Privacy policy

Effective date: 12 November 2026

Draft: this page is still being finalised and may change before Spacewright goes on sale.

1. Who we are

Spacewright is made and sold by an independent developer in Lithuania (individual activity registration, individuali veikla, in progress). In this policy "we" and "us" mean:

Name

Matas Vytautas Kinderis

Address

Alytus, Lithuania (full postal address on request: support@spacewright.app)

Registration

Individual activity (individuali veikla) registration in Lithuania is in progress; the certificate number will be added here.

Email

support@spacewright.app (write "Privacy" in the subject)

We have not appointed a data protection officer. Contact us at the address above about anything in this policy.

2. Who is responsible for what

• The Spacewright app runs on Atlassian's Forge platform inside your organisation's Confluence Cloud site. Your organisation decides which spaces are copied and who may use the app, so your organisation is the controller of the Confluence content and of the data the app keeps about it. Atlassian hosts that data under its own agreements with your organisation.
• We do not routinely access the app's data. It stays in Atlassian's storage for your site and the app never exports it. Where we do process some of it on your organisation's behalf, for example in error logs (section 5) or when you send it to us for support, we act as a processor and only use it to provide and fix the app.
• We are the controller for support emails, licence and billing information we receive, and this website (sections 6 to 8).
• We, not Atlassian, are responsible for how Spacewright processes data. Atlassian's own processing is covered by Atlassian's privacy policy.

3. Data inside the Spacewright app

While copying, Spacewright reads page content and attachment files from the source space and writes them into the new space. This happens in the app's working memory on Atlassian's platform. The app does not save page text or files anywhere of its own. It stores the following in its own database (Forge SQL) for your site:

Spacewright also writes into Confluence itself, where it stays under your organisation's control until someone deletes it:

• the new space and the copied content;
• the copy report page in the new space;
• the template settings, saved as a property of the template space, with the time they were last saved;
• a marker on each space Spacewright creates (job ID, source space key and time), used to resume a copy safely.

Personal data in the app is limited to Atlassian account IDs (not names or email addresses; names are shown by Confluence when a screen is displayed) and anything people type into template values, space names or space descriptions, such as a client contact's name. Page titles can also contain names if your teams write them there. The app stores account IDs only in job records and audit-log lines (and briefly in the progress note of the privacy report, see the table), so they too are deleted after 30 days. If a link that could not be switched contains an account ID (for example a search for content by one person), the account ID is replaced by "[account ID]" before the note is stored.

Reporting account IDs to Atlassian. As Atlassian requires of apps that store account IDs, once every 7 days Spacewright tells Atlassian's personal data reporting service which account IDs it holds and since when. This goes only to Atlassian, inside its platform. If Atlassian answers that an account has been closed, Spacewright erases what it holds about that person within the same run: their job records and the working data of those jobs are deleted, and their account ID is removed from audit-log lines (the line stays without it until it is deleted after 30 days). Spacewright stores no profile data, so when Atlassian reports that a profile changed there is nothing to update.

4. How long app data is kept

• Job records, working data and audit-log lines are deleted by an hourly clean-up 30 days after the job ends (finished, failed, cancelled, or stopped because the licence ended). A job that stopped without ending is deleted 30 days after its last activity. Because the clean-up runs every hour, deletion happens within about an hour after the 30 days are up. This includes page titles and IDs, dry-run lists, template values and account IDs.
• Monthly totals, templates and settings are kept while the app is installed. They contain no account IDs and no page titles or page IDs.
• The clean-up and the report to Atlassian also run when your licence has ended, as long as the app is installed.
• When your organisation uninstalls Spacewright, Atlassian deletes the app's stored data under its Forge data lifecycle: the data is first soft-deleted and kept only for Atlassian's retention period. If the app is reinstalled within 21 days, the data can be reconnected on request. We hold no copy of it.
• Content Spacewright wrote into Confluence (section 3) is not removed by uninstalling or by the clean-up, including report pages, which list page titles.

5. Error logs

When an unexpected error happens, the app writes a short line to its log: the type of error, the HTTP status, an error code and, for a Confluence error, the API route with content IDs removed. It does not log Confluence's error text, page content, page titles or template values; quoted text in other error messages is removed before logging. Background errors can also be logged by the platform.

These logs are stored by Atlassian. Atlassian lets the app's developer read them for your site unless your admin switches this off (in Atlassian Administration: Apps → Connected apps → Spacewright → Logs access). We use logs only to find and fix problems. How long logs are kept is decided by Atlassian.

6. Support emails

When you write to us we receive your name, email address, your organisation and whatever you put in the message or screenshots. We use it to answer you and fix problems. Legal basis: performing our contract with your organisation, and our legitimate interest in supporting our customers (GDPR Art. 6(1)(b) and (f)). We keep support emails for 24 months after the last message in a conversation, then delete them, unless we need them longer to deal with a legal claim. Emails to our spacewright.app addresses are forwarded by Cloudflare (Email Routing) to a Google (Gmail) mailbox.

7. Licence and billing information

Atlassian sells Spacewright and handles payments; we never receive card or bank details of customers. Atlassian shares with us information about licences and evaluations, such as the site, the licence type and dates and, where Atlassian provides it, the organisation's name and the contact person's name and email. We use it to manage licences, provide support, send important notices about the app (for example a security issue or a change to these terms) and keep accounts. Legal basis: contract, legitimate interests, and our legal obligations under Lithuanian accounting and tax law (GDPR Art. 6(1)(b), (c) and (f)). Accounting records are kept as long as Lithuanian law requires, generally up to 10 years; other licence information for as long as the licence is active and 24 months after.

We do not send marketing emails.

8. This website

This website uses no cookies, no analytics and no tracking. It loads no fonts, scripts or images from other companies. The hosting provider, Cloudflare (Cloudflare Pages), records technical logs (such as IP address, time and the page requested) to deliver and protect the site, under its own privacy terms.

9. Who we share data with

• Atlassian, which hosts and runs the app, its storage and logs, and handles sales and billing.
• Cloudflare for forwarding support email and hosting this website, and Google (Gmail) for the support mailbox.
• Our accountant and authorities, only where Lithuanian law requires it.

The app itself sends no data outside Atlassian. We do not sell personal data and do not share it for advertising.

10. Where data is stored and transfers

The app's data is stored by Atlassian's Forge platform in the same location as your Confluence site, and moves with it if your admin changes the site's data residency location. We do not move it anywhere else.

Support email and this website are hosted by the providers named above. Cloudflare and Google are based in the United States, so this data may be processed outside the EEA. Both rely on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses for these transfers.

11. Security

The app has no servers of its own; storage, encryption and network security are provided by Atlassian's platform. The app reads and writes Confluence with the permissions of the person using it. More detail is on the security page. If a security incident affects personal data, we will inform affected customers and Atlassian without undue delay, and the supervisory authority where the law requires.

12. Your rights

Under the GDPR you can ask us for access to your personal data, to correct or delete it, to restrict or object to its use, and to receive it in a portable form. Write to support@spacewright.app. We answer within one month.

For data inside the app on your organisation's Confluence site, your organisation is the controller, so please ask your Confluence admin first. We will help your organisation answer the request. When an Atlassian account is closed, Spacewright erases its data automatically (section 3).

You can also complain to a data protection authority. In Lithuania that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). You can also contact the authority where you live or work.

Spacewright is a business tool and is not meant for children.

13. Changes to this policy

If we change this policy in a way that matters, for example if the app starts storing new kinds of data, we will update the effective date above and tell customers through the Marketplace listing or by email before the change takes effect.