Plumbworks / Privacy Policy
Privacy Policy
Who we are
Plumbworks is operated by Plumbworks LLP. In this policy "we", "us" and "Plumbworks" mean that entity.
For any privacy question, contact team@plumbworks.app.
Scope
This policy covers two distinct things, which are worth separating because they are handled very differently:
- Our apps, distributed through the Atlassian Marketplace and running on Atlassian Forge inside your own Atlassian tenant.
- Our website and business correspondence, at plumbworks.app and via email.
Data our apps process
Our apps are built on Atlassian Forge and execute entirely within Atlassian's infrastructure. We do not operate servers or databases that receive data from your Atlassian instance, and no data from your instance is transmitted to us.
Within your tenant, the apps read the following, depending on which app is installed:
- Atlassian account identifiers, display names, email addresses where visible, account type and active status.
- Issue metadata, comments and change history, used to derive activity dates.
- Page metadata, version history and approval records, for Confluence apps.
Derived results are written to Atlassian Forge app storage, which resides inside your tenant and inherits your Atlassian data residency region. We have no access to that storage.
For this processing, you are the data controller and Atlassian is the processor under your existing agreement with Atlassian. Plumbworks does not act as a processor of your instance data because it does not receive it.
Retention and deletion of app data
Scan results are overwritten on each run. When you uninstall an app, Atlassian deletes its Forge storage. Because we hold nothing, there is no deletion request to make of us regarding instance data.
Data we do collect
Correspondence
If you email us, we hold your email address, name and the content of the correspondence, in order to provide support and keep a record of what was agreed. Lawful basis: legitimate interest in operating a business and providing support. Retained for two years after the last message.
Website
This website is a static site. It sets no cookies, runs no analytics, and does not track visitors. The one external request your browser makes is to Google Fonts to load the site's typefaces, in the course of which Google receives your IP address, as it does for any resource a browser fetches. Nothing else about your visit is collected, stored or shared.
Commercial and billing information
Atlassian handles all Marketplace billing. We receive from Atlassian aggregated and per-installation commercial reporting, which may include the customer organisation name, site identifiers, licence tier and contact details of the technical or billing contact. We use this for revenue reporting, licence support and, where permitted, occasional product communication. Lawful basis: legitimate interest and contract performance.
Sharing
We do not sell personal data. We share it only with:
- Atlassian, as the Marketplace and platform operator.
- Our email service provider, for correspondence.
- Authorities, where legally required.
International transfers
We are based in India. Correspondence and commercial data may be processed there and by the providers listed above. Where data is transferred from the UK or EEA, we rely on standard contractual clauses. Note that data processed by our apps does not leave your Atlassian tenant and is therefore not subject to any transfer by us.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to data portability. To exercise them, email team@plumbworks.app. We will respond within one month.
Requests about data inside your Atlassian instance should go to your own organisation's administrator or to Atlassian, since we cannot access it.
If you are in the UK or EEA and are unhappy with our response, you may complain to your supervisory authority.
Security
Our technical approach is described in full at plumbworks.app/security.
Children
Our apps are business software and are not directed at anyone under 16. We do not knowingly collect personal data from children.
Changes
We will post any changes on this page and update the date above. Material changes affecting customers will also be sent to the technical contact on record.