1. App provider
SynthScript, owner Christoph Kretschmer
Hornisgrindestraße 9
77855 Achern
Germany
Phone: +49 7841 627 44 00
Email: info@synthscript.de
This privacy policy applies exclusively to the Atlassian Marketplace app “Inline Notes for Confluence” (the “App”). The SynthScript website is covered by the separate privacy policy published there.
2. Overview and how it works
The App is a Confluence extension built on the Atlassian Forge platform. It lets users create, read and delete short notes directly on a Confluence page. The App runs entirely within Atlassian’s cloud infrastructure. No data is transmitted to SynthScript servers or any other third parties.
3. Roles and responsibility
The organization that installs and uses the App in its Atlassian/Confluence environment (the “Customer”) determines the purposes and means of processing the content captured via the App and is therefore the data controller within the meaning of the GDPR. SynthScript merely provides the technical functionality and acts in this respect as a data processor (or sub-processor of Atlassian) on behalf of the Customer.
4. Data processed
When using the App, the following personal data of end users may be processed:
- Atlassian account ID (accountId) of a note’s author — to attribute the note and to check permissions when deleting.
- User display name — to label the note; retrieved via the Confluence user API.
- User profile picture/avatar (reference/URL) — to display next to the note; retrieved via the Confluence user API.
- Note text written by the user (free text) — may contain personal data entered by the user.
- Group membership of the acting user — evaluated solely to determine the Confluence administrator role for moderating/deleting notes.
- Page ID (content ID) and creation timestamp — as context for the respective note.
5. Purposes and legal basis
Processing is carried out for the purpose of providing the App’s functionality (creating, displaying and managing page-related notes). The legal basis is the agreement between the Customer (controller) and its users; processing by SynthScript is carried out on the Customer’s instructions on the basis of Art. 28 GDPR.
6. Storage location and hosting
All data processed by the App is stored exclusively in the storage of the Atlassian Forge platform (Forge Storage) within Atlassian’s cloud infrastructure. Hosting and storage location depend on the infrastructure and, where applicable, the data residency settings of the Customer’s respective Atlassian tenant. SynthScript does not operate its own servers for the App and does not store any of this data on its own systems.
Provider of the underlying platform:
Atlassian Pty Ltd / Atlassian, Inc.
Details and sub-processors see https://www.atlassian.com/legal
7. No disclosure to third parties / no data egress
The App does not transmit any personal data to SynthScript or any other third parties and communicates exclusively with Atlassian services (Confluence). No data export (“egress”) from the Atlassian environment takes place.
8. Permissions (scopes)
The App requests only the permissions necessary for its operation:
storage:app— storing and reading notes in Forge Storage.read:confluence-user— retrieving display name and avatar and checking administrator group membership.
9. Retention and deletion
Notes remain stored until they are deleted by their author or by a Confluence administrator. Upon uninstallation of the App or termination of the usage relationship, the associated data is removed in accordance with the Atlassian Forge platform. As the controller, the Customer can request deletion at any time.
10. License and billing data
Purchase, licensing and billing of the App are handled via the Atlassian Marketplace. The contract and transaction data required for this is processed by Atlassian; as part of Marketplace participation, SynthScript receives license- and transaction-related information from Atlassian (e.g. about orders and license status). End-user content (notes) is not included in this.
11. International data transfers
Any transfer to third countries takes place exclusively within the Atlassian cloud infrastructure and on the basis of the safeguards provided by Atlassian (e.g. EU Standard Contractual Clauses). Atlassian provides further information at https://www.atlassian.com/legal .
12. Rights of data subjects
Under the GDPR, data subjects have in particular the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21). As SynthScript acts as a data processor, these rights must generally be asserted against the controller (the Customer using the App). SynthScript supports the controller in fulfilling such requests.
13. Right to lodge a complaint with a supervisory authority
Data subjects have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for SynthScript is:
The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
14. Changes to this privacy policy
SynthScript reserves the right to amend this privacy policy in order to adapt it to changes in the legal situation or changes to the App. The version currently linked in the Atlassian Marketplace applies.
15. Contact
For questions about data protection in connection with the App, please contact:
SynthScript, owner Christoph Kretschmer
Email: info@synthscript.de