Data Processing Addendum

Last updated: October 22, 2026

Conf2Git version: September 2, 2026. SQR coverage was published on October 22, 2026 and applies from the product’s first public availability through Atlassian Marketplace. Publication of this policy does not announce SQR’s Marketplace availability. Each customer’s agreement takes effect under its applicable agreement.

This Data Processing Addendum (“DPA”) forms part of the agreement (“Agreement”) between the customer using Conf2Git – Markdown Sync for Confluence or Service Quality Review for Jira Service Management (“Customer”) and Magnascale Inc., Ontario, Canada (“Magnascale”) governing Customer’s use of the applicable covered service.

This DPA applies where Magnascale processes Personal Data on behalf of Customer in connection with either covered service. Conf2Git-specific processing details below remain applicable only to Conf2Git. The SQR processing schedule governs SQR-specific processing; shared obligations apply to both services unless expressly product-specific.

1. Definitions

For this DPA:

Applicable Data Protection Law means privacy and data-protection law applicable to the processing covered by this DPA, including, where applicable, the GDPR, UK GDPR, Swiss data-protection law, Canadian privacy law, and applicable United States state privacy law.

Customer Data means information Customer directs the applicable covered service to process in providing the service.

Personal Data, Controller, Processor, Data Subject, and Processing have the meanings assigned by Applicable Data Protection Law.

Security Incident means a confirmed breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by Magnascale on behalf of Customer.

2. Roles and instructions

For Customer Data processed to provide either covered service:

Customer acts as Controller or otherwise determines the purposes and means of processing;
Magnascale acts as Processor or service provider to Customer to the extent required by Applicable Data Protection Law; and
Customer instructs Magnascale to process Customer Data as necessary to provide, secure, support, maintain, troubleshoot, and improve the reliability of the contracted service.

Magnascale may separately act as an independent Controller for its own legitimate legal, account, billing, security, fraud-prevention, and business-administration records.

Magnascale will process Customer Data only on documented Customer instructions, including the Agreement, this DPA, the customer’s configuration of the applicable covered service, and other written instructions consistent with the service, unless processing is required by applicable law.

If applicable law requires processing beyond Customer’s instructions, Magnascale will inform Customer before processing unless legally prohibited from doing so.

3. Conf2Git processing details

The following processing details describe Conf2Git only. SQR processing is described in the SQR processing schedule.

Subject matter

Operation of Conf2Git as a one-way synchronization service from Customer-selected Confluence Cloud spaces to Customer-selected GitHub repositories.

Duration

For the duration of the Agreement and for any limited retention period required to securely operate, recover, or delete service data in accordance with the Agreement, this DPA, and the applicable platform lifecycle.

Nature and purpose

Processing may include:

reading Customer-selected Confluence content;
converting supported content to Markdown;
processing eligible referenced images;
publishing generated output to the Customer-selected GitHub repository;
storing bounded configuration and operational metadata;
authenticating administrators and GitHub authorization;
operating queues, checkpoints, retries, recovery, and synchronization history;
enforcing Marketplace licensing;
providing security, support, troubleshooting, and incident response; and
protecting Customer repositories from unauthorized or destructive application behavior.

Categories of Personal Data

Depending on Customer’s selected Confluence content and configuration, Personal Data may include:

Confluence page content and eligible images;
page titles, identifiers, URLs, hierarchy, version and attachment metadata;
administrator and account identifiers;
GitHub installation, repository, branch and authorization metadata;
configuration and synchronization metadata;
timestamps, status information and bounded diagnostic information; and
any Personal Data Customer includes in the Confluence content it chooses to synchronize.

Categories of Data Subjects

Data Subjects may include:

Customer personnel;
Confluence users and content authors;
GitHub administrators and repository users;
Customer contractors, customers, partners or other individuals whose information Customer places in selected Confluence content; and
other persons whose Personal Data appears in Customer-selected content.

Customer controls what source content is selected for synchronization.

