Privacy policy · Safe Tree Copier

In short

The app runs entirely on Atlassian’s platform (Forge). I don’t run any servers or databases for it, and it sends nothing anywhere outside Atlassian.
It copies pages, labels and attachments between spaces on your own Confluence site. Page content and attachment files pass through it in memory and are never stored.
It stores copy plans, run reports and saved jobs in your site’s app storage. Run details are deleted after 30 days by default.
It never deletes or trashes Confluence content, and never changes permissions.
There are no analytics, no tracking, no cookies and no ads, and I never sell or share your data.

Who this policy covers

This policy covers the Confluence Cloud app Safe Tree Copier (“the app”), offered on the Atlassian Marketplace by Christian Ortiz, an individual publishing as Christian Ortiz Studio (“I”, “me”). It explains how the app handles data on the Confluence sites where it’s installed, and how I handle the information Atlassian and you share with me.

It doesn’t cover Confluence itself, or Atlassian’s own processing of your data, which is governed by Atlassian’s privacy policy.

Questions about this policy: support@christianortiz.studio.

Where the app runs

The app is built on Atlassian Forge, which means its code runs on Atlassian’s infrastructure and its data is kept in Atlassian-hosted app storage that belongs to your Confluence site.

The app declares no external servers and makes no network requests outside your Confluence site. Its screens load nothing from third parties: no scripts, fonts or images from elsewhere.
I have no database or server of my own that holds your data.
Data residency. Forge hosted storage follows your site’s data residency: if your Confluence site is pinned to a location (such as the EU, US, Australia or Germany), the app’s stored data is kept there too, and it moves with your site if the site is migrated. The app keeps all of its data in Forge hosted storage and has no remotes or outbound requests, so it qualifies without any extra setup. Atlassian aims to run the app’s code in the same location but doesn’t guarantee it, so processing in memory may occasionally happen elsewhere within Atlassian’s infrastructure.

What the app reads and writes

To plan and carry out a copy, the app works only within your Confluence site:

It reads the source pages and page tree, their content, labels and attachments, and the destination space and parent page.
It checks permissions: that the person copying can view the source and create pages in the destination. For scheduled jobs, it checks the job owner’s permissions before every run.
It writes to the destination: it creates pages, updates existing pages as new versions when you choose that option, and adds labels and attachments.
It never deletes or trashes pages, and never changes space or page permissions.

Page content and attachment files are held in memory only while they’re being copied. They are never written to the app’s storage or logs.

What the app stores, and for how long

Everything below is kept in your site’s Atlassian-hosted app storage.

Saved jobs: the job’s name, the source and destination (page and space IDs, plus the source page title and destination space and parent names so the job list can show them), the copy options and schedule, and the Atlassian account ID of the job’s owner, used to check their permissions before scheduled runs. Kept until the job is removed or the app is uninstalled.
Page mappings for saved jobs: which source page was copied to which destination page, and the source version last copied, so repeat runs update the right pages. Kept until the job is removed or the app is uninstalled.
Run records: when each run happened, how it was started, the account ID of the person who started it (empty for scheduled runs), a snapshot of the options used, the source page title and destination names, the page being worked on, counts, status and a plain-language error summary. For saved jobs, the most recent 20 runs per job are kept by default. A run that wasn’t saved as a job is deleted after 30 days by default.
Copy plans: for each page in a run, its IDs, title and position in the tree, version, labels, planned action and any error message. Deleted after 30 days by default.
Attachment checks: for each attachment, its ID, file name, type, size and whether it arrived intact. Not the file itself. Deleted after 30 days by default.
App settings chosen by your site admin.

A site admin can change how long run details are kept (from 1 to 365 days) and how many runs per job are kept (from 1 to 100) in the app’s settings. A daily clean-up applies these limits.

Personal data

Atlassian account IDs are personal data. Page titles and file names may also contain personal data that your team wrote into them; the app handles them only as described here.

The app doesn’t look up, show or store people’s names, email addresses or profile pictures. Only account IDs are kept.

