Privacy Policy

Effective Date: 18 August 2026  ·  Last Updated: 18 August 2026  ·  Version: 2.0

This Privacy Policy describes how Tollgate (“the App,” “we,” “our”) collects, uses, and protects information when you use our Atlassian Forge application.

1. Information We Collect

1.1 Automatically Collected Information

Tollgate is an investment-governance overlay for Jira. The information it holds falls into two categories: governance records you create inside the App, and data it reads from your Jira (and, optionally, Confluence) instance to populate the App.

Governance records you create in the App:

• Work packages (name, status, RAG, owner, budget/baseline/forecast, schedule dates, linked Jira issue keys)
• Project status (overall RAG, phase, reporting cadence, confidence)
• The Investment Thesis / charter (business problem, target outcome, expected financial return, named PM, sponsor, steering-committee members, customer representative, supplier representative, adoption data, approval lifecycle state, close-out as-built outcome and return, lessons learned, BAU handover)
• The financial case — the cashflows and discount rate you enter, and the net present value, internal rate of return and payback computed from them
• Risks & Opportunities register entries (descriptions, scores, treatments, owner). A risk that occurs is recorded as a materialised risk and routes to a decision; there is no separate actions or issues register.
• Decisions log entries, each with an evidence of record. That evidence may be a pasted email body or a file you upload (up to 4 MB), and both persist in Forge storage. Pasted correspondence often names third parties, so treat it as you would any record containing personal data.
• Scope-change requests
• Steering committee attendees recorded on the business case, and links to minutes pages held in Confluence
• Close-out records and benefits-realisation verdicts
• A governance audit trail (who changed what, and when)
• App settings (governance group name, terminology, nominated editors)

User identifiers (see also Section 13):

• Atlassian accountIds and display names of the users you name in governance roles — for example the project manager, sponsor, steering-committee members, and work-package owners. Tollgate stores these identifiers because the named roles are part of the governance record itself.

External (non-Jira) participants:

• Where you record a sponsor, approver or seat holder who has no Atlassian account, Tollgate stores the full name, email address and job title you enter, so the governance record names who decided. Tollgate never sends email — it holds no scope that would allow it, and the address exists so you can copy the person yourself.

Data read from Jira:

• Projects, project lead, and users (via people-pickers: accountId, displayName, avatar)
• Permission checks (for example, mypermissions) used to gate access to the App’s surfaces
• Write access (dormant): the App requests scope to write a work-package reference onto a linked issue through an app-created custom field. It is opt-in, off by default, and currently ships with no control to enable it. We disclose it because the scope is requested and the capability exists.

Data read from and written to Confluence (optional “Supporting documents” feature):

• Space and page summaries via search, so you can find and link existing Confluence pages
• The content of a page you have linked, so Ask Tollgate can answer from it
• Writes: at your request the App creates pages from four templates — change and adoption plan, benefits realisation plan, board paper, and steering committee minutes — and can update financial figures inside an existing page you nominate

1.2 Information We Do NOT Collect

We do not collect:

• Account credentials or passwords
• Email addresses of your Jira users — display identity resolves from Jira at render time. Email addresses of external participants you enter yourself are collected; see Section 1.1.
• Jira issue content (titles, descriptions, comments) or Jira attachments
• Credit card or payment information (handled by Atlassian Marketplace)
• Behavioural or usage analytics, telemetry, or tracking data
• Cookies of any kind

2. How We Use Information

2.1 Core Functionality

We use collected information to:

• Render the App’s governance surfaces — Investment Health, the Investment Thesis and business case, the financial case, Work Packages, Risks & Opportunities, Decisions, Changes, Close-out, Benefits Realisation, and Portfolio Health — across the six lifecycle stages of Commit, Run and Realise
• Present a current, defensible governance picture to sponsors and PMOs
• Maintain a governance audit trail of changes
• Power Ask Tollgate, the read-only Rovo agent, so it can answer questions against your current governance data. It exposes fourteen read-only actions, mutates nothing, and makes no external AI calls.
• Power the optional Confluence “Supporting documents” integration when you trigger it

2.2 Service Improvement

Tollgate does not embed analytics, telemetry, or behavioural tracking. We do not collect usage data inside the App. If you choose to submit feedback through the in-app feedback control (see Section 4 and Section 13), that feedback helps us improve the App — but it is entirely voluntary and user-initiated.

