members, and each person's group IDs as account IDs.
Display names and email addresses are not stored; they are read from Jira each time they are shown.
5
Where data goes
Nowhere. The app makes no network requests outside Atlassian and has no servers of its own. Data does not leave your Atlassian site's hosting region. Exports are generated in the administrator's browser and saved to their device; what happens to them after that is under your control.
6
Legal basis and roles
You (the customer) are the data controller for the personal data on your site. TELCOMA Global is a data processor acting on your instructions, which consist of installing the app and building reports. Where the GDPR applies, the app's processing is performed under your instructions and on Atlassian's infrastructure.
7
Retention and deletion
The app keeps the 6 most recent reports; older reports are deleted automatically. An administrator can delete any report from the Past reports tab. When the app is uninstalled, Forge deletes all app storage for your site. You may also request deletion by contacting us.
8
Security
The app runs on Atlassian Forge, which enforces the app's permissions at the platform level, hosts its storage, and isolates it from other apps. Every permission it holds is read-only. Only Jira administrators can open the app, and this is checked on every request. Security issues may be reported to [email protected]; please do not post them publicly. See also our security policy for Atlassian apps.
10
Changes to this policy
We will update this policy when the app's data handling changes and note the effective date above.