Privacy and Data Security
This page explains which data Flower processes, where it is stored and which rights you have. It covers the Flower apps for Jira and Confluence (Forge, “Runs on Atlassian”, and Data Center), the e-mails we send and this website.
Version 2.0 · last updated 11 November 2026
Summary
- Your process data stays in Jira. Process models, process instances and settings are stored in your Jira or Confluence site (Forge storage, Jira properties) or in your own Data Center installation.
- Flower for Forge runs on Atlassian. The app has no servers of its own. It sends no end-user data (names, e-mail addresses, work item content) out of Atlassian.
- Usage analytics can be switched off. Flower reports anonymous usage and errors to PostHog in the EU. A Jira administrator can switch this off in the Flower settings, on the Analytics tab.
- We know the contacts of your licence. The Atlassian Marketplace gives us the name, e-mail address, company and language of the technical and billing contact of every evaluation and licence. We use them for licence information and news about Flower. You can unsubscribe from every e-mail.
Part 1: Your data in Jira and Confluence
Flower for Jira and Confluence on Forge (“Runs on Atlassian”)
Flower for Forge runs entirely on Atlassian’s cloud platform:
- All Flower data (process models, process instances, settings, timers) is stored in Forge storage of your site and in Jira itself (work items, properties).
- The data follows the data residency of your Atlassian site, including a migration to another region. See Atlassian data residency .
- Flower operates no servers that receive or store your Jira data.
- The only connection to the outside is usage analytics (see Part 2). It is declared in the app manifest as analytics without end-user data, which is the condition of the “Runs on Atlassian” programme.
Flower for Jira Data Center
Flower for Data Center runs inside your Jira installation:
- All Flower data is stored in your Jira database. We have no access to it.
- If usage analytics are switched on, the browser of the user sends usage events and errors to PostHog (see Part 2). On Data Center these events can contain the Jira user’s account ID and display name, and error messages can contain text from the page. Switch analytics off on the Analytics tab of the Flower settings if this is not wanted in your organisation.
Access for support
We do not access your Jira site, your Data Center installation or your Flower data unless you grant us access for a support case.
Deletion
- Uninstall Flower: the Forge storage of the app is removed by Atlassian according to its data retention rules. Work items that Flower created stay in Jira, they belong to you.
- Delete your site: all Flower data in it is deleted with it.
- Data Center: the data stays in your database until you delete it.
Part 2: Privacy policy
Controller
BIT International CY Ltd
Anaritas 5, 8560 Peyia, Paphos, Cyprus
E-mail: [email protected]
What we process, why, and on which legal basis
| Data | Source | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| Licence data: site, licence type, hosting, evaluation and licence dates, company name | Atlassian Marketplace | Licence administration, support, statistics | Art. 6(1)(b) contract, Art. 6(1)(f) legitimate interest | Licence term plus 3 years |
| Contact data of the licence: name, e-mail address, language of the technical and billing contact and of the Atlassian Solution Partner | Atlassian Marketplace | Information about the evaluation and the licence, onboarding e-mails, news about Flower (newsletter) | Art. 6(1)(f) legitimate interest in informing users of our software; the EULA, section 10 | Until you unsubscribe or object, at the latest 3 years after the end of the last evaluation or licence |
| Usage analytics: which Flower features are used, errors, performance, browser and app version, the Atlassian site ID (cloudId) and the Atlassian account ID of the user; on Data Center also the display name | Flower app, if analytics are switched on | Find and fix errors, understand which features are used, improve Flower | Art. 6(1)(f) legitimate interest | 24 months |
| Website analytics without cookies (PostHog): page, referrer, campaign (UTM), clicks on Marketplace, template and meeting links, a daily changing server-side hash | this website | Understand how the website is used and which content leads to evaluations | Art. 6(1)(f) legitimate interest | 24 months |
| Website analytics with cookies (PostHog, Google Analytics), and the link token of our e-mails | this website, only with your consent | Recognise repeated visits; connect a visit from an e-mail to the contact record; connect a visit to what happens on our Marketplace listing (a pseudonymous identifier is passed with the link to the listing) | Art. 6(1)(a) consent | 24 months (PostHog), 14 months (Google) |
| Meeting bookings: name, e-mail, time, your message | Calendly | Demos and support calls | Art. 6(1)(b) | 12 months |
| Support requests | Flower Communication Hub (Jira Service Management) or e-mail | Support | Art. 6(1)(b) | 3 years after the request is closed |
We do not sell personal data. We do not make decisions based solely on automated processing that have legal or similarly significant effects for you.
