Wombats Corp — Privacy Policy

---

1. Introduction

This Privacy Policy describes how LLC "WOMBATS CORP" (identification number 44882380), a limited liability company organized under the laws of Ukraine, with its registered office at 33/37 Laboratorna Str., Kyiv, 03150, Ukraine ("Wombats Corp," "we," "us," or "our"), handles data in connection with the software applications ("Apps") we publish on the Atlassian Marketplace.

This Privacy Policy applies to all Wombats Corp Apps across all supported deployment types, including Atlassian Cloud (Forge — "Runs on Atlassian") and Atlassian Data Center.

We are committed to protecting the privacy and security of your information. Please read this Privacy Policy carefully to understand our practices.

2. Scope

This Privacy Policy covers:

• All Apps published by Wombats Corp on the Atlassian Marketplace;
• All supported Atlassian Products (Jira, Confluence, Bitbucket, Crowd, and others);
• All supported deployment types (Cloud and Data Center);
• Our company website and support channels.

This Privacy Policy does not cover third-party services, including Atlassian's own privacy practices. For information about how Atlassian handles your data, please refer to the Atlassian Privacy Policy.

3. Data Protection Roles & Data Processing Addendum

For the purposes of applicable data protection laws (including GDPR and CCPA):

• Cloud Apps (Forge): Cloud Apps run entirely within Atlassian's cloud platform ("Runs on Atlassian"). Atlassian acts as the primary cloud infrastructure provider and data processor under Atlassian's Data Processing Addendum (DPA). Wombats Corp does not host external application servers or collect independent databases of Customer Data. The Customer (the organization that installed the App) is the data controller.
• Data Center Apps: The Customer is both the data controller and data processor. Wombats Corp has no access to Customer Data in Data Center deployments.
• EU Representative Exemption (GDPR Art. 27): Under GDPR Article 27(2), Wombats Corp is exempt from the requirement to designate an EU representative because processing of personal data via Apps is occasional, does not include large-scale processing of special categories of personal data, and is unlikely to result in risk to the rights and freedoms of individuals.

Wombats Corp contact for privacy inquiries: LLC "WOMBATS CORP" 33/37 Laboratorna Str., Kyiv, 03150, Ukraine Email: info@wombatscorp.com

4. Data We Do NOT Collect

Wombats Corp does not:

• Operate its own data collection or analytics servers;
• Transmit Customer Data from any App to Wombats Corp servers or any external third-party service;
• Collect, store, or process personal data on infrastructure owned or controlled by Wombats Corp;
• Sell, rent, share, or trade personal data to third parties;
• Use Customer Data for advertising, profiling, or marketing purposes;
• Embed third-party tracking, analytics, or advertising SDKs within our Apps.

5. Data Handling by Deployment Type

5.1 Cloud Apps — Atlassian Forge ("Runs on Atlassian")

Apps built on Atlassian Forge run entirely within Atlassian's cloud infrastructure. This means:

Aspect	Detail
Where data is stored	Atlassian's cloud infrastructure (Forge Storage, Forge SQL, Jira/Confluence entity properties)
Where code executes	Atlassian's Forge runtime environment
External data transfer	None. No data leaves Atlassian's infrastructure to Wombats Corp servers.
Data residency	Governed by Atlassian's data residency policies and Customer's Atlassian configuration
Infrastructure security	Managed by Atlassian (encryption at rest, encryption in transit, SOC 2, ISO 27001)
Wombats Corp access to data	Wombats Corp does not have direct access to Customer Data stored in Forge. We cannot read, export, or view your data.

Data processed by Forge Apps may include (varies by App):

• Configuration data entered by administrators (e.g., module settings, templates, display rules);
• Metadata such as Jira project keys, issue type names, user account IDs (for attribution);
• User-generated content as required by the App's functionality.

