Release Sync & Notes — DPA & Security Policy

Part I

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Macon Apps ("Vendor", "Processor") and the customer installing the Release Sync & Notes application ("Customer", "Controller") governing Customer's use of Release Sync & Notes (the "App"), an application for Atlassian Jira Cloud distributed through the Atlassian Marketplace. It applies to the extent the Vendor processes Personal Data on behalf of the Customer in providing the App.

1. Definitions

"Personal Data", "processing", "controller", "processor", "data subject", and "supervisory authority" have the meanings given in the EU General Data Protection Regulation (GDPR). "Personal Information", "business", "service provider", "sell", and "share" have the meanings given in the California Consumer Privacy Act as amended (CCPA/CPRA).

2. Roles

For Personal Data processed by the App, the Customer is the controller (or a processor acting for another controller) and the Vendor is a processor. For customers subject to the CCPA, the Vendor acts as a service provider. The Vendor is independently a controller of data it collects for its own business operations (e.g., support tickets and billing information), which is governed by the Vendor's Privacy Policy, not this DPA.

3. Subject Matter and Details of Processing

4. Processor Obligations

The Vendor will:

• Process Personal Data only to provide the App and only on the Customer's documented instructions (given via installation, configuration of sync groups, and use of the App), unless required otherwise by law, in which case the Vendor will inform the Customer unless legally prohibited.
• Ensure persons authorized to process Personal Data are bound by confidentiality obligations.
• Implement and maintain the technical and organizational measures described in Part II (Written Security Policy).
• Assist the Customer, insofar as reasonably possible, in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection) and in meeting the Customer's obligations under GDPR Articles 32–36.
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits limited to (a) the Atlassian Marketplace Privacy & Security listing disclosures, (b) this DPA and Part II, and (c) written responses to reasonable security questionnaires no more than once annually.

5. Sub-processors

The Customer authorizes the Vendor's use of Atlassian Pty Ltd and its affiliates ("Atlassian") as sub-processor. The App runs entirely on Atlassian's Forge platform: all data is stored in Forge storage within Atlassian's cloud infrastructure, and the App's only network communication is with Atlassian's own Jira and Confluence APIs. The App makes no network calls outside the Atlassian platform. The Vendor uses no other sub-processor. The Vendor will provide 30 days' notice (via the Marketplace listing and/or email) before adding or replacing any sub-processor, and the Customer may object on reasonable data-protection grounds by terminating the subscription.

6. International Transfers

Data residency and cross-border transfer of data stored in Forge storage are governed by Atlassian's cloud hosting infrastructure and Atlassian's own data-transfer mechanisms (including standard contractual clauses in Atlassian's customer agreements). The Vendor does not itself export Personal Data outside the Atlassian platform.

7. Security Incidents

The Vendor will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting the Customer's Personal Data processed by the App, providing information reasonably available about the nature, scope, and remediation of the breach, and will cooperate with the Customer's reasonable requests in connection with the breach.

8. CCPA Service Provider Terms

To the extent the Vendor processes Personal Information subject to the CCPA on the Customer's behalf, the Vendor: (a) acts as a service provider; (b) will not sell or share Personal Information; (c) will not retain, use, or disclose Personal Information for any purpose other than providing the App or as otherwise permitted by the CCPA; (d) will not combine Personal Information received from the Customer with information from other sources except as permitted by the CCPA; and (e) certifies that it understands and will comply with these restrictions. The Vendor will notify the Customer if it determines it can no longer meet its CCPA obligations.

9. Data Subject Requests

Given the App's architecture, the Customer can satisfy most data-subject requests directly: personal data appearing in version names, descriptions, or issue summaries lives in the Customer's own Jira and Confluence content and can be edited or deleted there; synchronized copies follow the lead project's values automatically. Audit log entries are automatically pruned to the most recent 500. On written request, the Vendor will assist with deletion of specific stored records where technically feasible.

10. Deletion and Return

Upon uninstallation of the App, all App data — sync group configurations, version mappings, and audit log entries — is automatically and permanently deleted by the Forge platform. The versions themselves, and any release-notes pages published to Confluence, are the Customer's own Jira and Confluence content: they remain in place, unaffected by uninstallation, and under the Customer's direct control at all times. No separate return procedure is required.

11. Liability and Order of Precedence

The liability of each party under this DPA is subject to the limitations of liability in the governing agreement (the Atlassian Marketplace Terms of Use or the Vendor's EULA, as applicable). In case of conflict between this DPA and that agreement regarding processing of Personal Data, this DPA prevails.