E-mails and newsletter
As the technical or billing contact of a Flower evaluation or licence you may receive:
- Evaluation and licence e-mails: welcome and onboarding during the evaluation, a reminder before it ends, a note after it ended or when you bought or uninstalled Flower.
- Newsletter (at most monthly): new features, videos, process tips, BPMN and Jira know-how.
Every e-mail has an unsubscribe link. You can also object at any time at [email protected]. We keep a record that you unsubscribed so that you do not receive e-mails again. We measure whether e-mails are opened and links are clicked to improve them.
Website and cookies
This website sets a cookie to remember your cookie choice.
- Without consent (or until you choose) PostHog counts page views and clicks on links to the Atlassian Marketplace, templates and the meeting scheduler without cookies or local storage. PostHog derives a daily changing, privacy-preserving hash on its servers; it cannot recognise you on another day or on another website.
- With your consent PostHog stores an identifier in a cookie and local storage, so that repeated visits can be recognised, and Google Analytics is loaded.
- With your consent, a link from this website to our app on the Atlassian Marketplace also carries this pseudonymous PostHog identifier (parameter
partner_anonymous_id). Atlassian passes it back to us with the events of our Marketplace listing (page views, clicks, evaluations), so we can see which visits lead to an evaluation. It contains no name or e-mail address. Without consent the link carries no identifier. - If you came from a link in one of our e-mails, the link contains a token (
r=…) instead of your name, e-mail address or Atlassian account ID. With your consent this token connects the visit to your contact record, so that we see which e-mail content helps. The token is removed from the address immediately and is never used without consent.
Session recordings are switched off. You can change your choice at any time:
Videos from YouTube are embedded in privacy-enhanced mode (youtube-nocookie.com). The meeting scheduler loads Calendly.
Recipients (processors)
| Service | Purpose | Location |
|---|---|---|
| Atlassian | Marketplace (licence and contact data), Forge hosting of the app | EU/US, according to your data residency |
| PostHog | Usage analytics of the apps and this website, e-mails and newsletter | EU (Frankfurt) |
| Website analytics, only with consent | US | |
| Calendly | Meeting bookings | US |
| Vercel, Cloudflare | Hosting and delivery of this website (server logs with IP address, kept for a short time) | EU/US |
| Heroku (Salesforce) | Internal jobs that read the licence data from the Atlassian Marketplace | EU/US |
Transfers to the US are based on the EU-US Data Privacy Framework or on the EU Standard Contractual Clauses.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to withdraw a consent at any time with effect for the future. Write to [email protected].
You have the right to lodge a complaint with a supervisory authority, for example the Commissioner for Personal Data Protection of Cyprus or the authority of the country where you live or work.
Security
- Flower for Forge uses the security of the Atlassian platform: isolation of the app, encrypted storage, authentication through Atlassian.
- Flower for Data Center uses the permissions of your Jira: users see only the work items Jira allows them to see.
- Analytics events are filtered before they are sent: on Forge, no names, e-mail addresses, work item keys, titles or descriptions leave Atlassian.
Contact
Questions about privacy or security: [email protected] or the Flower Communication Hub .
Changes
| Version | Date | Change |
|---|---|---|
| 2.0 | 11 November 2026 | Forge and Data Center, usage analytics, licence contacts and e-mails, website cookies, privacy policy according to Art. 13 GDPR |
| 1.1 | 2025 | Data security statement for the Connect app |