Once a day the app sends the account IDs it stores to Atlassian’s personal data reporting service, as Atlassian requires. When Atlassian reports that an account has been closed, the app replaces that account ID with deleted-user wherever it’s stored, in saved jobs and in run records, and switches off the scheduled jobs that person owned. Their jobs’ settings and run history stay, without the account ID, until a job is removed or its history expires.

Logs

Atlassian gives me access to the app’s logs and usage metrics so I can keep it working. The app writes only counts, run statuses and short error messages to its logs, for example how many expired rows the daily clean-up removed, or that a storage call failed. It never logs page content, attachment contents, page titles, file names or account IDs. If a background copy hits an unexpected platform error, Atlassian’s runtime records that error so the copy can be retried from its last checkpoint.

Who’s responsible for your data

For the content and account IDs the app handles on your Confluence site, your organization is the controller and I’m the processor: the app processes them only to do what your users ask. The data processing agreement sets out the terms and applies automatically.
For the licensing and contact details Atlassian shares with me, and for support emails you send me, I’m the controller.
Under the California Consumer Privacy Act, I’m your organization’s service provider. I don’t sell or share personal information.

What I receive, and what I don’t

I don’t receive your Confluence content. The app has no way to send it to me.

When your organization installs, evaluates or buys the app, Atlassian shares licensing information with me, which can include your site address, organization name, and the names and email addresses of technical and billing contacts. I use it only to manage licenses, provide support and send notices that matter (such as security notices), and I keep it only as long as I need it for those purposes and for my legal and tax records.

If you email me for support, I keep your message and email address to help you and to improve the app. I’ll delete them on request unless I need to keep them by law.

I don’t sell, rent or share your data with anyone. The only sub-processor is Atlassian, which hosts the app’s code and storage on Forge under the Forge Data Processing Addendum. There are no other third parties. I’d disclose information only if the law required me to.

Security

The app asks Atlassian only for the access it needs to copy: reading and creating pages, reading and adding attachments and labels, reading spaces and the page tree, checking page permissions, and its own storage.
Every copy is previewed and confirmed by a person before anything is written, and a plan that went stale since its preview writes nothing. Scheduled runs only do what the job’s owner is allowed to do.
Previews read Confluence as the person copying. The copy itself is written by the app, only after those permission checks pass.
Security contact: email support@christianortiz.studio with Security in the subject line. I acknowledge security reports within two business days.
I don’t hold security certifications of my own, such as SOC 2 or ISO 27001. The app’s code and data run on Atlassian’s infrastructure, which Atlassian’s own audits cover.
If I learn of a security incident that affects your data, I’ll tell affected customers without undue delay.

Deleting your data

Remove a saved job in the app to delete its settings, page mappings, run history and reports. This never touches pages in Confluence.
Shorten retention in the app’s settings, or let run details expire after 30 days.
Uninstall the app to remove all of its data from your site. Atlassian then deletes the app’s storage under its data lifecycle for Forge hosted storage: the data is soft-deleted when the app is uninstalled and kept for 28 days, then permanently deleted. Reinstalling doesn’t bring it back on its own; within the first 21 days it can be reconnected to a reinstalled app only if your organization asks for that. I don’t keep a copy. Pages the app created stay in your Confluence site; they’re your content.
Ask me at support@christianortiz.studio with your site address, and I’ll help and confirm what was removed.

Your rights

Depending on where you live, you may have the right to access, correct, delete or move your personal data, or to object to how it’s used. Because the app’s data lives in your organization’s Confluence site, the quickest route is usually through your site admin, but you can always email me and I’ll respond within 30 days.

For content in your Confluence site, your organization decides what’s stored and why; the app processes it only to carry out the copies your users ask for. The data processing agreement applies to that processing.

Children

The app is a business tool and isn’t directed at children.

Changes to this policy

If I change this policy, I’ll update the date at the top of this page. If a change affects how your data is handled in a meaningful way, I’ll also say so in the app’s release notes or Marketplace listing before it takes effect.

Contact

Christian Ortiz, publishing as Christian Ortiz Studio
support@christianortiz.studio