Privacy policy

Last updated: 06.09.2026

1. Who we are

Visual Dependencies is a Jira app published on the Atlassian Marketplace under the trading name Uption.

The data controller is:

Vitalii Bobak

Via Carlo Bonino 5, 29122 Piacenza (PC), Italy

VAT / Partita IVA: 01935490332

Email: [email protected]

We are established in Italy. Our lead supervisory authority is the Garante per la protezione dei dati personali (garanteprivacy.it).

2. What the app does

Visual Dependencies renders dependency relationships between Jira work items as an interactive graph. It is built on Atlassian Forge and runs inside Atlassian's own infrastructure.

3. Data the app processes inside your Jira site

When you use the app it reads work item data from your Jira site in order to draw the graph. This can include:

  • Atlassian account identifiers, display names, and avatars of assignees, reporters, and watchers
  • Work item keys, summaries, statuses, and the link relationships between them
  • Project and board identifiers

The app also stores presets — your saved filters, layouts, and view configuration — using Forge storage (KVS). These may reference account identifiers where you have filtered by a person.

This data does not leave Atlassian's infrastructure. It is stored within your Atlassian organisation's selected data residency region. We do not copy it to servers of our own, and the app does not transmit work item data to any external service.

Usage metrics. The app records anonymous counters of feature usage (for example, how many times a dependency graph is rendered) using Atlassian's Forge custom metrics. These are numeric counts only. They contain no personal data, no user or account identifiers, and no information about what your work items contain. They are not transmitted outside Atlassian's infrastructure.

For this processing we act as a data processor. Your organisation is the data controller. Our obligations are set out in our Data Processing Addendum, available on request from [email protected].

4. Data we collect directly

For the following we act as a data controller.

4.1 Support enquiries

If you contact us through our support portal at https://uption.atlassian.net/servicedesk/customer/portal/3 or by email, we collect your name, email address, and whatever you include in your message. We use this only to answer you and to fix the problem you reported.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in supporting our product, and performance of a contract (Art. 6(1)(b)) where you are a paying customer.

Retention: 24 months after the enquiry is closed.

4.2 Licence and billing contacts

Atlassian is the merchant of record for paid Marketplace apps. Atlassian handles all payment processing — we never see your payment card or bank details. Atlassian provides us with licence records containing the name, business email address, organisation, and licence status of the technical and billing contacts for each paid licence.

We use this to provide support, to notify customers about material changes to the app, and to meet our tax and accounting obligations.

Legal basis: performance of a contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)).

Retention: for the life of the licence, then as required by Italian tax law.

4.3 Website

Our marketing website at https://uption.company uses Google Analytics (provided through Firebase) to count visits and see which pages are useful. It is off by default. Nothing is loaded and no analytics cookies are set unless you choose "Yes, I Accept" on the banner shown on your first visit.

If you accept, Google Analytics sets two cookies in your browser:

  • _ga — distinguishes one browser from another. Expires after 2 years.
  • _ga_HMHHW1DJZ5 — keeps analytics session state. Expires after 2 years.

Your choice itself is stored in your browser's local storage under cookiesAccepted. That is not a cookie and is never transmitted to us or to anyone else; it only tells the page what you picked last time. You can change your mind at any time using the "Opt-Out of Analytics" link in the footer, which appears once you have accepted.

We serve our own web fonts, so the website makes no third-party requests before you have made a choice.

We do not operate analytics or tracking inside the app itself.

5. What we do not do

  • We do not sell personal data.
  • We do not use your data to train machine learning models.
  • We do not send marketing emails to licence contacts without separate, specific consent. Consent is never bundled into this policy.
  • We do not use automated decision-making or profiling.

6. Who else sees the data

For the app and support data:

Atlassian (Atlassian Pty Ltd and affiliates) hosts the app, stores its data, operates our support portal, and processes payments. Atlassian's privacy policy: atlassian.com/legal/privacy-policy

Zoho (Zoho Corporation B.V.) provides our business email hosting. Email correspondence, including support enquiries, is stored in Zoho's European data centres in Amsterdam and Dublin.

Our team. Visual Dependencies is built by a small team. Team members located in Ukraine and Canada may access support correspondence and licence contact details in order to provide support and fix bugs. They are bound by written confidentiality and data-processing commitments and act only on our documented instructions.

For our marketing website only:

Google provides hosting (Firebase) and website analytics for https://uption.company. Google has no access to app data, support enquiries, or customer licence information. Analytics cookies are set only where you consent. Transfers to the United States rely on the EU-US Data Privacy Framework.

We do not disclose personal data to anyone else, except where required by law.

7. International transfers

Ukraine is not covered by a European Commission adequacy decision. Transfers of personal data to our team members in Ukraine are made under the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), together with supplementary technical and organisational measures including access controls, multi-factor authentication, and minimisation of the data made available.

Canada benefits from a partial adequacy decision. We nonetheless apply the same Standard Contractual Clauses to transfers to our team member in Canada.

A copy of the clauses is available on request from [email protected].

8. Security

  • All data in transit is encrypted using TLS.
  • App data is stored in Forge storage and inherits Atlassian's encryption at rest.
  • The app requests only the minimum Forge scopes required for its functionality.
  • Access to support and licence data requires multi-factor authentication and is limited to team members who need it.
  • We do not maintain copies of customer work item data outside Atlassian's infrastructure.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, and the right to data portability.

If you are a user of a Jira site where Visual Dependencies is installed, your employer or the organisation operating that site is the controller of your work item data. Please direct your request to them; we will assist them in responding.

For support enquiries and licence contact data, contact [email protected]. We will respond within one month.

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali or with the supervisory authority where you live or work.

10. Uninstallation and deletion

When the app is uninstalled from a Jira site, Forge storage associated with that installation — including all presets — is deleted. We action personal data deletion events received through Atlassian's APIs.

To have support correspondence deleted, email [email protected].

11. Changes to this policy

We may update this policy. Material changes will be announced on the Marketplace listing and, where we hold licence contact details, by email to the technical contact.

Change of legal entity. We are in the process of incorporating a company. Where our business is transferred to a successor entity as part of a reorganisation, incorporation, merger, or sale of assets, personal data covered by this policy may be transferred to that successor, which will be bound by commitments no less protective than those in this policy. We will update this policy and notify licence contacts before any such transfer takes effect.

12. Contact

Vitalii Bobak — [email protected]

Security enquiries: [email protected]

Support: https://uption.atlassian.net/servicedesk/customer/portal/3