Skip to content
Dueline
Menu

Dueline privacy policy

Last updated 29 October 2026

Dueline (“the app”) is a Jira Cloud app built on Atlassian Forge and published by Sugar Systems, SIA (registration number 40203386400), Stirnu street 5-29, Riga, LV-1035, Latvia (“we”, “us”). This policy explains what the app does with data when a Jira site administrator installs it. What the Lineset websites and the app’s waitlist keep is in the Lineset privacy policy, which covers every app.

What the app does

Dueline shows which EU incident reports are due under GDPR, NIS2, DORA and CRA, by when and to whom, on a Jira work item, and keeps the record of what was sent. A person on the response team qualifies a work item and records each report as sent; Dueline works the deadlines out from the times they give. It sends nothing to any authority. It reads Jira as the person using it and writes only its own reminder comments on a work item, never a field.

Data the app processes

  • What a person enters or picks when they qualify a work item or record a report: when the organisation became aware, which rules apply and the answers that choose their reports (a high risk to people, when a DORA incident was classified as major, which CRA case it is), when a report was sent, when a fix became available or an incident was handled, and an optional reference, such as the authority’s case number, of at most 100 characters. Nobody should put personal data in a reference.
  • The work item’s id, to keep its record apart from every other. Dueline never stores a work item’s summary, description or any of its fields. The register reads each qualified work item’s key, summary and space from Jira, as the person looking, to list it, and keeps none of it.
  • Account ids of the person who qualified or recorded something, and of the people on the response team, so it can say who did what and who may. A person’s display name is read from Jira when the panel is shown and is never stored.
  • The viewer’s own permissions and groups, read from Jira as that person, to tell whether they are a Jira administrator or on the response team.
  • Jira’s group list, to offer groups on the settings page.
  • What a reminder says, which the app writes as a comment on the work item (below): the report’s name, its deadline and the response team’s people and groups. A comment lives in Jira like any other, and Jira shows it as written by the app, “Dueline”.

The app processes no data from outside your Atlassian site.

Data the app stores

Everything the app stores lives in Forge storage, which is hosted by Atlassian inside the Atlassian cloud. The app stores five things:

  1. Settings chosen by your Jira administrators, one entry per site: which rules apply, the country of the main establishment, the DORA weekend rule and trust service provider answers, and the response team (account ids of people, and the id and name of each group).
  2. A record for each qualified work item, keyed by the work item’s id: its qualification (when the organisation became aware, when it was qualified, by whom, and the answers above) and a list of events: each report recorded as sent, a fix available, an incident handled. The list is append-only. A correction is a new event that names the one it corrects; nothing is edited or deleted, so the record shows what was entered and when. A record holds at most 200 events.
  3. The scope a person last showed in the register, under their account id: spaces, a saved filter’s id or a JQL search they wrote (which may name a person). It is kept for 90 days from its last change, then Forge storage deletes it.
  4. What was reminded, under its own key per work item, dueline:reminded: and the work item’s id: the report’s id, whether it was the reminder before the deadline or the one after, the deadline’s time, and when the comment was posted. It holds no summary, reference or person, is kept apart from the record above (a reminder is not evidence), and holds at most 60 entries.
  5. The review request: once the app is listed on the Atlassian Marketplace, a small “Review Dueline ⭐” link to its reviews shows on its settings page, and in a banner on its register pages until each person dismisses it, from each person’s fifth open. For each person the app stores their account id, how many times they opened it, counted up to five, and whether they dismissed the banner. Until the listing is public nothing is stored.

Deadlines are never stored: they are worked out again from these times each time the panel is shown. The app stores no passwords, no API tokens and no data about people beyond what is listed above.

Where data goes

Nowhere. The app makes no network requests to any service outside Atlassian. It has no servers of its own, loads nothing from a CDN, uses no analytics service or tracking, and shares nothing with third parties. It is built to meet Atlassian’s “Runs on Atlassian” requirements, Atlassian’s designation for apps with no data egress.

Atlassian counts how often each part of the app is used on your site, such as a page opened or a button pressed, and shows us those counts in its developer console. A count is a number under a name: it carries no work item data and names no person. Your Atlassian administrators can turn the counts off for the app in Atlassian Administration (Apps, Connected apps, the app’s Details).

Retention and deletion

  • Settings and work item records are kept until the app is uninstalled: a record of what was reported is the point of keeping it, and the app never deletes one. What was reminded is kept until the app is uninstalled too, and is never read for anything but not posting a reminder twice.
  • A reminder comment is a normal Jira comment. It stays on the work item, and is deleted like any comment: by someone who may delete it in Jira, or with the work item.
  • When the app is uninstalled from your site, Atlassian keeps its storage for 28 days, then deletes all of it. A reinstall starts empty: the old storage comes back only if you ask us within 21 days of uninstalling, and we ask Atlassian to restore it.
  • We hold no copy of your data, so there is nothing for us to delete or return on request; your Atlassian administrators control it entirely.

Permissions the app asks for

  • read:jira-work: to read the viewer’s own permissions, to tell whether they are a Jira administrator, and the key, summary and space of the qualified work items they may browse, for the register and the gadget.

  • read:jira-user: to read the viewer’s own groups, a person’s display name and Jira’s group list, for the response team.

  • storage:app: to keep the settings and each work item’s record in Forge storage.

  • write:jira-work: for one call only, to post its own reminder comment on a work item (POST /rest/api/3/issue/{issueIdOrKey}/comment), as the app, so Jira shows it as written by “Dueline”. On Jira Service Management the comment is internal, so a customer never sees it. The app edits no field of a work item and changes no setting in Jira, and an admin can switch the reminders off in the settings.

Your rights and contact

The apps keep no copy of your Jira data outside your Atlassian site, so requests about it are handled by your Atlassian site administrators. For the waitlist, or questions about this policy, an app or the websites, contact our support site or by email at support@lineset.dev. You can also complain to Latvia’s Data State Inspectorate (Datu valsts inspekcija).

Changes

We will update this page when an app’s data handling changes and note the date above. Material changes are also announced in that app’s Marketplace release notes.