Easy UML Editor Privacy

Privacy Policy — Easy UML Editor for Confluence

Last updated: June 2026

1. Controller and scope

The party responsible for data processing in connection with the app “Easy UML Editor for Confluence” (the “App”) is:

SynthScript
Owner: Christoph Kretschmer
Hornisgrindestraße 9
77855 Achern
Germany
Phone: +49 (7841) 627 44 00
Email: info@synthscript.de
VAT identification number pursuant to § 27a UStG: DE368676745

This privacy policy applies to the app “Easy UML Editor for Confluence”, which is provided as an application on the Atlassian Forge platform for Atlassian Confluence Cloud. It explains which data is processed when using the App, for what purpose, and what rights you have.

Personal data is any data with which you can be personally identified. We treat your personal data confidentially and in accordance with statutory data protection regulations (in particular the GDPR) and this privacy policy.

2. Allocation of roles (controller / processor)

The App is installed and used by organizations (the “Customer”) in their own Atlassian Confluence environment. For the content created and processed via the App, the respective Customer is the controller in the data protection sense.

SynthScript processes this content exclusively on behalf of and according to the instructions of the Customer and, in this respect, acts as a data processor within the meaning of Art. 28 GDPR. The technical infrastructure is provided by Atlassian Pty Ltd (“Atlassian”), which acts as a sub-processor in this respect.

3. Technical basis: Atlassian Forge

The App is what is known as a Forge app. It runs and is stored entirely within Atlassian’s cloud infrastructure. SynthScript does not operate its own servers for this App and does not maintain its own database outside the Atlassian platform.

This means:

  • All of the App’s data is processed and stored in the Forge infrastructure provided by Atlassian.
  • The storage location and data residency depend on the specifications and settings of the respective Customer’s Atlassian cloud environment.
  • No data is transferred to SynthScript servers.

Further information on data processing by Atlassian can be found in Atlassian’s privacy policy at https://www.atlassian.com/legal/privacy-policy.

4. What data is processed?

a) Diagram and content data

The App stores the UML diagrams created by users. These include:

  • the diagram model data (a structured description of the diagram in JSON format),
  • a graphical representation of the diagram (SVG image),
  • a configuration belonging to the respective macro (e.g. the setting of who may edit the diagram).

This data is stored in Forge storage (Forge App Storage) and assigned to a unique identifier of the respective macro on the Confluence page.

Note: The App itself does not write any personal data into the diagrams. Whether diagrams contain personal data depends solely on the content that users enter (user-generated content). The Customer is responsible for this content.

b) Permission and context data

To decide whether a user may edit a diagram, the App evaluates at runtime whether the currently logged-in user has the corresponding editing rights for the respective Confluence page. For this purpose, the App uses the permission check provided by Atlassian as well as context information (e.g. the identifier of the page or content). This processing serves access control only. No personal permission data is permanently stored by the App in this process.

c) License information

Via the licensing function of the Atlassian Marketplace, the App checks whether a valid license exists for the installation (status “active” / “inactive”). This information is used solely for functional and license control.

5. What the App does not do

In the interest of transparency, we expressly point out the following:

  • The App does not set its own cookies and does not use any comparable storage mechanism for tracking purposes in the browser.
  • The App does not use any analytics, tracking or web analytics services.
  • The App does not embed any external services, fonts or content from third-party servers; all required program libraries and fonts are shipped with the App.
  • The App does not transmit any data to SynthScript servers or to any other third parties outside the Atlassian infrastructure.

6. Purposes and legal bases of processing

The data referred to in section 4 is processed for the purpose of providing the App’s functions, in particular creating, storing, displaying and editing UML diagrams as well as controlling access rights and the license.

The legal bases are:

  • Art. 6(1)(b) GDPR (performance of the contract on the use of the App vis-à-vis the Customer) and, insofar as SynthScript acts as a data processor, Art. 28 GDPR;
  • Art. 6(1)(f) GDPR (legitimate interest in the secure, functional and abuse-free operation of the App).

For personal data entered into diagrams by users, the respective Customer, as controller, is responsible for the legal basis.

7. Recipients of the data

The data is processed within the Atlassian Forge platform by Atlassian as a sub-processor. No further disclosure to third parties takes place. SynthScript itself has no routine access to the contents of the stored diagrams.

8. Data transfer to third countries

Any processing in third countries (outside the European Economic Area) may result from the use of the Atlassian cloud infrastructure and depends on the Atlassian cloud environment and the settings of the respective Customer. Atlassian provides appropriate safeguards for such transfers within the meaning of Art. 44 et seq. GDPR, in particular Standard Contractual Clauses. Further details can be found in Atlassian’s privacy policy.

9. Retention and deletion

The diagram, image and configuration data stored by the App is retained for as long as the associated macro or the associated Confluence page exists and the data is required for the App’s function.

Upon uninstallation of the App from the Customer’s Confluence environment, the associated data stored by the App in Forge storage is deleted in accordance with the mechanisms of the Atlassian Forge platform. The Customer can also remove individual diagrams by deleting the corresponding macro or content.

10. Your rights as a data subject

Under the GDPR, you have in particular the following rights:

  • Right of access (Art. 15 GDPR),
  • Right to rectification (Art. 16 GDPR),
  • Right to erasure (Art. 17 GDPR),
  • Right to restriction of processing (Art. 18 GDPR),
  • Right to data portability (Art. 20 GDPR),
  • Right to object to processing (Art. 21 GDPR).

Since the App’s content is processed on behalf of the respective Customer, please address requests to exercise your rights primarily to the Customer (the organization in whose Confluence environment the App is used) as the controller. We support the Customer in fulfilling these requests within the scope of our obligations as a data processor.

11. Right to lodge a complaint with the supervisory authority

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for SynthScript is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart

12. Contact for data protection matters

For questions about the processing of your personal data in connection with the App, please contact:

SynthScript
Owner: Christoph Kretschmer
Hornisgrindestraße 9
77855 Achern
Germany
Email: info@synthscript.de

13. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to implement changes to the App’s functions. The version in force at the time will then apply to renewed use.