Legal
Privacy Policy
How we collect, process, and protect your data.
Last updated: July 2, 2026
The short version
- Forge-native — app, data, and AI inference all run on Atlassian infrastructure; AI prompts never leave Atlassian's platform
- Smart anonymization — known Jira user identifiers are replaced with anonymous codes; system identifiers (account IDs, emails, project keys) are stripped; user-entered prompt text is sent as-is — avoid including sensitive data
- No training on your data — AI inference runs on Atlassian's Forge-hosted LLM; under Atlassian's AI data terms, your prompts are not used to train models
- Data residency — app data follows your Atlassian Cloud data residency region; AI inference stays inside Atlassian infrastructure
- Admin controls — monitor AI usage and toggle analytics
1. Overview
SuperTemplates (“we”, “our”, or “us”) is an Atlassian Forge app for AI-powered and manual bulk task creation in Jira, providing both Manual Features and AI-Powered Features as defined in Section 2 of our Terms of Service. AI-Powered Features run entirely on Atlassian's Forge-hosted LLM — no Jira issue content or user-entered content is ever sent to a third-party AI provider, whether AI features are used or not. This Privacy Policy explains how we collect, use, and safeguard your information when you use our App or visit our website (supertemplates.ai).
Our app is built on Atlassian Forge — it runs entirely on Atlassian's infrastructure with no external servers or databases. All persistent data (templates, preferences, sessions) is stored in Forge Key-Value Storage, which follows your Atlassian Cloud data residency region per Atlassian's Forge data residency policies.
SuperTemplates is a product of Konkret.dev, a registered business in Poland. Data Controller contact: privacy@supertemplates.ai. For full company details including registered address and tax identification, see our Contact page.
2. Data Controller and Processor
For App Users: Your Atlassian organization is the data controller. We act as a data processor, processing data only as necessary to provide the App's functionality per your instructions. Our processing obligations are defined in our Data Processing Agreement (DPA).
For Website Visitors: We are the data controller for personal data collected through our website (supertemplates.ai).
3. Data We Collect
Data you provide (App Users)
- Task descriptions and prompts you input for AI generation
- Template configurations and saved variables
- Account preferences and app settings
Data we process from Jira (with your permission)
- Project context: issue type names, priority names, field definitions
- User display names (anonymized before AI processing)
- Sprint names and board structure
Data we never send to the AI model
- Existing Jira issue content (titles, descriptions, comments, attachments)
- Authentication credentials or API tokens
- Project keys and board names — never included in AI prompts
- Atlassian account IDs and email addresses — account IDs are used only server-side to map anonymous codes back to users; they never leave Atlassian infrastructure
Website visitor data
- Page views, referral sources, and visitor behavior (Google Analytics)
- Company-level identification from IP addresses — not individual visitors (Snitcher)
- No personal data is sold or shared with third parties for advertising
See our Analytics & Cookies page for full details and opt-out options.
Legal basis: Consent (GDPR Art. 6(1)(a) and ePrivacy Directive Art. 5(3)). Analytics scripts are only loaded after you grant explicit consent via our cookie banner. You may withdraw consent at any time by clearing your browser cookies.
Correspondence
- Name and email address when you contact us at privacy@supertemplates.ai
- Content of your message and any attachments
- Purpose: responding to inquiries, fulfilling data subject requests, and providing support
- Legal basis: Contractual necessity (Art. 6(1)(b)) or Legitimate interest (Art. 6(1)(f)) in responding to inquiries
- Retention: kept for the duration of the inquiry plus 12 months, then deleted
4. Legal Basis for Processing (GDPR)
For App Users (we are a data processor):
Your Atlassian organization (the data controller) determines the legal basis for processing. We process data solely on your organization's instructions under our Data Processing Agreement.
For Website Visitors (we are the data controller):
- Contractual necessity (Art. 6(1)(b) GDPR) — to provide the website and respond to inquiries
- Legitimate interest (Art. 6(1)(f) GDPR) — to improve and secure the website, diagnose issues
- Consent (Art. 6(1)(a) GDPR) — for analytics cookies (Google Analytics, Snitcher) and marketing communications
- Legal obligation (Art. 6(1)(c) GDPR) — to comply with applicable laws
5. How We Protect Your Data
Smart Anonymization
Before data is sent to the AI model (Atlassian's Forge-hosted LLM), we automatically replace known Jira user identifiers — display names from your project's member list are substituted with anonymous codes (e.g., “U1”), and system identifiers such as Atlassian account IDs, email addresses, project keys, and board names are stripped. The model never sees these identifiers. In GDPR terms, this process constitutes pseudonymization (Art. 4(5)), not full anonymization — the mapping between codes and original identifiers exists within your Jira instance.
Important: Free-text content you enter in prompts (task descriptions, meeting notes, requirements) is sent to the model as written. If you include personal names not in your Jira project's user list, confidential information, or sensitive data directly in your prompt text, we cannot automatically detect or remove it. You are responsible for not including sensitive personal data in AI generation prompts.
Encryption
All data in transit is encrypted using TLS 1.2+. Data at rest is encrypted using AES-256 via Atlassian Forge infrastructure.
Data Residency
All app data is stored in Forge Key-Value Storage, which follows your Atlassian Cloud data residency region. AI inference is performed by Atlassian's Forge-hosted LLM inside Atlassian's infrastructure — prompts are not sent to any external AI provider.