4. Confidentiality

Magnascale will ensure that persons authorized to process Personal Data on its behalf are subject to appropriate confidentiality obligations.

Access by Magnascale personnel is limited to personnel with a legitimate need for support, security, reliability, troubleshooting, abuse investigation, legal compliance, or incident response.

5. Security measures

Magnascale will maintain technical and organizational measures appropriate to the nature of the service and the risks of the processing.

The following implementation measures describe Conf2Git. SQR measures are described in the SQR processing schedule. Current Conf2Git measures include:

read-only Confluence application access for the synchronization service;
GitHub App installation authentication rather than customer personal access tokens;
server-side authorization checks for sensitive operations;
restriction of publication to the configured non-default GitHub branch;
no force-push behavior;
managed-file ownership and provenance controls;
tenant-isolated Atlassian Forge hosted storage for bounded application metadata;
bounded storage and retention of operational records;
exclusion of customer content bodies, generated Markdown bodies, image bytes, credentials, tokens, authorization headers, and raw licence/provider responses from intentional application logging;
secrets management through the supported application/platform mechanisms;
need-to-know and least-privilege operational access;
HTTPS/TLS protections provided by the applicable Atlassian and GitHub services; and
fail-closed behavior where required authorization, source completeness, ownership, provenance, entitlement, or safety evidence is unavailable.

Additional public information is available in the shared Security Policy, including its Conf2Git controls:

https://magnascale.com/security/

6. Service platforms and third parties

Conf2Git’s production data flow uses:

Atlassian

Atlassian provides Confluence Cloud and the Forge compute, hosted storage, queue, logging, authorization, administration, and Marketplace licensing services used to operate Conf2Git.

GitHub

GitHub is the Customer-selected publication destination and provides the GitHub App authorization and repository APIs used by Conf2Git.

Customer expressly directs Conf2Git to transmit the selected generated content to the GitHub repository configured by Customer.

Magnascale does not operate a separate vendor-hosted remote application backend or content database for Customer’s Confluence content in public v1.

To the extent that a service provider used in delivering either covered service qualifies as a subprocessor under Applicable Data Protection Law, Customer authorizes Magnascale to use the service components disclosed in this DPA and the applicable privacy disclosures.

Magnascale will not add a separate third-party processor of Customer content without first updating applicable disclosures and meeting any notice or authorization obligations required by Applicable Data Protection Law.

7. International processing

Magnascale’s authorized operational personnel access relevant Atlassian-hosted operational information from Canada.

Where applicable law permits transfers to Canada on the basis of an adequacy determination, the parties may rely on that mechanism.

Where another lawful transfer mechanism is required, the parties agree that the applicable European Commission Standard Contractual Clauses (“SCCs”) are incorporated into this DPA to the extent necessary.

Where Customer is a Controller and Magnascale is a Processor, Module Two (Controller to Processor) of the SCCs applies unless another module is legally required by the parties’ actual roles.

For transfers subject to UK GDPR, the applicable UK International Data Transfer Addendum or successor lawful mechanism applies to the SCCs as required.

For transfers subject to Swiss data-protection law, the SCCs will be interpreted and modified as necessary to apply to Switzerland and the Swiss Federal Data Protection and Information Commissioner.

This section does not represent that Atlassian or GitHub infrastructure is located exclusively in Canada.

8. Data-subject requests

Taking into account the nature of the processing, Magnascale will provide reasonable assistance to Customer in responding to Data Subject requests where Customer cannot reasonably fulfill the request without Magnascale’s assistance.

Where Magnascale receives a request relating primarily to Customer-controlled Personal Data, Magnascale may direct the requester to Customer unless Applicable Data Protection Law requires a different response.

9. Security incidents

Magnascale will notify Customer without undue delay after becoming aware of a confirmed Security Incident affecting Personal Data processed by Magnascale on Customer’s behalf.

