This policy explains how Plugins Factory (“we”) handles personal data in AssetPilot for Jira and AssetPilot Connect (the “Apps”), on plugins-factory.com and docs.plugins-factory.com, and in our support channels. We are responsible for the processing described here.
Privacy contact: privacy@plugins-factory.com.
Our two roles
- In the Apps, we are a processor. Your organisation decides what goes into the Apps and is the controller of that data. We process it only to provide the Apps, under our Data Processing Addendum.
- For our own business, we are a controller. This covers the websites, support requests, security reports, and the licensing and contact details Atlassian shares with us when you install an App.
Data the Apps access, collect and process
AssetPilot for Jira
| Category | Examples | Source |
|---|---|---|
| Atlassian account ids | Asset assignees, people who made a change (audit log) | Jira, when users act in the App |
| Jira profile data | Display name, avatar | Read from Jira when a page loads. Not stored. |
| External people | Name, email and department of people without a Jira account | Entered by your admins |
| Asset data | Tags, serial numbers, models, locations, dates, costs, notes, custom fields | Entered or imported by your users |
| Issue references | Keys of issues linked to assets | Your users’ actions |
AssetPilot Connect
| Category | Examples | Source |
|---|---|---|
| Device and MDM user data | Serial number, model, operating system, MDM user name and email | The MDM service you connect |
| Atlassian account ids | Who connected the App, who created an API key, assignees in event payloads | Jira and AssetPilot |
| Credentials | OAuth client secret and refresh token, MDM credentials, webhook secrets, chat URLs | Entered by your admins |
| Run and delivery logs | Event type, status, response code, per-device errors with serial number and MDM id | Produced by the App |
The Apps contain no analytics, tracking, advertising or AI.
Data on our websites
- Hosting. Cloudflare serves the websites and keeps standard request logs (IP address, time, page) for security and operations.
- Optional analytics. Google Analytics 4 and PostHog load only after you accept analytics in the consent panel, and only on our production domains. We send page views and a few link clicks, such as links to the Marketplace or documentation, with the page address without its query string or fragment. Session recording, automatic click capture, Google signals and ad personalisation are off. See cookies and analytics. Change your choice at any time through Privacy settings in the footer.
Why we process data
We process data only to provide the App functions your organisation turned on, keep the Apps and websites secure, understand website use with your consent, and answer requests you send us.
As a processor, we follow your organisation’s instructions, set out in the DPA.
Where data is stored
The Apps run on Atlassian Forge. App data is stored in Forge storage on Atlassian’s cloud infrastructure, in the location Atlassian uses for your Jira site, including your pinned data residency location. We run no servers or databases of our own.
AssetPilot sends no data outside Atlassian. AssetPilot Connect sends data only to services your admins configure: your MDM service, Slack or Microsoft Teams channels, and your webhook URLs. Your organisation chooses and contracts those services.
Data from our websites and support channels is stored with providers on our subprocessor list. Some are in the United States.
Who we share data with
- Atlassian, which hosts the Apps on Forge and runs our support portal (Jira Service Management).
- Services your admins connect through AssetPilot Connect.
- Our subprocessors, listed at /legal/subprocessors/. We give 30 days’ notice before adding one that processes App data.
- Authorities, only when the law requires it. We challenge requests that are not legally valid and tell your organisation unless the law forbids it.
We do not sell personal data or share it for cross-context behavioural advertising as defined by the CCPA/CPRA.
International transfers
App data stays in Atlassian’s infrastructure for your Jira site. Where website, analytics or support data is transferred out of the EEA, the UK or Switzerland, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses (with the UK Addendum).
How long we keep data
| Data | Retention |
|---|---|
| App data | For the life of the installation. Deleted by the Forge platform after uninstall, within Atlassian’s retention period for Forge hosted storage. |
| Connect logs | The last 50 sync runs per source, the last 500 deliveries, and stored idempotent responses for 24 hours |
| Support emails | 24 months after the request is closed |
| Security reports | 3 years |
| Analytics | Up to 14 months |
| Licensing contacts from Atlassian | While a licence is active, plus 12 months |
See data handling for details.
Security
Atlassian Forge provides encryption in transit and at rest. Controls include secrets in Forge secret storage, API keys stored as hashes, least-privilege permissions and no personal data in function logs. See the security page.
Your rights
Under the GDPR, the UK GDPR and similar laws, you can ask for access, correction, deletion, restriction or portability, and object to processing. California residents have the right to know, delete and correct their data, opt out of sale or sharing (we do neither), and not be discriminated against for using these rights.
For data inside the Apps, contact your organisation’s Jira admin first. They control that data, and we help them respond.
For anything else, write to privacy@plugins-factory.com. We reply within 30 days. You can also complain to your data protection authority.
Consent
The Apps ask for no consent beyond the permissions a Jira admin accepts at installation. Website analytics run only with your consent.
Children
The Apps and websites are for businesses and are not directed at children under 16.
Changes
We publish changes on this page with a new version number and date, and keep earlier versions. We announce material changes 30 days in advance on this page and to the technical contacts of active licences.