Rule Kit for Jira Workflows — Privacy Policy
Last updated:
This policy covers Rule Kit for Jira Workflows (“the app”), a Jira Cloud app built on Atlassian Forge. MSC Labs, not Atlassian, is responsible for how the app processes data.
In short
- The app runs on Atlassian's own platform and sends nothing outside Atlassian.
- It has no database or storage of its own.
- It reads and changes work items only as the rules your Jira admins set up tell it to.
- Its logs record what a rule did, not what a work item says.
Who we are
- Developer
- Muhammed Said Çakır (MSC Labs), a sole proprietorship
- Location
- Kütahya, Türkiye
- Contact
- muhammedsaidcakir@msclabs.tr
What the app reads and changes
Jira asks your admin to approve these permissions when the app is installed. The app uses each one only for what is written here.
| Permission | What the app does with it | Rules that use it |
|---|---|---|
read:jira-work | Reads the work item, its links, children, parent and statuses, and checks JQL with Jira's own parser and matcher. | JQL validator, Linked work items validator, Parent/child validator, Add or remove labels, Add or remove watchers, Run actions in order |
write:jira-work | Changes the work item after a transition: labels, watchers, text fields, and creating a linked work item. | Add or remove labels, Add or remove watchers, Run actions in order |
manage:jira-configuration | Jira only calls a Forge workflow post function when the app holds this scope; without it the post functions never run. | Add or remove labels, Add or remove watchers, Run actions in order |
read:jira-user | Lets an admin search users by name when picking watchers, and shows the current names of users already picked. Names are not stored. | Add or remove watchers, Run actions in order |
Where data goes
The app runs on Atlassian's infrastructure and qualifies for Atlassian's “Runs on Atlassian” programme: it makes no requests outside Atlassian and declares no external network access. Data the app handles stays where Atlassian hosts your site, so your site's data residency applies. The only company that processes data for the app is Atlassian, as the platform operator.
What is stored, and where
| Data | Where | How long |
|---|---|---|
| Each rule's settings (JQL, labels, statuses, picked users' account IDs, text for ordered actions) | In your Jira site, saved by Jira inside the workflow | Until an admin removes the rule from the workflow |
A marker on work items the “run actions in order” rule creates: the issue property workflow-rules-created, holding only a version number | On that work item, in your Jira site | Until the work item is deleted or an admin removes the property |
| App logs (see below) | Atlassian's Forge platform | 30 days, set by Atlassian |
The app has no database, no file storage and no Forge storage of its own.
Personal data
The personal data the app handles is Atlassian account IDs: of the users an admin picks in a watcher rule, and, while a rule runs, of the user who made the transition, the assignee and the reporter. When someone opens a rule's settings, the app sends that person's account ID to Jira to check that they are a Jira administrator; the answer is not saved. Display names are read from Jira at the moment the settings screen shows them and are not saved. The app does not use or keep email addresses.
Logs
Each time a rule runs, the app writes a short log line to Atlassian's Forge platform so that problems can be found. A line holds the rule, the work item key (such as ABC-123), the outcome, and, when Jira refuses a change, the HTTP status and Jira's error message. Account IDs that appear in Jira's error messages are replaced before logging.
Logs do not hold work item content (summaries, descriptions, comments, field values), names or account IDs. Atlassian keeps them for 30 days; we cannot extend that.
Deleting data
We hold no copy of your data, so there is nothing for us to delete. When an admin uninstalls the app, it stops running. Rule settings stay in your workflows until an admin removes the rules; the marker property stays on the work items the app created until they are deleted or an admin removes it with Jira's issue property API. Logs expire after 30 days.
Your rights
Because we do not hold your data, requests to see, correct or delete data in your Jira site go to your site admin, who controls it. For questions about this policy or the app, write to muhammedsaidcakir@msclabs.tr. We reply within 30 days.
Changes to this policy
When the way the app handles data changes, we update this page the same day and change the date above.