Exposure Check for Jira: privacy policy

Who we are

Exposure Check is a free app for Jira (cloud). It is made by SYNDEO s.r.o. ("Syndeo").

• Company ID (IČO): 05617596; VAT ID (DIČ): CZ05617596
• Registered in the Commercial Register kept by the Municipal Court in Prague, file C 267152
• Registered address: Jaurisova 515/4, Michle, 140 00 Praha 4, Czech Republic
• Contact: info@syndeo.cz

Our role under the GDPR (EU data protection law): for the data the app reads and stores, Syndeo is neither controller nor processor. The app runs and stores its report only inside your Atlassian site, and none of it reaches Syndeo, so no data processing agreement (DPA) with Syndeo is needed for the app. Syndeo is the controller only for the messages you send us yourself, such as a booking or a support email, and for the details you give us when you register for a customer code.

What the app reads

The app only reads. It cannot create, change or delete anything in Jira. It asks Atlassian for these permissions (scopes), all read-only, plus app storage:

• read:jira-work: issue text (summaries, descriptions and comments)
• read:jira-user, read:user:jira, read:group:jira: people and groups behind access
• read:permission-scheme:jira, read:permission:jira, read:project-role:jira, read:application-role:jira: who can open each project
• read:issue-security-scheme:jira, read:issue-security-level:jira: issue security in use
• read:project:jira: project list
• read:filter:jira, read:dashboard:jira: shared filters and dashboards
• read:workflow:jira, read:issue.changelog:jira: how work flows and handovers
• read:project-version:jira: releases
• read:audit-log:jira: the audit log control check
• read:avatar:jira: Jira requires it to list the members of a group, which the app needs to count Jira admins.
• storage:app: the report

What it stores and where

The app stores its report in Forge app storage. Forge is Atlassian's hosting for apps, so the report stays inside Atlassian.

The report holds issue keys, field names, finding types, counts and project access results. This is the data "in scope" for data residency (where Atlassian keeps data).

Found values are never stored; only where they sit (issue, field, type) is kept, and a value is shown masked, read live from the issue when a viewer who can open it asks.

The app also keeps the settings an admin chooses (for example, which frameworks apply).

What never leaves Atlassian

Nothing leaves Atlassian. The app has no external fetch, no remotes, no web triggers and only storage:app for storage.

• No third parties receive data from the app.
• The app does not expose any web address of its own. The app has no web triggers or remote endpoints.
• Transfers outside the EEA by the app: none, as no data leaves Atlassian.
• The app calls Jira only through Forge as the app. It uses no personal access tokens or shared secrets.

The app meets the requirements of Atlassian's "Runs on Atlassian" program (compute and storage hosted by Atlassian only), checked with Atlassian's own eligibility tool.

How long we keep data and how to delete it

The app keeps one report: the latest check.

• Running a new check replaces the old report when the new one finishes.
• Any admin can delete the whole report at any time with "Delete report". The admin settings stay.
• If you uninstall the app, Atlassian keeps its storage (the report and the settings) for 28 days, so it can be recovered on request, and does not restore it if you install the app again. To remove the report straight away, use "Delete report" before uninstalling.

Syndeo cannot see, copy or delete the report. It lives in your Jira site.

What Syndeo receives

From the app itself: no issue content, no findings and no report. Two things reach Syndeo through Atlassian, as for any Marketplace app:

• the address of each Jira site where the app is installed (shown to app makers in Atlassian's developer console), and
• the app's error logs, which hold Jira error codes only, never issue text or found values. Atlassian keeps these logs for a limited time.

We use the site addresses to count installs and to answer support requests. Beyond that, Syndeo only receives what you choose to send us:

• when you register for a free customer code, through www.syndeo.cz,
• when you book a free walk-through of your report, through www.syndeo.cz, and
• when you write to support.

We use that to answer you and to hold the walk-through. Our legal basis is our legitimate interest in answering you and running the app (GDPR Art. 6(1)(f)), or taking steps toward a contract you ask for (Art. 6(1)(b)). We keep these messages in our email system for as long as we work with you, and delete them at the latest two years after our last contact, unless the law requires us to keep them longer (for example invoices).

When you register

To use the free Do it yourself path in the app, you register on www.syndeo.cz. Syndeo is the controller for these details.

• What we collect: your name, work e-mail, company, your Jira site address if you give it, the time you agreed, and the customer code we give you.
• Why: to give you your customer code, to answer you, and to tell you about Exposure Check and our services for it.
• Legal basis: the contract you enter by registering (GDPR Art. 6(1)(b)), for giving you the code; our legitimate interest in telling you about Exposure Check (Art. 6(1)(f)). You can object to that at any time, and we stop.
• Where: in Syndeo's customer database, hosted for us by Railway in the United States. The transfer is covered by the EU standard contractual clauses in our data processing agreement with Railway.
• How long: two years after our last contact, then we delete them, unless the law requires us to keep them longer (for example invoices).

Your rights under the GDPR

For the personal data Syndeo holds about you (registration, booking and support messages), you can ask us to:

• show you what we hold,
• correct it,
• delete it,
• limit how we use it, or stop using it,
• give it to you in a format you can move elsewhere,
• or you can object to how we use it.

Write to info@syndeo.cz. We answer within one month, as the GDPR requires (Art. 12(3)).

You can also complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů.

The report inside your Jira is held in your Jira site, not by Syndeo. Requests about it go to your own Jira admins, who can delete it with "Delete report".

Changes to this policy

If we change this policy, we put the new version on this page with a new date. If a change affects what the app reads or stores, we also say so in the app's release notes on the Atlassian Marketplace.