License Sentinel privacy policy
1. What this policy covers
License Sentinel is an app for Atlassian Jira. It helps a site's administrators find accounts that hold a Jira license but show no recent activity, so they can review them before a renewal. This policy explains what the app does with data, who sees it, and what choices you have.
It covers data the app handles on behalf of a customer organization (sections 2 to 8) and the messages you send us for support (section 10). It does not cover Atlassian's own handling of data, which is described in Atlassian's privacy policy.
2. Who is who
- The customer is the organization that installs the app. For the account activity data described below, the customer decides why and how it is used, so the customer is the controller (the party responsible for it).
- We, Alzhan Group LLC, process that data only on the customer's behalf, to run the app. We are the processor (service provider).
- Atlassian hosts the app and its storage (see section 6).
If you are a person whose account appears in the app, the organization you work for is your first point of contact about this data (see section 9).
3. What data the app handles
About the app's setup
| Data | Why |
|---|---|
| A switch that records an administrator chose to start collecting | So nothing is read before the administrator agrees |
| The administrator's chosen stale threshold (days) and, if they enter them, a monthly price per account for a cost estimate and the Atlassian organization ID (used only to build links to Atlassian Administration) | To decide which accounts count as stale, and to show an estimate and links |
| Technical state of the scans (times, a paging token, a status) | To run the hourly scan reliably |
| A daily row of counts (how many accounts are active, stale, unknown or kept, and the threshold in force), kept for 400 days | To show an administrator how the numbers change over time. It holds no account ID or name. |
About people with accounts on the Jira site
| Data | Why |
|---|---|
| The person's Atlassian account ID (an identifier, not a name) | To tell accounts apart |
| The date they last did something in Jira, and in Jira Service Management, and the more recent of the two. "Did something" means created an issue, commented, logged work or changed an issue. | To decide whether the account looks in use |
| A status (active, stale or unknown) worked out from those dates | To show administrators which licenses look unused |
| A keep mark, set only when an administrator presses Keep on the account (for example a service account), with an optional reason chosen from a fixed list (such as service account, shared account, contractor or executive) and an optional end date | To leave that account out of the stale count and the savings estimate until the end date. The app has no free-text field, so it holds no note an administrator typed. |
How the app finds those dates. It reads the history of the issues in the projects it is allowed to browse. For each issue it looks at who created it, who commented, who logged work and who changed it, and when. It keeps only an account ID and a date. Because Jira hands over the comments and changes whole, the text of an issue's content reaches the app for the moment it takes to read the author and the time, and is then discarded. It is not stored, logged or sent anywhere.
Shown but not stored. A person's display name is looked up from Jira when an administrator opens the dashboard and is shown on screen only. The names of projects are compared to tell the administrator which ones the app cannot read, and are not stored. A CSV export is built on the administrator's screen from the list shown, to copy from, and is not stored by the app.
4. What the app does not collect
- It does not store names or email addresses.
- It does not store any Jira content, such as issue titles, descriptions, comments, attachments or project data.
- It does not read Confluence, and it does not see logins, page views or what anyone looked at.
- It does not collect passwords, API keys or any other credential.
- It does not use advertising, analytics or tracking tools, and sets no cookies of its own.
5. How we use the data
Only to provide the app: to show a site's administrators which accounts have recent activity and which do not, so they can decide whether to review or remove a license. We do not use the data for marketing, we do not sell it, we do not build profiles from it, and we do not use it to train models.
The result is an estimate, and it is about license management only. Someone who only views issues, boards or dashboards leaves no trace, so a stale account shows an absence of recorded activity, not that the person does not use Jira. The app is not a tool for judging a person's work or for monitoring staff, and administrators should use it only to review licenses.
6. Where the data is kept and who it is shared with
All of this data is kept in Atlassian's Forge hosted storage, inside the customer's own Atlassian site. We do not run our own servers or databases. Atlassian encrypts it at rest and keeps each customer's data separate from other customers'. Forge storage follows the data residency of the Atlassian product it is attached to.
The app makes no connection outside Atlassian. It reads Jira through Atlassian's own product interfaces, and reports stored account IDs to Atlassian for privacy purposes (section 8). We do not share the data with anyone else. No customer data is sent to us.
Our app's technical logs (counts such as how many issues were read, and error codes) are available to us through Atlassian. They do not contain account IDs, names, dates or issue content.
7. How long we keep it
| Data | Kept until |
|---|---|
| A person's record | The person is no longer an active member of the site. It is then removed automatically after two refreshes of the people list have missed them. |
| A person's record, if Atlassian reports that the account was closed or that its personal data changed | Removed within the next weekly privacy check |
| A keep mark | Until the administrator removes it, its end date passes, or the person's record is removed |
| The daily counts | 400 days |
| All app data, when the app is uninstalled | Atlassian deletes it after its standard retention period for uninstalled apps. See Atlassian's description of the Forge data lifecycle. |
An administrator can remove all of the app's data at any time with the Delete all data button in the app, which also stops the app reading anything until the administrator chooses to start again, or by uninstalling the app.
8. Security and your account data
The app holds no credential of any kind, and needs no API key. It asks for the smallest set of permissions it needs: to store its own data, to list the site's people, to read issues, and to report account IDs to Atlassian. Our security policy describes the safeguards in detail.
To meet Atlassian's privacy rules, the app regularly tells Atlassian which account IDs it holds, and erases the data of any account Atlassian says is closed or has changed.
9. Your rights
Depending on where you live, you may have the right to know what personal data is held about you, to have it corrected or erased, to object to its use, and to complain to a data protection authority.
- Because the customer is the controller, please start with the organization you work for. Its administrators can see the data in the app and can have it removed.
- You can also write to us at hello@alzhangroupllc.com. We will help the customer respond, or pass your request on to them.
- Data about a closed Atlassian account is erased automatically.
10. Messages you send us
If you contact us for support, we keep the message and the details you choose to send, to help you and to improve the app. We keep support records for as long as they are needed to help you, and for up to 24 months after the last message. For these messages we decide how the data is used, so we are the controller. We do not share them except with providers who help us run support, which at present is Atlassian (our support portal runs on Jira Service Management) and our email provider, Google Workspace.
11. Transfers outside your country
The app does not move customer data to servers of ours. The data stays in Atlassian's Forge storage under Atlassian's own arrangements for hosting and international transfers. Support messages are handled in the United States.
12. For organizations using the app
The dates the app keeps describe when employees and contractors last created, commented on or changed something in Jira. In some countries and workplaces, using that may need notice to staff, a legal basis, or consultation with employee representatives. That is the customer's responsibility. The app is designed for license management only, not for monitoring individual people, and it keeps only the latest date per person, not a history. We recommend telling staff that account activity dates are used to manage licenses.
If your organization needs a data processing agreement, ask us at hello@alzhangroupllc.com.
13. Changes to this policy
If we change this policy in a way that affects how data is handled, we will update the effective date above and tell customers through the app's Marketplace listing.
14. Contact
Alzhan Group LLC, Houston, Texas, United States
Privacy and support: hello@alzhangroupllc.com