STAGECRAFT FOR JIRA

Privacy Policy

Last updated: October 24, 2026.

This policy explains what personal data the Stagecraft for Jira app ("Stagecraft", "the app") processes, why, where it is kept and for how long. Stagecraft is published by Veloxy Labs, Rua Dona Vitorina Menk 125, Osasco, São Paulo, 06075-380, Brazil ("Veloxy Labs", "we"). Contact: support@veloxylabs.com.

1. Who is responsible

Your organization (the Atlassian customer that installs the app) decides how Stagecraft is used and is the controller of the data in its Jira site. Veloxy Labs builds the app and acts as a processor for the data the app stores on your behalf. Stagecraft is a Forge app: it runs on Atlassian's infrastructure, and Veloxy Labs does not operate servers that receive your Jira data.

2. What the app stores

The app stores data in Atlassian Forge's hosted storage (Forge key-value storage, Forge secret storage and Forge SQL) inside your Atlassian cloud site, and in properties of your Jira work items and spaces:

  • Configuration: flows, stages, checklists, templates, agents, display and integration settings.
  • People, by Atlassian account ID. References to people are stored as account IDs, never as names or email addresses: in role and permission settings, in who completed a stage, marked a checklist item, answered an approval or forced a move, in the audit of configuration changes, and in the model of the activity comment the app keeps on a card. Names are looked up from Jira at the moment they are shown and are not stored. Free text people write (a reason for a forced move or a rejected approval, evidence, an agent's suggestions, a page draft) is stored as written and may mention someone.
  • Work item data the app derives: the stage each card is in, what is pending, the stage history and, for the Indicators, the card key, summary, dates and stage history.
  • A Rovo agent's request while it waits: the prompt (the agent's instructions and the card content it may read) in a property of the work item, removed when the answer arrives.
  • Agent runs: the agent, the card, the result and suggestions an AI agent produced, the cost reported by the AI provider.
  • Secrets you provide: API keys and tokens for services you connect (for example an AI gateway, a repository host, an MCP server, n8n). They are kept in Forge secret storage, encrypted by Atlassian, never shown back in full and never written to logs.

3. Data that leaves Atlassian (only if you turn it on)

By default Stagecraft sends nothing outside Atlassian. A Jira admin can turn on Integrations › Call services outside Atlassian and connect services. Then, and only for what is configured:

  • AI providers you choose (through Portkey or your own endpoint): the card's key and summary, the card content an agent is set up to read (description, acceptance criteria, comments, pull requests, Confluence pages if allowed) and the agent's instructions. The provider is chosen and contracted by your organization. If your organization turns on Portkey's log storage, Portkey keeps the prompts and answers under your Portkey account.
  • Repository hosts (GitHub, GitLab, Bitbucket): branch and pull request names and descriptions built from the card.
  • n8n (n8n Cloud or your own host): the card's key, ID, summary, work type, status and link; the stage change (stage name, previous and new status) and the display name of who moved the card; the card fields the flow action is set to send, as Jira returns them (a person field carries that person's display name, and their email when Jira shows it); and, only when the action is set to send them, the IDs of the pending items and the assignee and reporter with their account ID and display name. The app does not store these names. Card text sent to any of these services (a description, a comment) may also mention people by name.
  • MCP servers you add: the requests an agent makes to their tools.

Rovo agents run inside Atlassian. Confluence on the same site is not external.

4. Why

To run your workflow rules (stage gates, checklists, approvals), to show who did what in each stage, to compute delivery indicators, and to run the AI agents your organization configures. We do not sell data, use it for advertising, or use it to train AI models.

5. How long

  • The live activity comment model of a card: 30 days after its last change, and immediately when the card is deleted.
  • Configuration audit: 1 year. Agent runs: 180 days. Indicator snapshots and history: 400 days.
  • Configuration and the card's stage state: while the app is installed.
  • In your Jira site, after uninstall: what the app wrote into your site stays there until your admins delete it or the work item or space is deleted: the comments it posted; the card's stage state in a work item property (cairn.state, with the account IDs of who moved the card and marked items) and its other cairn.* properties (including a Rovo request still waiting, with the card text it carries); the license state on spaces that have a flow (cairn.license); the labels and synced fields it set; and, in Confluence, the pages it published. Before uninstall the app tries to remove its validator from your workflows; on a site with many workflows some may be left for an admin to remove.
  • When the app is uninstalled, Atlassian keeps its Forge hosted storage for 28 days (a reinstall can be linked back to it if your organization asks within 21 days) and then deletes it. When a site is deleted for good, the app's data is deleted with it.

6. Closed Atlassian accounts

Stagecraft uses Atlassian's personal data reporting API every week. When Atlassian reports an account as closed, the app, in the same run, removes it from permissions, roles and caches, and replaces its account ID everywhere else (audit, stage history, card states, activity comments, template maintainer) with a random pseudonym shown as "Closed account A3F9C1". The pseudonym keeps the history readable without the person's ID. This is pseudonymisation, not full anonymisation: Jira's own history of a work item still lists the former user, and a flow definition that named the person keeps the ID until an admin edits it (the app shows a warning).

7. Who processes the data

  • Atlassian (hosting of the app and its storage, under Atlassian's own terms and privacy policy).
  • Services your organization connects (section 3), under your organization's agreements with them.
  • Veloxy Labs staff do not have access to your Jira site or the app's storage. We see only the app's operational logs, kept by Atlassian for 30 days, which contain technical identifiers (work item keys, space IDs, and an account ID when something about that person fails), never names, email addresses, card content or Jira's responses.

8. Where

Everything in section 2 is in Forge hosted storage (key-value, secret and SQL storage), which Atlassian's data residency covers: the app's data is kept in the same location as your Jira site (for example the USA, the EU, Germany, the UK, Australia, Canada, India, Japan, Singapore, South Korea or Switzerland) and moves with it when an admin moves the site.

Not covered by that residency: the data sent to services your organization turns on (section 3), which goes where those services are; and the app's operational logs (technical identifiers only, kept by Atlassian for 30 days).

9. Your rights

People in your organization exercise their rights (access, correction, deletion, objection) through your organization, which controls the data. We help your organization respond. Contact support@veloxylabs.com. Depending on where you are, laws such as the GDPR (EU), the UK GDPR and the LGPD (Brazil) apply.

10. Security

See our security policy. Report a vulnerability to support@veloxylabs.com with the subject "Security".

11. Changes

We publish changes to this policy on this page and update the date at the top.