The notification will include information reasonably available to Magnascale regarding:

the nature of the incident;
affected data or systems;
known or reasonably anticipated consequences; and
measures taken or proposed to contain, investigate, and remediate the incident.

Magnascale’s notification of a Security Incident is not an admission of fault or liability.

10. Assistance and compliance

Taking into account the nature of processing and information available to Magnascale, Magnascale will provide reasonable assistance with Customer’s obligations relating to security, breach notification, data-protection impact assessments, and regulator consultation where required by Applicable Data Protection Law.

Magnascale will maintain information reasonably necessary to demonstrate compliance with its obligations under this DPA.

11. Audits and information requests

Upon reasonable written request, Magnascale will provide Customer with information reasonably necessary to demonstrate compliance with this DPA.

Where that information is insufficient and Applicable Data Protection Law gives Customer an audit right, Customer may request a reasonable audit.

Audits must:

be related to processing under this DPA;
occur on reasonable advance notice;
avoid unreasonable disruption to Magnascale or other customers;
protect confidential information and security-sensitive material; and
not require disclosure of another customer’s information, credentials, secrets, or information that would materially weaken service security.

The parties will cooperate in good faith regarding reasonable scope, timing, confidentiality, and cost.

12. Return and deletion

Conf2Git

Customer controls the destination GitHub repository and may remove generated GitHub content using GitHub controls.

Removing a Conf2Git mapping removes applicable Conf2Git mapping and associated bounded application records through the supported application lifecycle, but does not automatically delete content previously published to GitHub or uninstall the GitHub App.

Confluence page bodies and eligible image bytes used for conversion are processed transiently and are not retained as an application content store in Atlassian Forge hosted storage.

All covered products

For SQR, the fixed retention, supported deletion, account redaction and delivered-data rules in the SQR processing schedule apply.

Upon uninstall, Atlassian controls the lifecycle of Forge-hosted application data according to its then-current platform data-retention and recovery rules.

At termination, Magnascale will delete or cause deletion of Personal Data it controls as Processor when required by the Agreement, Customer’s lawful instructions, and Applicable Data Protection Law, except where continued retention is legally required.

13. CCPA and similar United States privacy laws

To the extent Magnascale processes Personal Information on behalf of Customer under a United States state privacy law that recognizes a service-provider, contractor, or processor role:

Magnascale will process that information only for the limited and specified purposes described in the Agreement and this DPA;
Magnascale will not sell Customer Personal Information;
Magnascale will not share Customer Personal Information for cross-context behavioral advertising;
Magnascale will not retain, use, or disclose Customer Personal Information outside the direct business relationship except as permitted by applicable law and necessary to provide the service; and
Magnascale will provide reasonable assistance required for Customer to meet applicable statutory obligations.

14. Customer obligations

Customer is responsible for:

ensuring that it has a lawful basis and all required notices, rights, and permissions for Customer Data it directs the applicable covered service to process;
for Conf2Git, configuring access to Confluence and GitHub appropriately;
for Conf2Git, limiting synchronization to content that may lawfully be transmitted to the selected GitHub repository;
responding to Data Subjects in its capacity as Controller; and
complying with Applicable Data Protection Law applicable to its use of the service.

15. Conflict and liability

This DPA is part of the Agreement.

If this DPA conflicts with another provision of the Agreement concerning processing of Personal Data, this DPA controls to the extent of that conflict, except where the applicable Atlassian Marketplace agreement is required to control.

The liability provisions and limitations applicable under the Agreement also apply to this DPA except to the extent Applicable Data Protection Law prohibits such limitation.

16. Changes

Magnascale may update this DPA where necessary to reflect changes in law, regulatory guidance, lawful transfer mechanisms, or the technical operation of either covered service.

Material changes will be dated and made publicly available.

If a change materially reduces Customer’s data-protection rights during an active subscription, it will apply only to the extent permitted by the Agreement and Applicable Data Protection Law.

