Skip to content
Lineset
Menu

Data processing agreement

Last updated 21 October 2026

This agreement applies whenever a Lineset app processes personal data for a customer. The customer is the organisation whose Jira site the app is installed on; it is the controller. Sugar Systems, SIA (registration number 40203386400), Stirnu street 5-29, Riga, LV-1035, Latvia (“we”) is the processor. It applies from the day the app is installed, with nothing to sign, and forms part of the terms under which the customer uses the app. Where they conflict on personal data, this agreement wins. A customer who wants a signed copy can ask us through our support site or by email at support@lineset.dev.

What is processed

  • Subject and purpose: running the app the customer installed: reading Jira data as the person using the app, working out what the app shows, and keeping the short-lived copies that make it fast.

  • Duration: while the app is installed, then until Atlassian deletes its storage, 28 days after it is uninstalled.

  • Personal data: Atlassian account ids, and what Jira returns to the person using the app: work item summaries, assignees, and in Logline worklogs with their authors’ names and time zones.

  • Data subjects: the people who use the app and the people named in the work items it reads.

  • Where: only in Atlassian’s cloud, through Atlassian Forge, in the data residency region of the customer’s site. What each app keeps, and for how long, is in its privacy policy:

  • Sumline

  • Logline

  • Blockline

What we do

  1. Only as instructed. We process personal data only to run the app as the customer and its administrators set it up. The app and its settings are the customer’s documented instructions. We tell the customer if we think an instruction breaks data protection law.
  2. Confidentiality. Only the people who build and release the apps can reach the accounts that do it, and they are bound to keep what they see confidential. Forge gives us no access to an app’s storage on a site except through the app itself, and the apps never send it to us.
  3. Security. We keep the measures in our information security policy. The data stays on Atlassian’s infrastructure, encrypted at rest and in transit by Atlassian.
  4. Sub-processors. The customer authorises Atlassian as our one sub-processor, under Atlassian’s Forge terms and data processing addendum. We announce any new sub-processor on our security page and in the app’s Marketplace release notes at least 30 days before it starts. A customer who objects can stop using the app before then.
  5. Rights requests. The data stays in the customer’s Atlassian site, so its administrators answer requests from the people it concerns. We help where they need us, and pass on any request that reaches us.
  6. Breaches. We tell the customer without undue delay after we become aware of a personal data breach, as our incident response plan says, with what we know and what we are doing, and keep them informed until it is closed.
  7. Assessments. We give the customer the information it reasonably needs for a data protection impact assessment or a question from a supervisory authority.
  8. Deletion. When the app is uninstalled, Atlassian keeps its storage for 28 days, then deletes all of it. We hold no copy, so there is nothing more for us to delete or return.
  9. Showing we comply. We answer reasonable written questions about how we process personal data, and make available what is needed to show we meet Article 28 of the GDPR.

Transfers

We move no personal data anywhere. It stays in Atlassian’s cloud in the site’s data residency region, under Atlassian’s own transfer terms.

Changes

We will update this page when the agreement changes and note the date above, and announce a material change in each app’s Marketplace release notes.