5.2 Data Center Apps

Data Center Apps are installed and executed entirely on the Customer's own infrastructure:

Aspect	Detail
Where data is stored	Customer's own servers and databases
Where code executes	Customer's Atlassian Data Center instance
External data transfer	None. The App does not send data to Wombats Corp or any external service.
Data residency	Determined entirely by the Customer's infrastructure choices
Infrastructure security	Customer's responsibility
Wombats Corp access to data	None. Wombats Corp has no access to Customer's Data Center environment.

5.3 Marketplace Licensing Data

When you purchase or subscribe to an App through the Atlassian Marketplace, Atlassian may share limited licensing and transaction data with Wombats Corp as the App vendor, including:

• Organization name;
• Contact email address;
• License tier and type (evaluation, commercial, community);
• License start and end dates;
• Technical contact information.

This data is provided by Atlassian under the Atlassian Marketplace Vendor Agreement and is used by Wombats Corp solely for license management, support, and communication purposes.

6. Personal Data We May Process

6.1 Through App Functionality

Depending on the specific App, the following categories of personal data may be processed within the Atlassian platform (not by Wombats Corp directly):

Category	Examples	Purpose
User identifiers	Atlassian account IDs	Attribution (e.g., recording who created or modified a configuration)
User profile data	Display names, avatars	Display purposes within the App's UI
Work content	Issue data, page content, project metadata	As required by the App's documented functionality

6.2 Through Support Interactions

When you contact Wombats Corp for support, we may collect:

• Your name and email address;
• Your organization name;
• Technical details about your environment (Atlassian Product version, App version, deployment type);
• Screenshots, logs, or descriptions of issues you provide voluntarily.

This data is used solely to provide support and is retained only as long as necessary for that purpose.

7. Legal Basis for Processing (GDPR)

Where the EU General Data Protection Regulation (GDPR) applies, Wombats Corp processes personal data on the following legal bases:

Legal Basis	Application
Contract performance	Processing necessary to provide App functionality and support services as agreed in our Terms of Service
Legitimate interest	License management, product improvement, security
Consent	Where required by applicable law, e.g., for optional communications
Legal obligation	Where required to comply with applicable laws

8. Data Retention

• Cloud App data (Forge): Data is retained within Atlassian's infrastructure for as long as the App is installed. Upon App uninstallation, data retention and deletion is governed by Atlassian's policies and the Forge platform's data lifecycle.
• Data Center App data: Data is retained on the Customer's infrastructure. Upon App uninstallation, data retention is the Customer's responsibility.
• Support interaction data: Retained for up to 36 months after the last interaction, or longer if required by applicable law.
• Marketplace licensing data: Retained for the duration of the business relationship and for up to 36 months thereafter, or longer if required by applicable law.

9. Data Security & Security Incident Notification

9.1 Cloud Apps (Forge)

Security of data stored in Forge is managed by Atlassian, including:

• Encryption at rest and in transit;
• Compliance with SOC 2, ISO 27001, and other certifications;
• Regular security audits and penetration testing.

Wombats Corp follows Atlassian's security guidelines for Forge app development, including the principle of least-privilege permissions and regular review of requested Atlassian API scopes.

9.2 Data Center Apps

Security of the Customer's Data Center environment is the Customer's responsibility. Wombats Corp develops Data Center Apps following secure coding practices but does not control the deployment environment.

9.3 Organizational Measures

Wombats Corp maintains the following organizational security practices:

• Access to Marketplace vendor accounts is restricted to authorized personnel;
• Development follows secure coding standards;
• App updates are reviewed before publication;
• Source code is managed through access-controlled repositories.

9.4 Security Incident Notification

In the event that Wombats Corp becomes aware of any confirmed security incident or unauthorized access affecting our Apps or customer licensing data, Wombats Corp will notify affected customers and Atlassian without undue delay (and no later than 72 hours after confirmation) and take reasonable steps to mitigate the impact.

