Privacy policy

Gatetrail is provided by Johannes Seedorf, trading as Isavren, Nentschau 42, 95194 Regnitzlosau, Germany ("we"). Contact: support@gatetrail.com. Gatetrail is offered to businesses only. We, not Atlassian, are responsible for our processing of personal data described here.

What the app processes

The app runs on Atlassian's Forge platform inside your Atlassian cloud site. It processes SonarQube™ data that you send to it — project keys, branches, quality gate results, rule names, file paths, line numbers and finding messages — to create and maintain Jira issues, and stores configuration and ticket links in Atlassian-hosted storage. When an approver records a risk decision, the app stores the approver's Atlassian account ID, the decision and the reason; display names are looked up from Jira when shown and are not stored. As Atlassian requires, the app reports the stored account IDs to Atlassian regularly and removes the account ID from all decisions when the account is closed.

We have no access to this data; it stays in your site. Your organization decides what the app is used for and is the controller for this data.

Function logs (our own processing)

Atlassian provides us, as the app developer, with the function logs of all installations of the app. They are designed to contain as little personal data as possible: Jira issue keys, SonarQube™ rule keys, counts, short error reasons (for Jira errors, only the status code and the names of the fields concerned) and the platform's metadata, such as the site, the function and the time. SonarQube™ project keys, branch names, file paths and finding keys appear only as short hashes, salted per installation; the salt stays in your site, so we cannot reverse them. Branch names or file paths can contain names if your team uses them; in the logs they are pseudonymised this way. A name can still appear in exceptional cases, for example in a shortened error message.

These data do not come from you directly but from your organization's Jira site and SonarQube™ (Art. 14 GDPR). Categories of data subjects: users of your organization's Jira site and people whose names appear in branch names, file paths or error messages. The app shows a short notice with a link to this policy on its admin page, project page and ticket panel, and our Provider-Specific Terms to Atlassian's standard Marketplace End User Agreement ask your organization to make this policy available to its users.

We read these logs regularly to monitor the app: to detect errors, keep it stable and notice security problems. This is our own purpose; we process any personal data in the logs as controller, not on your organization's behalf. When you ask us for support, we read the logs of the installation concerned under the same rules.

Purpose and legal basis: our legitimate interest in operating a stable, secure and working app for all customers, and in fixing errors quickly (Art. 6(1)(f) GDPR). We keep the intrusion small:

• We read the logs only in Atlassian's developer console. We never export them and never copy log content into e-mails, tickets or any other system.
• The app logs as little personal data as possible; error texts are shortened before they are logged.
• We use the logs only for troubleshooting, stability and security, never for marketing or for analyses of individual customers.
• We keep no copies. Atlassian keeps the logs for 30 days and then deletes them.

Atlassian Pty Ltd, Australia, hosts the function logs for us as our processor under the Forge Data Processing Addendum, together with its sub-processors (list). Atlassian does not document where function logs are stored. They may be processed outside the European Economic Area, in particular in Australia and the United States. Safeguards: the EU Standard Contractual Clauses incorporated in that addendum (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

Log sharing is enabled by default; your site administrators can turn it off. You may object to this processing at any time, see "Right to object" below.

Licence and billing contact data (our own processing)

Atlassian sells the app on our behalf as our commercial agent and processes payments; we, not Atlassian, license the app to you. Through its licence reports, Atlassian shares with us the customer's company name, country, licence details (licence type, user tier, term, status) and the name and e-mail address of the technical and the billing contact.

We process these data as controller for our own purposes: administering the licence relationship, billing and accounting, providing support and sending service messages about the app, such as security notices and changes that affect the customer. This processing is ours, not processing on the customer's behalf, and is not covered by a data processing agreement. We send marketing messages only with consent. When we first write to a licence contact, we point to this policy.

Purpose and legal basis: for contact persons acting on behalf of a business customer, our legitimate interest in administering the licence relationship with that customer, billing, support and service information (Art. 6(1)(f) GDPR); where the customer is a sole trader acting in person, performance of the licence relationship (Art. 6(1)(b) GDPR). Art. 6(1)(c) GDPR applies only to records we must keep under commercial and tax law, such as invoices and accounting records. Source: Atlassian's Marketplace licence reports.

Retention: contact data is kept for the duration of the customer relationship and deleted or reviewed when it is no longer needed, at the latest when the relationship ends. Only records subject to statutory retention (§ 147 AO, § 257 HGB) are kept for the statutory period, currently up to ten years, and only with the data they contain.

Contacting us

When you write to support@gatetrail.com or security@gatetrail.com, we process your message and contact details to answer it, using our e-mail provider Hetzner Online GmbH, Gunzenhausen, Germany.

Purpose and legal basis: answering your request, as part of a contract or its preparation (Art. 6(1)(b) GDPR) or in our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the messages when the matter is closed, unless commercial or tax retention applies.

The relay

The relay runs in your CI, not with us. It talks only to your SonarQube™, to the app's web trigger on Atlassian, and, for back-sync, to Atlassian's API for your Jira site, as a service account of your organization. It is designed to send no data to us, and we do not operate, host or access it.

Where data is stored and who receives it

App data is stored in your Jira site and in Atlassian's Forge storage, in the location where Atlassian hosts your site; it follows your site's data residency, see data residency. Support and security e-mails are stored in Germany by our e-mail provider. Licensing data is stored in Atlassian's Marketplace systems and in our records in Germany.

Recipients: Atlassian (hosting of the app and its storage for your organization; hosting of the function logs for us as our processor, see above; Marketplace sales as our commercial agent), GitLab Inc. (hosting of this website), and our e-mail provider Hetzner Online GmbH (Germany), for e-mails you send us only. Countries outside the European Economic Area: for function logs, see "Function logs" above; for this website, see "This website" below.

Retention and deletion

Data in Jira stays under your control. The risk-decision log is kept as an audit record for as long as the app is installed. Sync state and overviews of branches without activity for 90 days, and of projects whose binding an administrator deletes, are removed automatically within days. Uninstalling the app deletes its stored data, including the decision log, according to Atlassian's data lifecycle; a reinstall starts empty. Atlassian retains the deleted storage for 28 days and then erases it; within 21 days, we can ask Atlassian to relink it to a new installation, only with your consent, but it may not be restorable. Export the decision log as CSV before uninstalling if you need it as a record.

This website

This website sets no cookies, uses no analytics and loads nothing from third parties. It is hosted on GitLab Pages by GitLab Inc., USA. To deliver the pages and protect them against abuse, GitLab logs IP addresses and request data and, according to GitLab, deletes them after 7 days.

Purpose and legal basis: our legitimate interest in delivering the website securely (Art. 6(1)(f) GDPR). GitLab Inc. states that it is certified under the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795).

Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Write to support@gatetrail.com. For data in your Jira site, please contact your organization's administrators first; your organization controls that data.

Contacting us is voluntary; without your message we cannot answer. The app data listed above is technically necessary for the functions your organization chooses; without it those functions cannot be used. There is no statutory requirement to provide data. We do not use automated decision-making, including profiling.

You may lodge a complaint with a supervisory authority. Our competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation; we will then stop unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Write to support@gatetrail.com.

For the function logs, we usually cannot tell from a hash or an issue key whose data a log line contains. We will therefore ask your organization's administrators to help us assess your objection, stop reading the logs of your site in the meantime, and answer you within one month.

Changes

We will update this policy when the app's data processing changes. We will inform customers and Atlassian of material changes before they take effect. Last updated: 25 October 2026.