Privacy Policy

Last updated: 26 September 2026

Compliance Glossary production v6 processes Confluence content, account identifiers, optional GitHub content, and administrator-selected AI inputs. Core records use Forge KVS. Enterprise evidence uses Forge SQL and Object Store. This site loads Umami, GoatCounter, and Cloudflare Web Analytics. The sections below explain purpose, storage, retention, and rights.

This Privacy Policy applies to all Atlassian Confluence applications ("Apps") published by DailyMind LTD on the Atlassian Marketplace. It also applies to websites at teamkit.dev and its subdomains (collectively, "Services").

1. Who We Are

DailyMind LTD (the "Company", "we", "us") is the controller for website, Marketplace, and direct support data whose purposes we determine.

Roles for customer-managed app content depend on the customer's use and applicable Atlassian agreements. This policy does not replace those agreements.

• Company number: HE 439959
• Registered office: Idaliou 19, GALAXIA COURT, Flat/Office 201, 3021, Limassol, Cyprus
• Contact: [email protected]

2. Apps Covered

App	Platform	Data Storage
Compliance Glossary for Confluence	Atlassian Forge	Atlassian Forge KVS, SQL, and Object Store
Simple Glossary for Confluence	Atlassian Connect (Cloud)	Your Confluence instance
Simple Toolkit for Confluence	Atlassian Connect (Cloud)	Your Confluence instance
Advanced Task Report for Confluence	Atlassian Connect (Cloud)	Your Confluence instance

3. Data We Process Through Our Apps

3.1. Core App Data

Our Apps run on Atlassian Forge or Connect infrastructure. They access Confluence page content, user profiles, and space information to provide requested functions.

Compliance Glossary production v6 includes terminology workflows, scanning, enterprise evidence, GitHub processing, and Forge LLM functions. The relevant data boundaries appear below.

Core app data:

• Is processed within Atlassian's infrastructure
• Is not stored on DailyMind-operated app servers
• Is not used for advertising or behavioral profiling
• Is governed by Atlassian's Privacy Policy

3.2. Compliance Glossary — Additional Data

Compliance Glossary stores core records in Atlassian Forge KVS:

• Glossary terms, definitions, categories, and synonyms
• Term versions, timestamps, change reasons, and actor account IDs
• Page references, titles, versions, scan findings, usage verdicts, and scan history
• Finding resolutions, resolver account IDs, and justification text
• Roles, subscriptions, regulation-pack markers, baselines, connector metadata, and manifest-import metadata

Routine scans fetch Confluence page bodies and convert them to text during the request. Stored scan findings exclude context snippets and full page bodies.

KVS and SQL store Atlassian account IDs in actor fields. The administrator UI requests display names from Confluence when needed.

The UI keeps resolved display names in a bounded, in-memory browser cache. It does not persist that cache in browser storage.

App processing follows customer installation permissions and Forge controls. Customer-provided support material follows Section 3.6.

3.3. Enterprise Evidence and File Uploads

Enterprise evidence metadata uses Forge SQL. Canonical frozen content, archive parts, manifests, and uploaded file bytes use Forge Object Store.

A baseline freeze fetches the exact scanned Confluence revision. It stores the page's storage-format body as captured evidence in Object Store.

Supported uploads send file bytes and administrator-supplied retention data to Forge. Object Store keeps the file bytes in canonical base64 form.

SQL stores file names, MIME types, sizes, hashes, provenance, actor account IDs, extracted-text data, retention classes, and derived evidence records.

Uploads require a retention class and future date. Multipart KVS sessions retain that date, but permanent upload evidence does not attach it.

Current code validates upload retention inputs. It does not execute enterprise retention deletion.

3.4. Optional GitHub Connector

An administrator can enable the GitHub connector. The Forge backend then sends requests only to https://api.github.com.

The connector uses a customer-provided GitHub App installation. It reads configured repositories and allow-listed documentation paths at immutable commits.

• GitHub App private keys and webhook secrets are stored in Forge Secure Storage.
• Short-lived GitHub installation tokens remain in invocation memory.
• Allowed file text is processed in memory for terminology findings.
• Stored findings include repository, revision, path, line, term, and rule metadata.
• Findings exclude source text, provider payloads, private keys, webhook secrets, and installation tokens.
• Disabling a connector deletes its stored private key and webhook secret. Later queued work rechecks the disabled state.

3.5. Forge LLM Processing

Production v6 uses Atlassian-hosted Forge LLM for AI-assisted curation and approved-term usage classification.

• Curation begins only after an administrator selects undefined-term findings.
• Curation inputs include the space, candidate names, page references, and bounded page excerpts.
• Secret-like assignments are redacted before curation excerpts enter the prompt.
• Usage-classification inputs include page identifiers, titles, versions, approved terms, definitions, and bounded usage excerpts.
• Classification stores verdicts, timestamps, model identifiers, prompt versions, and checked-excerpt counts. It does not store those excerpts.
• Curation stores editable proposal metadata and page references. It excludes prompts, excerpts, page bodies, reasoning, and raw model responses.
• AI output cannot approve or publish terms. A selected proposal becomes a Draft under the normal review workflow.

3.6. Data We May Receive During Support

If you contact us for support, we may receive:

• Your name and email address
• Screenshots or descriptions that may contain Confluence content
• Error logs or diagnostic information you choose to share

We use this data solely to resolve your support request and delete it within 90 days of resolution.