10. International Data Transfers

Wombats Corp is based in Ukraine. However:

• Cloud Apps (Forge): Data remains within Atlassian's infrastructure, and data residency is governed by Atlassian's data residency program and the Customer's configuration. Wombats Corp does not transfer Cloud App data internationally.
• Data Center Apps: Data remains on the Customer's infrastructure. No data is transferred to Wombats Corp.
• Support and licensing data: May be accessed from Ukraine. Where such data includes personal data of individuals in the EU/EEA, Wombats Corp relies on appropriate safeguards as required by applicable law.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access — request information about the personal data we hold about you;
• Right to rectification — request correction of inaccurate data;
• Right to erasure — request deletion of your data, subject to legal retention requirements;
• Right to restrict processing — request limitation of how we process your data;
• Right to data portability — receive your data in a structured, commonly used, machine-readable format;
• Right to object — object to processing based on legitimate interests;
• Right to withdraw consent — where processing is based on consent.

To exercise these rights, contact us at info@wombatscorp.com. We will respond within 30 days.

For data stored within Atlassian's infrastructure through Cloud Apps, please note that Wombats Corp does not have direct access to Customer Data. Requests related to such data should be directed to Atlassian or managed by your organization's Atlassian administrator.

11.1 California Privacy Rights (CCPA/CPRA Notice)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, grants you specific rights regarding your Personal Information:

• Right to Know and Access: You may request details about the categories and specific pieces of personal information collected.
• No Sale or Sharing: Wombats Corp does not "sell" or "share" (for cross-context behavioral advertising) your Personal Information as defined under the CCPA.
• Right to Opt-Out / Limit Use: Because we do not sell or share data or process sensitive personal information for profiling, no opt-out link is required.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

12. Children's Privacy

Wombats Corp Apps are business-to-business tools designed for use within Atlassian Products by authorized business users. Our Apps are not directed at individuals under the age of 16 (or applicable age of majority), and we do not knowingly collect personal data from children.

13. Third-Party Services

Our Apps may interact with Atlassian APIs and services as part of their documented functionality. We do not embed third-party analytics, advertising, or tracking services within our Apps.

Links to external resources (e.g., documentation, support pages) may be present within our Apps. These external sites are subject to their own privacy policies.

14. Cookies and Tracking

Wombats Corp Apps do not set cookies or use tracking technologies beyond what is provided by the Atlassian platform itself. Any cookies or local storage used are limited to functional purposes (e.g., UI state) within the Atlassian Product and do not track users across sites.

15. App-Specific Data Handling

The following section provides additional data handling details for specific Apps. This list is updated as new Apps are published or existing Apps are updated.

15.1 Pro Customizer for Jira (Jira Cloud — Forge)

Aspect	Detail
Deployment	Atlassian Forge ("Runs on Atlassian")
Atlassian Product	Jira Cloud
Data storage location	Forge SQL, Jira entity properties (all within Atlassian infrastructure)
Personal data processed	Atlassian account IDs and display names (for module attribution); Jira project keys and issue type names (for module scoping)
External data transfer	None
Permissions requested	storage:app, read:jira-user, read:jira-work, write:jira-work, manage:jira-configuration
Admin-authored content	HTML templates created by Jira administrators are stored in Forge SQL and Jira entity properties

15.2 Data Center Apps (General)

Aspect	Detail
Deployment	Customer's Data Center infrastructure
Data storage location	Customer's servers and Atlassian application database
Personal data processed	As required by each App's functionality, processed entirely within the Customer's environment
External data transfer	None
Wombats Corp access	None

For specific Data Center App details, refer to the respective App's Marketplace listing.

16. Changes to This Privacy Policy

Wombats Corp may update this Privacy Policy from time to time. Material changes will be communicated through an updated "Last Updated" date at the top of this document or notice on the Atlassian Marketplace listing. Continued use of any App after the effective date of a revised Privacy Policy constitutes acceptance of the changes.

17. Contact Information

For privacy-related inquiries, requests, or complaints, please contact: