Privacy Policy
What Jev for Jira stores, where it is stored, how long it is kept, and who else processes it. The app runs on Atlassian Forge and sends configured classification requests to OpenRouter, which routes them to TypeSafe. This website is hosted on Cloudflare Pages, and its launch update emails are sent through Resend.
Who we are
Jev for Jira is published by We The Folks sp. z o.o., based in Poznań, Poland. Our address and registration details are in the Contact section. The app is distributed through the Atlassian Marketplace.
We do not operate our own servers for this app. All application code runs inside Atlassian Forge, on Atlassian's infrastructure.
What this policy covers
This policy covers the Jev for Jira app and this website. It does not cover Jira itself, which is governed by Atlassian's own privacy policy and your agreement with Atlassian.
Processor, not controller
For issue data processed by the app, the customer organisation is the data controller and We The Folks acts as a processor on its instructions. Those instructions are the rules an administrator configures: the prompt, its Jira variables, the outcomes and the actions.
For the administrator account references stored with rules and activity, and for contact details sent to us directly, we act as controller.
What the app stores
Full issue bodies, expanded action values, attachments and provider credentials are not stored in activity.
Credentials
We The Folks supplies and pays for the OpenRouter credential used for classification. It is stored as an encrypted Forge environment variable, is read only by the app backend, and is never sent to the browser. Customers do not supply, view or replace it.
Where data is stored
Application records are stored in installation-scoped Forge storage. Rules and activity are additionally scoped by project. Data residency for Forge storage follows Atlassian's platform behaviour for your site.
Classification requests leave Atlassian and are processed by OpenRouter and TypeSafe. We do not control their processing regions.
How long it is kept
Retries, progress updates, and move continuations do not renew retention. For recovered events, activity and receipts also respect the earlier deadline of 14 days from the original event’s queue time.
What is sent to the model
When a rule runs or is tested, the app sends the prompt and outcome descriptions after variable expansion, configured outcome labels, and the Jira values those templates reference.
Older source-field rules also send their selected source-field identifier and value until an administrator reviews and saves their conversion to explicit variables. Plain-text conversion reduces embedded Jira metadata but does not remove every personal detail from the text.
Values used only inside action templates are expanded locally and are not part of the model request. The app caps the expanded request at 30,000 UTF-8 bytes; oversized input fails instead of being truncated.
No model request is made until a site administrator has authorized external AI processing. Disabling the authorization stops new requests; it cannot recall data already sent, cancel an accepted Jira move, or guarantee an immediate stop to an already-started action batch.
Service-health checks from the administration page and recovery scheduler use fixed synthetic data, not Jira issue content. They require site consent, make no ticket changes, and create no Activity log entries.
Sub-processors
The app does not enforce provider zero retention, no training on submitted data, or a fixed processing region. Provider retention follows their own policies.
Logs and our access
Forge developer logs may briefly contain operational information such as identifiers, statuses and error text. We do not log issue content, prompt bodies or credentials.
We do not have standing access to a customer's Jira data. Access for support requires the customer to share information with us deliberately.
What we do not do
The app has no advertising or data-sale feature. It is designed to classify Jira issues using administrator-defined questions and outcomes. It is not intended as the sole basis for decisions with legal or similarly significant effects on individuals.
The app does not search other Jira issues, does not generate free-form replies and does not choose actions beyond those an administrator configured.
This website
This site is a product page hosted on Cloudflare Pages. Cloudflare receives web request information, such as IP addresses and request headers, to deliver and protect the website. This hosting is separate from the Jira app's Forge runtime and storage.
This website uses Google Analytics to understand page visits and interactions. Google Analytics uses cookies and receives information such as visited page URLs, referral sources, browser and device details, and online identifiers. This website analytics integration is separate from the Jira app and does not connect to your Jira installation.
Fonts are loaded from Google Fonts, which receives the request metadata needed to serve them.
How Google uses information from sites that use its services
Launch update emails
Before Jev for Jira was released, this website let visitors sign up for launch updates; sign-ups closed when it became available on the Atlassian Marketplace. If you signed up, we collected the email address you entered and send you only two emails: a welcome email when you signed up and one announcing that Jev for Jira is available on the Atlassian Marketplace. We use the address for nothing else. So that one mailbox never receives these emails twice, we store the address in lower case and without any "+tag", and for Gmail addresses without dots, because those variants reach the same mailbox. We are the controller of this address, and the legal basis is your consent (Article 6(1)(a) GDPR).
Resend, operated by Plus Five Five, Inc. in San Francisco, United States, stores the address in our contact list and sends these emails as our processor. Its primary processing takes place in the United States. Its Data Processing Addendum incorporates the EU Standard Contractual Clauses for these transfers.
You can withdraw your consent at any time using the unsubscribe link in any of these emails, or by writing to [email protected]. Withdrawing consent does not affect emails sent before you withdrew it. We delete the list after we send the launch announcement. If you unsubscribe earlier, Resend keeps your address marked as unsubscribed, only so that you are not emailed again, until we delete the list; you can ask us to delete it sooner. The address is not added to the Jira app or shared with Atlassian. The sign-up form gives the same answer whether or not an address is already on the list.
Security
Every backend operation checks permissions; hidden controls are not treated as an authorization boundary. Activity entries are shown only to viewers who can access the referenced issue.
When a Jira write cannot be confirmed, the run is marked Needs review rather than repeated automatically. Report a suspected vulnerability to [email protected].
Your rights
Data subjects should contact the customer organisation that installed the app, as controller of the issue data. We support that organisation in responding.
A scheduled job reports stored administrator account references and removes those Atlassian marks as closed or updated. Hashed erasure markers prevent in-flight jobs from restoring removed references.
This process covers explicit account-reference fields. It does not automatically locate personal details embedded in prompts, action values, rule names or outcome labels, or recall data already sent to providers. Requests involving such content require an authorized, installation-specific review.
Where we act as controller, you can request access, correction, erasure, restriction or portability, object at any time to direct marketing such as the launch email, and complain to your supervisory authority.
International transfers
Classification requests may be processed outside the European Economic Area; the app does not restrict provider processing to an EEA region. We have not published app-specific contractual transfer terms. Contact us to review and complete the applicable agreements before using the app with data that requires those safeguards. Launch update emails are processed by Resend in the United States, as described in section 13.
Changes to this policy
Material changes will be announced on this page with a new version number and effective date before they take effect. On October 7, 2026, sections 01 and 13 were updated for the Atlassian Marketplace release and the end of launch sign-ups; this did not change how data is processed. Version 1.3, effective September 24, 2026, adds the optional launch update emails described in section 13 (a welcome email and a launch email); on the same date, section 01 replaced its private-testing notice with a reference to the current release status. Version 1.2 was published on September 21, 2026, to disclose Google Analytics on this website. Version 1.1 added technical detail about recovery, account references, erasure markers, and synthetic health checks.
Contact
We The Folks sp. z o.o., Wawrzyńca Engeströma 10, 60-571 Poznań, Poland. KRS: 0001185995. VAT ID: PL7812093366.
Privacy questions and data requests: [email protected].
For security reports and general enquiries, contact [email protected]. See also our App Terms.