4. Data We Collect on Our Websites

4.1. Template Downloads

Some product pages offer free CSV templates after you provide an email address and consent. We use Resend, Inc. to deliver them.

We do not add that address to a mailing list. DailyMind does not retain it beyond the delivery transaction.

Resend is US-based. Transfers from the EEA are covered by Standard Contractual Clauses.

4.2. Analytics

This page loads three analytics scripts:

• Umami loads from u.vigilcom.dev with a site identifier.
• Umami receives page measurements and custom scroll-depth events containing depth and path.
• At full depth, Umami also receives article-read-complete with the path.
• GoatCounter loads from gc.vigilcom.dev and uses gc-teamkit.vigilcom.dev/count for page counting.
• Cloudflare Web Analytics loads a beacon from static.cloudflareinsights.com.

Requests to these endpoints can include IP addresses, paths, referrers, user agents, and standard HTTP metadata.

This page does not configure analytics cookies. We do not use analytics for advertising or behavioral profiling.

The repository does not establish server retention periods, hosting regions, or operator identities for the vigilcom.dev analytics endpoints.

4.3. Third-Party Resources

Some other service pages may load Font Awesome from cdnjs.cloudflare.com, which Cloudflare operates.

Those requests can include IP addresses, referrers, user agents, and standard HTTP metadata. Cloudflare handles that data under its privacy policy.

4.4. Hosting

Our websites are hosted on Cloudflare Pages. Cloudflare may process IP addresses and request metadata during normal hosting operations.

Cloudflare handles hosting and Web Analytics data under its privacy policy.

5. Legal Basis for Processing (GDPR Art. 6)

Processing Activity	Legal Basis
App functionality (accessing Confluence data)	Legitimate interest (providing the service you installed)
Audit trail data (Compliance Glossary)	Legitimate interest (compliance functionality you opted into)
Compliance Glossary optional GitHub connector	Legitimate interest / contractual necessity (administrator-enabled repository terminology scanning)
Compliance Glossary Forge LLM functions	Legitimate interest / contractual necessity (term curation and approved-term usage classification)
Support requests	Contractual necessity / legitimate interest
Website analytics	Legitimate interest (site measurement)
Template delivery (email)	Consent (explicit opt-in at point of collection)

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We share data only with:

• Atlassian — as the platform provider (governed by their terms)
• GitHub — for an administrator-enabled GitHub App connector
• Atlassian-hosted Forge LLM — for curation and approved-term usage classification
• Analytics endpoints — the Umami, GoatCounter, and Cloudflare endpoints listed in Section 4
• Hosting and CDN — Cloudflare Pages and cdnjs.cloudflare.com on applicable pages
• Email delivery — Resend, Inc. (US) for template delivery only, when you explicitly request it
• Legal authorities — if required by law, regulation, or court order

7. International Data Transfers

Core and enterprise app records use Atlassian Forge infrastructure. This repository does not establish the selected Forge storage region for each installation.

The GitHub connector sends configured repository requests to GitHub. Cloudflare serves our websites through its network.

Section 4 states the known limits for website analytics hosting information.

8. Data Retention

• Core KVS data — no fixed deletion period is defined in code. Atlassian policies govern retained app data after uninstall.
• AI curation previews — uncreated previews expire after 14 days. A daily job deletes them and eligible empty runs.
• Created curation records — created candidates and resulting Draft terms remain normal app records.
• Manifest imports — administrators select one to 365 days. The disabled default is 30 days.
• Manifest deletion — a daily job deletes expired import metadata and findings. Administrators can delete an import earlier.
• GitHub credentials — reconfiguration replaces them. Disabling the connector deletes its private key and webhook secret.
• Enterprise baselines — freeze jobs record retention classes and dates. Automated expiry and uninstall deletion remain documented plans.
• Uploaded evidence — permanent records retain the class, but not the selected date. Current code does not execute expiry deletion.
• Support data — our policy deletes it within 90 days after request resolution.
• Website analytics — the repository does not establish server-side retention periods.

8.1. Closed Atlassian Accounts

A weekly Forge privacy job reports stored account IDs and latest timestamps to Atlassian's personal-data API.

When Atlassian returns a closed status, KVS actor references become account-deleted. The account is also removed from the manager list.

Enterprise SQL actor fields become [deleted-user]. Revision checks prevent the job from claiming an erasure after a conflicting update.

The privacy callback does not mutate Object Store objects. Broader object expiry and tenant-uninstall deletion remain plan-only.

9. Your Rights (GDPR)

If you are in the EEA, you have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate personal data
• Erasure — request deletion of your personal data
• Restriction — request we limit processing of your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Complaint — lodge a complaint with the Cyprus Commissioner for Personal Data Protection or your local supervisory authority

To exercise your rights, contact [email protected]. We respond under GDPR Article 12, normally within one month.

10. Security

We rely on Atlassian's security infrastructure for App data. Support and website operations use TLS, access controls, and periodic security review.

11. Children

Our Services are not directed at individuals under 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will appear on this page with a revised date.

Continued use of our Services after changes constitutes acceptance.

13. Contact

For privacy-related inquiries:

• Email: [email protected]
• DailyMind LTD, Idaliou 19, GALAXIA COURT, Flat/Office 201, 3021, Limassol, Cyprus

14. Supervisory Authority

Commissioner for Personal Data Protection of the Republic of Cyprus
www.dataprotection.gov.cy