No Training on Your Data
AI inference is performed by Atlassian's Forge-hosted LLM under Atlassian's AI data terms. Your prompts are not used to train AI models, and we do not log AI prompt or response content. If Atlassian materially changes how the Forge LLM handles data, we will promptly notify site administrators and update this policy.
6. AI Transparency (EU AI Act)
Under the EU AI Act, SuperTemplates is classified as a limited-risk AI system (content generation tool). We comply with transparency obligations as follows:
- AI interaction disclosure — the App clearly indicates when content is generated by AI. All AI-generated tasks are presented in a review interface before creation.
- Human oversight — no AI-generated content is created in Jira without explicit human review and approval (human-in-the-loop).
- No autonomous decisions — the App does not make automated decisions that produce legal or similarly significant effects on individuals (GDPR Article 22). It is a productivity tool that assists human decision-making, not replaces it.
7. Data Retention
We retain data only as long as necessary for the purposes described in this policy.
| Data Type | Retention Period |
|---|---|
| Templates & preferences | Until you delete them or uninstall the App |
| AI generation sessions | Transient — deleted shortly after results are retrieved, and no later than 24 hours (automatic expiry in Forge storage) |
| AI inference (Atlassian Forge LLM) | Handled inside Atlassian infrastructure under Atlassian's AI data terms; we do not log prompt or response content |
| Usage analytics | Pseudonymized (hashed identifiers); aggregated for reporting |
| App data after uninstall | Deleted per Atlassian Forge data retention policies |
8. Sub-processors
We use the following sub-processors:
| Provider | Type | Data Retention |
|---|---|---|
| Atlassian (Forge) | App hosting, data storage, authentication, and AI inference (Forge LLM) | Per your Atlassian data residency region |
| PostHog | In-app analytics (admin can disable) | SOC 2 Type II; no personal data stored |
| Vercel | Website hosting (cookieless) | Aggregated, anonymized |
| Google Analytics | Website analytics (consent required) | Per GA4 retention settings |
| Snitcher | Website B2B identification (consent required) | EU-based; GDPR compliant |
9. Admin Controls
Site administrators can:
- View per-user AI usage statistics
- Disable analytics egress at the site level (app functions normally without analytics)
- Export or delete all app data for their organization
10. Your Rights (GDPR)
App users (Jira)
Your Atlassian organization is the data controller for all data processed through the App. SuperTemplates is a Forge-native app — all data is stored on Atlassian's infrastructure, not on our servers. We do not have independent access to your organization's data.
To exercise GDPR rights regarding your Jira data (access, erasure, portability, etc.), contact your Atlassian site administrator. They can export or delete all app data directly, or uninstall the App to remove all stored data per Atlassian's Forge data retention policies.
In-app analytics (PostHog) track product usage events (e.g., feature clicks, page views) keyed to a hashed, pseudonymized identifier — no names, emails, or readable account IDs. Your site administrator can disable analytics entirely from the admin panel.
Website visitors (supertemplates.ai)
We are the data controller for analytics data collected through our website. This data is limited to what Google Analytics and Snitcher collect after you grant cookie consent (see Analytics & Cookies).
Under GDPR, you have the right to:
- Access — request a copy of personal data we hold about you
- Rectification — correct inaccurate personal data
- Erasure — request deletion of your data from our analytics providers (clearing cookies alone only stops future tracking)
- Restrict processing — limit how we process your data
- Object — object to processing based on legitimate interests
- Withdraw consent — revoke cookie consent at any time via the cookie banner or by clearing your browser cookies; withdrawal stops future data collection but does not affect data already processed
- Lodge a complaint — with the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or another supervisory authority in your jurisdiction
To request backend data deletion or exercise any other right, contact us at privacy@supertemplates.ai. We will respond within one calendar month per GDPR Article 12(3).
11. California Privacy Rights (CCPA)
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:
- Right to know — what personal information we collect, use, or share
- Right to delete — request deletion of your personal information
- Right to opt-out — of the sale of personal information (we do not sell personal data)
- Right to non-discrimination — for exercising your CCPA rights
We do not sell personal information. We do not share personal information for cross-contextual behavioral advertising.
12. International Data Transfers
App data is stored on Atlassian Forge infrastructure and follows your Atlassian Cloud data residency region. AI inference is performed by Atlassian's Forge-hosted LLM inside Atlassian's infrastructure — we do not transfer AI prompts to any third-party AI provider.
Atlassian operates its cloud infrastructure, including Forge LLM inference, on AWS as its infrastructure sub-processor — see Atlassian's sub-processor list.
For website analytics (Google Analytics, US-based), transfers are covered by Google's EU-US Data Privacy Framework certification and Standard Contractual Clauses.
13. Children's Privacy
The App is not intended for use by children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us at privacy@supertemplates.ai and we will promptly delete it.
14. Data Protection Contact
After assessing our processing activities against GDPR Article 37, we have determined that a Data Protection Officer (DPO) is not required. Our core activities do not involve large-scale systematic monitoring of individuals or large-scale processing of special category data.
For all privacy inquiries, data subject requests, or concerns about our data processing, please contact our Data Protection Lead: privacy@supertemplates.ai
15. Changes to This Policy
We may update this policy when we add new features or change sub-processors. Material changes will be communicated through the App or via email to site administrators with at least 14 days' advance notice.
16. Contact
For privacy-related questions or data requests, contact us at privacy@supertemplates.ai