Privacy policy

Last updated: 12 October 2026

Who we are

Vouchline Access Reviews for Jira ("Vouchline", "the app") is published by RETEK ("we").

Legal entity: RETEK Kamil Gromadzki, Administracyjna 2B, 11-710 Piecki, Poland, VAT ID PL7422153037.

Contact for privacy matters: privacy@retek.app General support: support@retek.app

The short version

• Vouchline runs entirely on Atlassian Forge, inside your Atlassian site.
• We have no servers and receive none of your data. The app makes no network connection to us or to any third party.
• The app reads permission metadata from Jira. It does not read work items, comments, attachments or worklogs, and it changes nothing in Jira.
• The app stores account identifiers, not people's names.

Roles

For the data the app processes inside your Atlassian site, your organisation is the controller. The data is stored and processed on Atlassian's infrastructure under your agreement with Atlassian. We do not have access to it and therefore do not act as a processor of it in the ordinary operation of the app.

We are a controller only for the data you give us directly — for example when you write to our support address.

What the app reads from Jira

• projects, project leads, project roles and who holds them
• permission schemes and their grants
• groups and their members
• for accounts that appear in the above: account identifier, account type, whether the account is active, which Jira products it can access, and whether it administers the site or Jira

Account display names are read during a scan only to derive two flags (the name matches a service-account pattern; the account is a deleted account). The name itself is not stored.

What the app stores

All of it in Forge hosted storage belonging to your installation:

Justifications are free text. The app keeps them word for word, because they are part of the audit evidence and are included in the hash chain. If a reviewer writes a person's name in a justification, that name is stored. The reviewer screen asks reviewers to describe people by role, not by name.

Names shown on screen and in downloaded files

When a screen needs to show who an account is, the app asks Jira for the display name at that moment, on behalf of the person looking at the screen. A user who is not allowed to see user details in Jira sees identifiers instead. These names are not written to the app's storage.

The files an administrator downloads — PDF report, CSV files and Package (JSON) — do contain display names, so that they can be read by an auditor. Once downloaded, these files are under your control and outside the app.

Logs

Application logs contain technical identifiers, counters and timings. They do not contain names, email addresses or justification text. Logs are stored by Atlassian as part of the Forge platform.

Where the data is

In Atlassian's Forge hosted storage. Vouchline keeps all of its data there and nowhere else, so the data follows the data residency location of your Atlassian site: if your site is pinned to a region, the app's data is stored in that region, and it moves together with the site if you change the location. This is handled by Atlassian; there is nothing to configure in the app.

Data we do not collect

No analytics, no telemetry, no error-reporting service, no cookies of our own, no advertising identifiers. The app loads no resources from outside Atlassian.

How long data is kept

• Snapshots: the ten most recent are kept; older ones are removed automatically. A snapshot that a review refers to is kept as long as the app is installed.
• Reviews and the decision register: kept as long as the app is installed. A closed review cannot be edited or deleted from inside the app; this is what makes it usable as evidence.
• On uninstall: the app loses access to its data immediately and Atlassian deletes it according to its Forge data lifecycle.

Requests from individuals

Because the data is held in your Atlassian site and we cannot access it, requests from your users about their data should be addressed to your organisation.

Two things to know when handling such a request:

• The app stores an account identifier, not a name. When Atlassian closes an account, Jira stops returning its name, and the app shows the identifier only.
• A closed review is immutable by design. An individual entry cannot be removed from a decision register without invalidating it. Removing the data means uninstalling the app (which removes all of it) after downloading the evidence you are required to keep.

The app does not copy profile data — names, email addresses, avatars — from Atlassian into its storage, so there is no stored profile data to update or erase when a user changes or closes their Atlassian account.

Support requests

If you contact us, we process your name, email address and whatever you include in the message, in order to answer you. Please do not send evidence packages or screenshots containing personal data unless we ask for them. We keep support correspondence for 24 months after the last message in a conversation and then delete it. The legal basis is our legitimate interest in answering you and in being able to refer to earlier conversations (Art. 6(1)(f) GDPR). Our email is hosted by OVHcloud in the European Union.

Your rights

For the data we hold as a controller — support correspondence — you can ask us for access, correction, erasure or restriction, and you can object to the processing. Write to privacy@retek.app. You also have the right to lodge a complaint with a supervisory authority; ours is the President of the Personal Data Protection Office (UODO) in Poland.

Changes to this policy

We will publish changes on this page and update the date above.