Provider: Karelia Labs, Sweden ("we", "us")
Contact for privacy questions: support@karelialabs.atlassian.net
Version / date: 1.0 / 2026-10-18
1. What this policy covers
Treewright ("the App") is an app for Atlassian Confluence Cloud built on the Atlassian Forge platform. It copies page trees, creates page trees from templates and applies edit restrictions to child pages. This policy explains what personal data the App handles and what we, the provider, do and do not receive.
2. The short version
- The App runs entirely on Atlassian's infrastructure (Atlassian Forge, "Runs on Atlassian"). It does not send customer data to us or to any third party.
- We cannot read the data stored by the App on a customer's site. We do not receive page content, titles, attachments, user names or email addresses from the App.
- The App stores a small amount of job and configuration data in Forge storage on the customer's site, described below, and deletes most of it automatically.
3. Data handled by the App on the customer's site
| Data | Examples | Purpose | Where | Retention |
|---|---|---|---|---|
| Atlassian account ids | The user who started a job, created a template or a rule | Show a user their own jobs; attribute templates and rules | Forge storage on the customer's site | Jobs: 90 days, then deleted automatically. Templates and rules: until deleted or the App is uninstalled. |
| Page ids and page titles | Titles of the pages in a copied tree; titles in the link report | Plan, resume and report a copy job | Same | Jobs: 90 days |
| Link report | Text of links before and after rewriting (page titles, URLs) | The job report | Same | Jobs: 90 days |
| Template data | Template name, description, variable definitions, source page id and title | The template registry | Same | Until deleted or uninstall |
| Template values | Values a user types into a template form (for example a client name) | Fill in titles and text of the new pages | Used in memory and stored with the job record (so a job can be resumed) | Jobs: 90 days |
| Rule data and activity log | Page id/title, who created the rule; time, page id and result of automatic actions | The optional edit restriction rule; troubleshooting | Same | Rules: until deleted. Log: 14 days. |
| Short markers | Ids of pages created by a running copy job | Prevent the rule trigger from interfering with a running copy | Same | Hours |
The App does not store page bodies or attachments. While a job runs, page content is read and written through Confluence's own API in the App's temporary memory.
The App does not request or store names, email addresses, profile pictures or any other profile data. Users may themselves type personal data into page titles or template values; that data is then handled as described above.
4. Data we receive as the provider
- Support requests: if you contact support we receive what you send us (typically name, email address, site URL and the problem description). We use it to answer you and keep it as long as needed for support and legal obligations for at most 24 months after the last message, unless a longer period is required by law (for example bookkeeping rules).
- Marketplace transactions: purchases, licences and billing are handled by Atlassian under the Atlassian Marketplace terms. We receive licence and sales information from Atlassian as described in the Marketplace Partner Agreement, such as site, tier and contact details of the technical and billing contacts.
- Website: the Karelia Labs website sets no cookies and uses no analytics or trackers.
5. Roles and legal basis
For data handled by the App on the customer's site, the customer decides why and how it is used and is the controller. Atlassian hosts and processes it as the customer's processor under Atlassian's terms and the Forge Data Processing Addendum. Because the App's code runs on that platform and we have no access to the data, we do not process the customer's personal data on our servers. For the support requests you send us, we are the controller of that correspondence.
For our own data (support, partner and billing contacts) we are the controller. The legal basis is our contract with you and our legitimate interest in running and supporting the App, and legal obligations (bookkeeping).
6. Sub-processors and recipients
We use no sub-processors for customer data. Atlassian (platform, hosting, billing, Marketplace) acts under its own terms. Support requests, whether sent through our support portal or by email, are handled in Atlassian's Jira Service Management, with Atlassian as our processor under its Data Processing Addendum.
7. International transfers
Customer data stays where the customer's Atlassian product keeps it; the Forge storage used by the App follows the data residency of the host product. Our own support data is stored in Atlassian's cloud. Atlassian may process it outside the EU/EEA, for example in the United States, and protects such transfers with the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework.
8. Retention and deletion
- Job records and reports are deleted automatically after 90 days; users can remove a finished job earlier in the App.
- Templates and rules can be deleted in the App.
- Uninstalling the App removes its stored data from the customer's site according to Atlassian's Forge data retention rules.
- The App uses Atlassian's personal data reporting process: it reports the account ids it stores to Atlassian at least every 7 days and erases jobs, and anonymises templates and rules, of accounts that Atlassian reports as closed.
- Lists of people in page restrictions are read from Confluence while a job runs and are not stored by the App.
9. Security
The App follows the Forge security model: it requests only granular scopes, makes every Confluence request with the permissions of the acting user, validates all input, writes no page content to logs and uses no external services. Data in transit and at rest is protected by the Forge platform. We handle vulnerabilities within Atlassian's required time limits and notify Atlassian of security incidents within 48 hours.
10. Your rights
Under the GDPR you may have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to complain to a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY). For data stored by the App on a customer's site, please contact the administrator of that Atlassian site first; for our own data contact support@karelialabs.atlassian.net.
11. Children
The App is a business tool and is not directed at children.
12. Changes
We will update this policy when the App's data handling changes and publish the new version with a new date. Material changes are announced in the release notes.