Data processing agreement

Last updated: 31 October 2026

This agreement covers personal data that Pivot & Roll-up Reports for Jira (“the app”) processes on your behalf. It forms part of the End user terms and applies automatically when you install the app; there’s nothing to sign. If you’d like a signed copy, email support@embertail.co.uk.

Who’s who

• You (the customer that installs the app) are the controller of the personal data in your Jira site.
• Embertail, the trading name of Steven Lewis, a sole trader based in Redditch, United Kingdom, is your processor for the processing described below.
• Data protection law means the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. Terms such as “personal data”, “processing” and “personal data breach” have the meanings given there.

Personal data Embertail handles as a controller in its own right, such as licensing contacts, app logs and support emails, is covered by the Privacy policy, not by this agreement.

The processing

Subject matter and purpose	Providing the app: building, saving, sharing and showing reports from your Jira data, as described in the documentation
Duration	While the app is installed, then until the data is deleted as described under Deletion
Nature	Reading Jira data to calculate reports; storing saved reports and settings; sending AI requests when people use AI features
Personal data	Atlassian account IDs and display names of report owners, editors and the people reports are grouped by; data in the Jira issues a report reads (such as assignees, reporters and worklog authors); the text of AI questions
Data subjects	Users of your Jira site, and anyone named in its issues
Special category data	None intended. Don’t put it in report names or AI questions

The app runs entirely on Atlassian Forge. Jira data is read when a report is shown and is not stored by the app; what is stored is listed in Data and security. Embertail cannot see your Jira data or saved reports.

Embertail’s commitments

Embertail will:

1. Follow your instructions. Process the personal data only to provide the app as set out in these terms and the documentation, which are your instructions, unless the law requires otherwise (in which case Embertail will tell you first, unless the law forbids it). Embertail will tell you if it believes an instruction breaks data protection law.
2. Keep it confidential. Only Steven Lewis has access to Embertail’s systems. Anyone given access in future will be bound by confidentiality.
3. Keep it secure. Maintain the measures in Data and security, including: running only on Atlassian’s platform with no outside servers; read-only access to Jira as the person using the app, so nobody sees more than Jira allows; access checks on Atlassian’s servers; and two-step verification on every account that can change or deploy the app.
4. Use only approved sub-processors. See Sub-processors.
5. Help with people’s rights. Most requests can be handled in Jira and the app by your admins. Where they can’t, Embertail will help you respond to requests to access, correct, delete or move personal data.
6. Help with your obligations. Give you reasonable help with security, breach notifications, data protection impact assessments and consultations with regulators, taking into account what Embertail can see.
7. Report breaches. Tell you without undue delay after becoming aware of a personal data breach affecting your data, with what is known and what is being done, and keep you updated.
8. Delete it at the end. See Deletion.
9. Show compliance. Give you the information you reasonably need to show this agreement is being kept, including answering security questionnaires. Audits are by written questions first; any further audit needs reasonable notice, is at your cost and happens no more than once a year unless a regulator requires it or there has been a breach.

Sub-processors

You authorise Embertail to use these sub-processors:

Sub-processor	What for	Where
Atlassian (Atlassian Pty Ltd and its affiliates)	Hosting the app on Forge: running its functions, storing its data, the Forge LLMs service for AI features, and app logs	Your Jira site’s data residency location for stored data; see Atlassian’s documentation for the rest
Google (Gmail)	Holding support emails, if you send personal data to support	Google’s data centres
Cloudflare	Forwarding support email	Cloudflare’s network

Each is bound by data protection terms that protect personal data at least as well as this agreement. Embertail will give at least 30 days’ notice of a new sub-processor on What’s new. If you object on reasonable data protection grounds and we can’t resolve it, you can stop using the app.

International transfers

Embertail is in the United Kingdom, which the EU recognises as providing adequate protection. Transfers by sub-processors are covered by their own safeguards, such as Atlassian’s data processing addendum, the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

Deletion

• Deleted reports are removed after 30 days, and weekly totals for “changes since last week” after 70 days.
• When an Atlassian account is closed, the app erases that person’s name within about a week.
• When you uninstall the app, Atlassian deletes its stored data under its data retention policy. Embertail keeps no copy.
• App logs are kept by Atlassian for up to 30 days.

General

• If this agreement conflicts with the End user terms on personal data, this agreement wins.
• Liability under this agreement is subject to the limits in the End user terms.
• It is governed by the laws of England and Wales.
• We may update it to reflect changes in the law or the app, and will note significant changes on What’s new. Changes won’t reduce the protection of your data.