This Privacy Policy explains how CITIES BUBBLES collects, uses, discloses, and protects personal data in connection with the "TriageQuant" application for Atlassian Jira Cloud (the "Software" or "App"). It is incorporated by reference into, and supplements, the Software License and Subscription Agreement. Where the Software processes personal data on behalf of a customer ("Licensee"), the Data Processing Addendum also applies and prevails over this Policy for any conflict regarding such processing.
| Company name | CITIES BUBBLES |
|---|---|
| Registered office | Kaunas, Lithuania |
| Company code | 306704904 |
| General contact | info@citiesbubbles.com |
| Privacy / data protection contact | support@citiesbubbles.com |
| Data Protection Officer | Not appointed — see contact above |
| EU/UK representative | Not applicable |
If you have any questions about this Policy or how we handle personal data, contact us at support@citiesbubbles.com.
2.1. This Policy applies to personal data processed in connection with: (a) installation, configuration, and use of the Software within a Licensee's Atlassian Jira Cloud instance; (b) communications with us (for example, support requests); and (c) our Atlassian Marketplace listing and related sales/billing operated through Atlassian.
2.2. This Policy does not cover: (a) the Atlassian Platform itself (Jira Cloud, Atlassian Marketplace, Atlassian account, billing), which is governed by Atlassian's privacy policy and terms; (b) the AI Provider that the Licensee selects and configures, which is governed by that provider's own terms and privacy policy (see Section 7); or (c) any third-party websites or services we do not control.
3.1. As a processor. For personal data contained in Licensee Data (issue content, configuration entered by the Licensee, and generated DNA Score records processed inside the Licensee's Jira instance), the Licensee is the data controller and we act as a data processor acting on the Licensee's documented instructions. This processing is governed by the DPA.
3.2. As a controller. We act as an independent data controller for a limited set of data we determine the purposes and means of, including: (a) account and contact details of the Licensee's administrators and billing contacts; (b) support correspondence; (c) aggregated, non-persistent usage metrics and telemetry (see Section 5.3); and (d) records we must keep for legal, tax, and security purposes.
4.1. The Software is built on the Atlassian Forge platform and runs natively within the Licensee's Jira Cloud instance. Configuration data and DNA Score records are stored within that native tenant environment (Forge storage and/or Jira issue properties) on Atlassian's infrastructure.
4.2. We do not transmit or store a separate persistent copy of Licensee Data on our own infrastructure, except as strictly necessary to perform a support request that the Licensee initiates, and only for as long as needed to resolve it.
4.3. Because the Software runs on Forge, the data residency of Licensee Data follows the Licensee's Atlassian/Jira data-residency configuration. We do not override Atlassian data-residency settings.
4.4. AI analysis (default mode). Where the default AI mode is used, issue content and configuration are transmitted to a model we self-host on our own AWS infrastructure in the European Union (Milan, Italy — AWS eu-south-1) for analysis, and are processed transiently in memory only. We do not persistently store this content, the prompts, or the outputs on that infrastructure (see Section 7).
| Data | Examples | Purpose | Legal basis |
|---|---|---|---|
| Issue content submitted to the analysis feature | Summary, description, comments, fields selected for scoring | To generate the DNA Score and related output | Performance of the Agreement / Licensee instruction |
| Company-context configuration | Prompt variables, rules, per-project overrides entered by the Licensee | To configure how scoring is performed | Performance of the Agreement / Licensee instruction |
| DNA Score records | Score values (0/25/50/75/100), rationales, timestamps | To display and persist scoring results | Performance of the Agreement / Licensee instruction |
Personal data may appear in this content only to the extent the Licensee chooses to include it. The Licensee controls what is entered into Jira and submitted to the feature. Licensee warrants that it will submit (upload) to Jira only personal data for which the data subject has provided consent in accordance with Article 6(1)(a) of the GDPR. The Licensor shall not be liable for any personal data breach to the extent that such breach results from the Licensee's upload of personal data or the Licensee's instructions or actions.
| Data | Source | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Administrator / installer identifiers (e.g., Atlassian account ID, email, name) | Atlassian Forge / Marketplace | Provisioning, licensing, security, communications | Contract (Art. 6(1)(b)); for security, legitimate interests (Art. 6(1)(f)) |
| Billing/transaction metadata | Atlassian Marketplace | Manage subscriptions and licensing | Contract (Art. 6(1)(b)) |
| Support contact details and correspondence | The Licensee | Provide support under the Agreement's support schedule | Consent, contract (Art. 6(1)(a) and (b)) |
We rely on Atlassian to process payments, invoicing, refunds, and currency conversion; we do not receive or store full payment-card data.
