Last updated: October 24, 2026.
This Data Processing Addendum ("DPA") is part of the agreement under which the customer ("Customer") uses Stagecraft for Jira (the "App"), published by Veloxy Labs, Rua Dona Vitorina Menk 125, Osasco, São Paulo, 06075-380, Brazil ("Veloxy Labs").
1. Roles
Customer is the controller of the personal data in its Atlassian site. Veloxy Labs is a processor of the personal data the App stores on Customer's behalf. Atlassian hosts the App and its storage under Atlassian's own terms with Customer.
2. Subject, nature and purpose
| Subject | The App's features: stage gates, checklists, approvals, the live activity comment, indicators and AI agents Customer configures |
| Nature | Storage and computation inside Atlassian Forge hosted storage in Customer's site; transmission to external services only when Customer turns them on |
| Purpose | Providing the App to Customer; no other purpose (no advertising, no sale, no training of AI models) |
| Duration | While the App is installed, then the retention in section 7 |
| Data subjects | Customer's Jira users and people its work items mention |
| Personal data | Atlassian account IDs; work item keys, summaries, dates and stage history; free text users write in the App (reasons, evidence, approval answers, agent suggestions, page drafts) |
| Special categories | None intended. Customer should not put them in the free text fields |
3. Veloxy Labs' obligations
Veloxy Labs will:
- process personal data only on Customer's documented instructions, which are this DPA, the agreement and Customer's configuration of the App;
- ensure that anyone it authorises to process the data is bound by confidentiality;
- apply the measures in section 5;
- help Customer, as far as the App allows, to answer data subjects' requests and to meet its obligations on security, breach notification and impact assessments;
- notify Customer without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting the App;
- make available the information needed to show compliance with this DPA, and allow audits by Customer or its auditor with reasonable notice, at most once a year unless a breach or a regulator requires otherwise;
- tell Customer if it believes an instruction breaks the GDPR, the LGPD or other data protection law.
4. Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Atlassian (the Forge platform) | Hosting of the App, its compute and its storage | The data residency location of Customer's site |
Services Customer connects to the App (its AI provider, repository host, n8n, MCP servers) are Customer's own processors under Customer's agreements with them, not Veloxy Labs' sub-processors. Veloxy Labs will give at least 30 days' notice on this page before adding a sub-processor, and Customer may object on reasonable grounds.
5. Security measures
- The App runs only on Atlassian's Forge platform; Veloxy Labs runs no server that receives Customer's data.
- Storage encrypted at rest and in transit by Atlassian; secrets in Forge secret storage, never shown back in full or logged.
- Least-privilege scopes; screens act as the user; where the App acts as itself it checks the person's own Jira permission and lists only what they can see.
- People stored by account ID only; closed accounts pseudonymised in the weekly run in which Atlassian reports them.
- Inputs validated and bounded; Forge SQL only with bound parameters.
- Logs with technical identifiers only, kept by Atlassian for 30 days; no Veloxy Labs access to Customer's site or storage.
- External calls off until a Jira admin turns them on.
- Dependencies checked on every build; vulnerabilities fixed within Atlassian's Marketplace security bug fix policy.
6. International transfers
The App's storage stays in the data residency location of Customer's site, and Veloxy Labs has no access to it. Veloxy Labs is established in Brazil. If it ever receives personal data of Customer (for example in a support request), data from the European Union reaches it under the European Commission's adequacy decision for Brazil (Implementing Decision (EU) 2026/179); data from Brazil stays under the LGPD; for data from other countries without such a decision (for example the United Kingdom or Switzerland) the EU Standard Contractual Clauses (Module 2, controller to processor), with the UK Addendum where it applies, are incorporated into this DPA by reference. Transfers to services Customer connects are Customer's decision.
7. Return and deletion
When the App is uninstalled, Atlassian keeps its hosted storage for 28 days (Customer may ask Atlassian to relink a reinstall within 21 days) and then deletes it. Veloxy Labs keeps no copy. What the App wrote into Customer's site (comments on work items, the work item properties cairn.state with account IDs and other cairn.* properties, the space property cairn.license, labels, synced fields and Confluence pages it published) belongs to Customer's site and stays there until Customer deletes it.
8. Liability and order of precedence
Liability under this DPA follows the limits of the agreement. If this DPA and the agreement conflict on personal data, this DPA prevails.
Contact: support@veloxylabs.com