Part II

Written Security Policy

This policy describes the technical and organizational measures protecting Customer data processed by Release Sync & Notes. It is reviewed at least annually and after any material architectural change.

1. Architecture and Data Flow

• Release Sync & Notes is built entirely on Atlassian Forge and runs exclusively within Atlassian's cloud infrastructure. There are no Vendor-operated servers, databases, or third-party services.
• The App declares no external network egress: its only communication is with Atlassian's Jira and Confluence REST APIs, invoked server-side through the Forge platform. No Customer data is transmitted to any non-Atlassian destination.
• All processing (version sync planning and execution, reconciliation sweeps, release-notes generation, Confluence publication) executes in Forge functions inside Atlassian's sandboxed runtime.
• Release-notes content is generated on demand from live Jira data and rendered to the requesting administrator; it is persisted only when the administrator explicitly publishes it to the Customer's own Confluence site.

2. Data Storage and Encryption

• Sync group configurations, version ID mappings, and audit log entries are stored in Forge Key-Value Storage, encrypted at rest and in transit (TLS 1.2+) by the Atlassian platform.
• The App stores no credentials of any kind: no API tokens, passwords, or secrets. All Atlassian API access uses the Forge platform's own app-identity authorization, scoped and consented at installation.
• Data residency follows the Atlassian Forge platform's hosting arrangements.

3. Access Control

• The App's admin interface is available only to users with Jira administration permissions on the Customer's site, enforced by Atlassian's module-level access control.
• The Vendor has no standing access to Customer data. Forge's developer tooling does not expose stored Customer data to the Vendor in normal operation; application logs are limited to operational metadata and error diagnostics.
• Vendor accounts with publishing access to the App are protected by strong, unique credentials and two-factor authentication.

4. Least-Privilege Scopes

• The App requests only the OAuth scopes required for its function: reading Jira work items and projects (release-notes generation and pickers), managing project versions (the sync itself), app storage, and — solely for the optional publishing feature — creating Confluence pages and listing Confluence spaces.
• Destructive operations are opt-in: deletion sync is disabled by default on every sync group and must be explicitly enabled by a Customer administrator.
• Every write the App performs is recorded in its in-app audit log, including the prior values of any fields it overwrites, so Customer administrators can review and reverse the App's actions.

5. Secure Development

• All changes pass an automated test suite (unit and integration tests covering the sync engine, event pipeline, reconciliation, notes generation, and storage layers) before deployment.
• Dependencies are limited to Atlassian's official Forge SDK packages, are kept current, and are audited for known vulnerabilities (npm audit) as part of the release process; the codebase is linted with Atlassian's forge lint tooling.
• Deployments use staged environments (development → production); production deploys occur only after functional verification on a development site.

6. Vulnerability Management and Disclosure

• Marketplace apps are subject to Atlassian's ecosystem security scanning, and the Vendor participates in Atlassian's Marketplace security programs applicable to its tier.
• Security reports may be submitted to [email protected]. The Vendor will acknowledge reports within 2 business days, and aims to remediate critical vulnerabilities within 2 weeks of confirmation, in line with Atlassian Marketplace security bug-fix expectations.

7. Incident Response

• Operational failures are detected via platform logs and the App's own audit log, which records failed operations as error entries visible to Customer administrators.
• On discovering a security incident affecting Customer data, the Vendor will: contain the issue (including disabling the affected capability if needed), assess scope using platform logs, notify affected customers within 72 hours per Part I Clause 7, and publish remediation details.

8. Data Retention and Deletion

• Sync group configurations and version mappings are retained for the life of the subscription to serve the App's purpose.
• Audit log entries are automatically pruned to the most recent 500 by a scheduled maintenance job — the App does not accumulate an unbounded activity history.
• Uninstalling the App permanently deletes all stored data via the Forge platform's app-storage lifecycle. No copies exist outside Atlassian infrastructure. Versions and published Confluence pages are the Customer's own content and are unaffected.

9. Business Continuity

• Availability, redundancy, and disaster recovery of the runtime and storage are provided by the Atlassian Forge platform. The App holds no data outside that platform, so there is no separate Vendor recovery surface.
• The App is stateless apart from Forge storage; redeployment from source restores full service. A nightly reconciliation sweep self-heals any synchronization state affected by transient failures.

10. Sub-processors

• Atlassian (Forge platform: runtime, storage, Jira and Confluence APIs) — sole sub-processor.

Macon Apps · Release Sync & Notes · DPA & Written Security Policy v1.0 · 7/31/2026 · [email protected] · Questions? Open a ticket in our support portal.