Privacy Policy
AcceptDeck Privacy Policy
This Privacy Policy explains how Samir El Khaout, trading as AcceptDeck (“AcceptDeck,” “we,” “us,” or “our”), processes information when customers install or use AcceptDeck for Jira (the “App”), visit acceptdeck.com, or contact us. We are based in Casablanca, Morocco.
Hosting summary: AcceptDeck does not operate a separate customer database. App data is stored and processed within the customer’s Atlassian Jira site and Atlassian Forge hosted services. The public review interface is delivered through Blogger, but review content is requested directly from and submitted directly to an Atlassian Forge endpoint.
1. Scope and roles
This policy applies to the App, the public review interface at go.acceptdeck.com/p/app.html, and our website. The organization that installs the App generally determines what Jira information is placed in an acceptance package and why it is processed. For that customer-controlled content, the customer is generally the controller and AcceptDeck acts as its processor or service provider. We act as controller for business communications, support requests, security reports, and our Marketplace relationship.
2. Information processed
| Category | Examples | Purpose |
|---|---|---|
| Atlassian identifiers | Jira site and issue identifiers, Atlassian account ID, account type, and Marketplace license state | Authorize access, associate settings and decisions, and enforce licensing. |
| Acceptance-package content | Package title and summary, deliverable title and description, acceptance criteria, due date, attachment identifiers and metadata | Create, publish, display, and maintain an acceptance package. |
| Decision information | Approve/request-changes selection, comment, actor label or account identifier, timestamp, and revision | Record a traceable decision and optionally add it to the related Jira issue. |
| External review security data | Random page identifier, expiry time, salted password verifier, session-signing material, and rate-limit counters | Secure an external review page, expire or revoke access, and prevent abuse. |
| Preferences | Date and time display preference linked to an Atlassian account ID | Remember the user’s chosen display mode. |
| Communications | Name, email address, support messages, and security reports | Respond to requests and operate the service. |
| Technical data handled by platforms | IP address, browser information, request metadata, and platform logs | Deliver, secure, diagnose, and operate Atlassian Forge and Blogger services. |
The App does not request or store Atlassian passwords, personal access tokens, or customer API tokens. Every external review password is transformed into a salted verifier; the plaintext password is not retained by the App. Passwords are submitted in the unlock request body and are not included in review URLs.
3. How information is obtained
Information comes from the customer’s Jira site, users and external reviewers who interact with an acceptance package, Atlassian Marketplace and Forge context, and people who contact us. Customers decide which deliverables and attachments are exposed through an external review link and are responsible for having an appropriate legal basis and providing any necessary notices to their users and reviewers.
4. Purposes and legal bases
We process information to provide and secure the App, authenticate and authorize requests, record acceptance decisions, provide support, comply with law, prevent misuse, and improve reliability. Depending on the context, our legal bases may include performance of a contract, legitimate interests in providing and securing the App, compliance with legal obligations, and consent where required.
5. Storage, hosting, and international transfers
Acceptance packages are stored as Jira issue properties. App preferences, revision history, external-page secrets, and rate-limit records use Atlassian Forge hosted storage. Atlassian controls the underlying hosting, encryption, isolation, supported data-residency locations, migrations, backups, and infrastructure logs under its applicable terms and documentation. Forge processing and support may involve Atlassian and its subprocessors in multiple countries.
The static external review interface is hosted using Google Blogger. The review URL and normal web-request metadata may be visible to Google as the hosting provider. Review content is exchanged with the Forge endpoint and is not intentionally persisted by AcceptDeck in Blogger, cookies, analytics, advertising systems, or a vendor-operated database.
6. Sharing and subprocessors
We do not sell personal information or use App data for advertising. Information is disclosed only as needed to provide the App, comply with law, protect rights and security, or complete a transaction involving the business with appropriate safeguards. Our current infrastructure providers are listed on the Subprocessors page.
7. Retention and deletion
Acceptance packages and decisions remain in the customer’s Jira site until an authorized user removes them, the customer deletes the related Jira content, or a verified deletion request is completed. Revision history and preferences in Forge storage remain while needed to provide the App or until deletion. External-link credentials remain until the link is revoked, expires and is cleaned up, or is deleted in response to a verified request. Atlassian may retain backups and logs according to its own retention schedules and legal obligations.
Uninstalling the App may not immediately delete Jira issue properties or all Forge-hosted records. A Jira administrator may contact us to request deletion. We will verify authority, act without undue delay, and normally complete a valid request within 30 days, subject to legal requirements and Atlassian platform capabilities.
8. Security
We use least-privilege Forge scopes, Jira permission checks, randomized expiring and revocable review links, mandatory password protection, salted password verifiers, signed browser sessions, request throttling, input validation, and Atlassian-hosted storage. No method of transmission or storage is completely secure. More detail is available in our Security Statement.
9. Your rights
Depending on applicable law, a person may have rights to access, correct, delete, restrict, or object to processing of personal information, request portability, or complain to a supervisory authority. Users should first contact the organization that provided their Jira or review-page access because that organization generally controls the content. We assist customers with verified requests where required.
Send privacy and data-rights requests to privacy@acceptdeck.com. Include the relevant Jira site, a description of the request, and enough information to verify authority. Do not send passwords, access tokens, or unnecessary confidential content by email.
10. Children
The App is a workplace collaboration tool and is not directed to children. Organizations and users are responsible for ensuring they are legally permitted to use the App and submit information. We do not knowingly solicit personal information from children.
11. Changes
We may update this policy when the App, law, or our practices change. The effective date above identifies the latest version. Material changes will be communicated through this page or another appropriate channel.
12. Contact
Samir El Khaout, AcceptDeck
Casablanca, Morocco
General: contact@acceptdeck.com
Privacy: privacy@acceptdeck.com
Support: support@acceptdeck.com
