Privacy Policy

Last updated: 20 July 2026

1. Scope

This Privacy Policy explains how the Atlassian Forge app CRA Reporting Copilot (the "App"), provided by Kazunari Itagaki, handles data. The App is a compliance-support tool that assists manufacturers in meeting the reporting obligations under Article 14 of Regulation (EU) 2024/2847 (the Cyber Resilience Act, "CRA"). It is not legal advice, and the customer (the manufacturer) remains solely responsible for determining whether and when to report, for preparing submissions, and for meeting statutory deadlines.

2. Data-handling model: processing stays inside your Atlassian tenant

The App runs entirely on the Atlassian Forge platform inside your own Atlassian Cloud tenant. As a result:

All data the App reads, computes on, or stores is processed and stored inside your Atlassian tenant. We do not receive, collect, or transmit your data to any server operated by us or by any third party outside Atlassian's platform.
The App has no external network egress. It does not make outbound calls to the internet, to us, or to any analytics, advertising, or telemetry service.
The App does not use any large language model (LLM) or other external AI service. All logic runs locally within Forge.

3. What the App accesses

The App requests only the following Forge scopes, and nothing more:

read:jira-work — read-only access to Jira work items so the App can analyze product/asset information relevant to CRA reporting. The App does not modify your Jira data through this scope.
storage:app — the App's own storage area inside your Atlassian tenant, used to hold the App's working data, classification results, drafts, and usage metrics.

The App does not request access to user account credentials, email contents, billing information, or any scope beyond the two listed above.

4. Reference data (KEV and similar) is a bundled static snapshot

Reference datasets used for analysis (for example, a Known Exploited Vulnerabilities / "KEV"-type catalog) are shipped inside the App as a static snapshot. The App does not make any live external connection to fetch or refresh this data. Because the snapshot is fixed at the time of each App release, it may not reflect the most current published state of the source; the snapshot's as-of date is always shown in the App so its freshness is never overstated.

5. Measurement / usage metrics stay inside Forge Storage

Any usage measurement the App performs (for example, counts of analyses run, feature usage, or error events) is written only to storage:app inside your Atlassian tenant. Metrics are not transmitted to us or to any external analytics provider. We do not have a mechanism to read your in-tenant metrics remotely.

** Separately from in-App metrics: as an Atlassian Marketplace vendor, the Provider receives from Atlassian** certain Marketplace-level information about installations and licenses (e.g., licensing/transaction reports used for billing and support). That information originates in Atlassian's Marketplace systems, not inside your tenant, and does not include your Jira content or the App's in-tenant metrics.

6. Retention

In-tenant App data (classification results, drafts, working data, metrics) is retained inside your Atlassian tenant's storage:app for as long as the App is installed, or until you delete it, whichever is earlier.
On uninstall, App data in storage:app becomes immediately unavailable to the App — a reinstall does not automatically restore prior data; it starts empty. At the Atlassian platform level, the data is soft-deleted and retained for 28 days, after which it is disposed of under Atlassian's data retention and disposal policy. Recovery of the prior data is possible only via a manual Atlassian support request to re-link the data to a reinstalled App, submitted within 21 days of uninstallation and with the customer's consent; if no such request is made within that window, the data cannot be recovered. (The 28-day platform retention window and the 21-day deadline to *request* re-linking are two distinct periods.)

7. No personal data sale; no advertising

We do not sell, rent, or share your data, and we do not use it for advertising. Because the App does not transmit your data out of your tenant, there is no data for us to sell or share.

8. Your role as data controller

Because processing occurs inside your Atlassian tenant, you (the customer) act as the controller of any personal data contained in your Jira work items that the App reads. The App is a tool operating within your environment rather than a service to which you transfer data.

8-bis. Personal data received via support

When you contact support, information you choose to share with us (e.g., screenshots, exported files, log excerpts) may contain personal data. We process such information solely to handle your support request, and delete it after 90 days after the request is resolved. This is separate from in-product processing, in which we do not receive your tenant content.

9. Contact

Questions about this Policy: support@complydraft.com.

10. Changes

We may update this Policy when the App changes. Material changes will be reflected in the version and date above.

---