5.3.1. We may use native in-app messaging or telemetry to collect aggregated, non-persistent usage metrics and optional customer-survey input to improve product quality, track engagement, and inform the roadmap.
For the Paid Edition, the Software can produce security audit logs stored within the Licensee's tenant. We may also process limited diagnostic/error logs to keep the Software secure and reliable, protecting the Software against cyber incidents or other damage. Legal basis: legitimate interests (GDPR Art. 6(1)(f)) and, where applicable, legal obligation (GDPR Art. 6(1)(c)).
7.1. The Software offers AI analysis in two modes, and your privacy position differs between them.
7.2. Default mode — Licensor-managed model. By default, issue content and the company-context configuration are sent to a large-language model (Mistral) that we self-host on our own infrastructure on Amazon Web Services (AWS) in the European Union (Milan, Italy — AWS eu-south-1). In this mode: (a) we act as a processor on the Licensee's behalf (governed by the DPA); (b) AWS is our sub-processor (infrastructure/compute only); (c) the model runs within our controlled AWS environment, so the model provider (Mistral) does not receive the data; (d) data is processed transiently in memory and is not persistently stored (no retained prompts or outputs); and (e) because processing occurs in the EU, there is no transfer outside the EEA for this path.
7.3. Optional mode — your own AI model (Paid Edition). If the Licensee chooses to configure its own AI provider/model (endpoint, API key, model), issue content and configuration are sent directly to the provider the Licensee selects. In this mode the Licensee is the sole controller of that transfer, that provider is not our sub-processor, and the Licensee is responsible for the provider's terms, privacy, retention, lawful basis, and any international-transfer mechanism.
7.4. We do not use Licensee Data to train any AI model. AI output (DNA Scores and rationales) is automatically generated, probabilistic, and may be inaccurate, incomplete, or biased. It is decision-support only and does not constitute professional, legal, financial, or strategic advice.
We disclose personal data only to:
9.1. Licensee Data hosted on Forge stays within the Licensee's configured Atlassian data residency. For the default AI mode, processing occurs on our AWS infrastructure located in the European Union (Milan, Italy — AWS eu-south-1), so this path does not involve a transfer outside the EEA.
9.2. Where we (or our sub-processors) process personal data outside the European Economic Area (EEA), the UK, or other relevant jurisdiction, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or an adequacy decision. Details and copies are available on request via support@citiesbubbles.com.
| Category | Retention |
|---|---|
| Licensee Data (in Jira / Forge storage) | Retained in the Licensee's tenant until the Licensee deletes it or uninstalls the Software; controlled by the Licensee |
| Support correspondence | Up to 24 months after the request is closed |
| Account/licensing records | For the Subscription Term and up to 7 years afterwards where required for tax/legal purposes |
| Aggregated telemetry | Kept in aggregated, non-identifying form; not tied to an identifiable person |
On uninstall, Licensee Data stored in Forge/Jira is removed in accordance with Atlassian's Forge data lifecycle. The Licensee may export DNA Score data before uninstalling, as described in the Agreement.
11.1. The Software relies on Atlassian Forge security controls, including encryption in transit and at rest provided by the platform, tenant isolation, and Atlassian-managed infrastructure.
11.2. We maintain technical and organizational measures appropriate to the risk, described in the DPA's Technical and Organizational Measures annex. For the Paid Edition, we maintain participation in applicable Atlassian marketplace security programs (e.g., Bug Bounty and Cloud Fortified) as stated in the Agreement.
11.3. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
12.1. Subject to applicable law (including the GDPR), individuals may have the right to: access; rectification; erasure; restriction; objection; data portability; and to withdraw consent where processing is based on consent.
12.2. If your personal data sits in Licensee Data, the Licensee is the controller, and you should direct your request to the Licensee. We will assist the Licensee in responding, as set out in the DPA.
12.3. For data where we are the controller (Section 3.2), contact support@citiesbubbles.com. We will respond within the timeframes required by applicable law.
12.4. You may lodge a complaint with your supervisory authority. In Lithuania, this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), www.vdai.lrv.lt.
The Software is a business tool not directed to children and is not intended for use by individuals under the age of 16 (or the applicable age of digital consent). We do not knowingly collect data from children.
We may update this Policy from time to time. Material changes will be communicated through the Atlassian Marketplace listing, the App, or other reasonable means, and the "Last updated" date will be revised. Continued use after the effective date of an update constitutes acceptance.
CITIES BUBBLES · Kaunas, Lithuania
Privacy contact: support@citiesbubbles.com
General contact: info@citiesbubbles.com