17. Contact

Privacy and DPA inquiries may be sent to:

privacy@magnascale.com

Additional privacy information is available at:

https://magnascale.com/privacy-policy/

SQR processing schedule

Field	SQR processing details
Provider and service	Magnascale Inc.; Service Quality Review for Jira Service Management.
Customer instructions	Authorized setup, sampling, assignment, review, reporting, calibration, coaching release, confirmed corrective work, optional AI assistance and supported data lifecycle actions.
Subject matter	Evidence-based quality review of selected Jira Service Management requests and related review history.
Nature/purpose	Read authorized Jira/JSM sources; store cited excerpts and review records; process authorized review judgments and reports; run requested assistance and bounded maintenance.
Data subjects	Administrators, managers, reviewers, reviewed agents, cited source authors, and other people mentioned in customer-selected evidence or notes.
Personal data	Account IDs; source references; quotations and bounded AI evidence; user-written assessments, notes, findings and coaching; configuration, audit, assignment and operational identifiers. Content may include any personal data customers place in source text.
Duration	While used, subject to fixed expiry, redaction and supported deletion. Drafts up to 90 days and unused AI material up to 30 days, capped by parent expiry; submitted/period history ordinarily expires 365 days after the first period closure/cancellation. Calibration expires at most 365 days after reveal/cancellation, capped at 730 days from creation and by earlier parent/source expiry. Separate long-open/finding bounds, asynchronous cleanup and the content-free program closure marker also apply. See the full retention table.
Platform	Atlassian Jira/JSM and Forge compute, hosted storage, queues, logs and Forge LLMs. No separate app-configured external AI service or vendor application backend.
Support and licensing	Separate vendor-controlled records. Contact form: name, email, topic and message through Cloudflare/Turnstile → SES → Google Workspace. Marketplace may provide customer contact, licensing/evaluation/subscription and transaction information. Vendor correspondence and licensing/business records follow the shared necessity-based retention rule. The owner operates from Canada; SES uses Ohio and provider processing can occur in the US/other countries under the shared transfer framework. SQR support uses only the Magnascale owner and the documented providers. See privacy and runtime and browser data handling; the fixed app retention table does not govern these vendor records.
Customer troubleshooting logs	Customer-controlled log data remains under customer instructions and this DPA when handled for troubleshooting; downloading it does not turn it into independent vendor-controlled business records. No routine customer-log archive. Delete temporary downloaded customer logs promptly after troubleshooting and retain only minimal bug/fix or product-improvement findings without raw logs or unnecessary identifiers. Atlassian manages platform logs under its separate lifecycle.
Technical measures	Magnascale’s owner confirms that applicable online and offline data and copies, including temporary customer troubleshooting material, are encrypted. This describes an owner-confirmed operating practice, not an independently audited certification or verification of provider, account, device, or encryption-key settings. Temporary troubleshooting copies are processed and stored while they are in use. Tenant and actor checks; intersection of QA/source access; bounded evidence; citation validation; no autonomous AI action; safe logging; redaction and fixed retention. See SQR security controls.
Requests and deletion	Organizational administrators/managers use supported access/export/deletion controls; account erasure follows reported closures. App deletion differs from Atlassian soft-delete/backups; supported deletion does not recall previously delivered files or Jira work items. Genuine closed-account and full-site erasure have not been verified in native platform acceptance; retention completion under ongoing activity remains a post-launch validation item. Uninstall follows Atlassian’s then-current platform lifecycle; its 21-day recovery-request window is not a physical-deletion maximum. See Atlassian’s hosted-storage lifecycle.
Delivered data	Customer/recipient controls browser-held recovery state, downloaded CSVs and Jira corrective work already created. App deletion does not recall them.

Customer remains responsible for lawful source selection, Jira permissions and app program memberships. Adding an app role does not grant Jira source access.

Provider notice address: Magnascale Inc., Suite 411, 4033 Hurontario St, Mississauga, ON L4Z 0B8, Canada.