2.3 Legal Basis for Processing (GDPR)

Our legal basis for processing data:

• Legitimate Interest: Investment governance and project oversight
• Contract Performance: Providing the service as agreed
• Consent: Implicit consent through app installation by an authorized administrator

3. Data Storage and Retention

3.1 Storage Location

All data is stored in Atlassian Forge app-scoped storage, across two tiers:

• The Custom Entity Store for higher-volume records — work packages, risks and opportunities, decisions, changes, and the audit trail
• Key-Value Storage for singletons and settings
• Storage is isolated per Jira instance and is not shared across customers
• Tollgate makes no calls to any Softwired-operated server, and no data is transferred outside Atlassian infrastructure

Data residency: where Tollgate supports Atlassian data residency, app data follows your product’s pinned region. Atlassian may replicate data across regions under its own disaster-recovery arrangements. If your organisation needs a residency commitment in writing, contact us before you deploy.

There are no Softwired servers. Softwired does not copy your governance data to any external server, database, or analytics system.

3.2 Data Retention

• Governance Records: Retained until you delete the record, the project is deleted, or the App is uninstalled
• App Settings: Retained until the App is uninstalled or manually deleted
• User Identifiers in Governance Roles: Retained as part of the governance record until that record is deleted, the named user is permanently deleted from Jira (see Section 3.3), or the App is uninstalled

3.3 Data Deletion

• User deletion (right to be forgotten): When a user is permanently deleted from your Jira instance, the App receives Atlassian’s avi:jira:deleted:user event and automatically scrubs that user’s accountId from stored governance records.
• External participants: Atlassian’s deletion event only fires for users with an Atlassian account. An external approver you recorded by name, email and job title has no such account, so nothing scrubs them automatically. Email help@softwired.com.au to have an external participant removed and we will action it within 30 days.
• Project deletion: When a Jira project is deleted, the App removes that project’s governance data.
• App uninstallation: A Forge preUninstall purge automatically deletes ALL of the App’s stored data for your tenant before the uninstall completes. Your underlying Jira issues and Confluence pages are unaffected.

To manually delete data while keeping the App installed, contact help@softwired.com.au with your Jira instance URL; we will arrange deletion of stored governance data within 30 days.

4. Data Sharing and Disclosure

4.1 No Third-Party Sharing

We never share, sell, or transfer your data to third parties.

In normal operation the App makes no network calls outside your own tenant’s Atlassian APIs. There are no third-party services, SDKs, analytics, or cookies. All data remains within your Jira Cloud instance and Atlassian Forge infrastructure. The single user-initiated exception is the in-app feedback control described in Section 4.2 and Section 13.

4.2 Exceptions

We may disclose data only when:

• Legally Required: To comply with court orders, subpoenas, or legal obligations
• Security Threats: To investigate fraud, security threats, or policy violations
• With Your Consent: When you explicitly authorize data sharing for support

Feedback control: The App includes an in-app feedback control that deep-links your browser to Softwired’s public Jira Service Management portal (softwiredau.atlassian.net). If you choose to submit a bug report, feature request, or satisfaction rating there, that content is sent to Softwired and processed to triage and respond to your feedback. This is a user-initiated browser navigation — the App itself transmits nothing externally. Submitting feedback is voluntary; please do not include sensitive personal data in free-text feedback.

4.3 Atlassian Infrastructure

Your data is processed on Atlassian’s Forge platform:

• Atlassian’s privacy policy applies: https://www.atlassian.com/legal/privacy-policy
• Forge infrastructure follows Atlassian’s security and compliance standards
• Data residency follows your Jira instance’s region where Tollgate supports the Atlassian data residency programme
• Ask Tollgate runs on Atlassian’s Rovo/AI platform; Atlassian’s AI data-handling terms apply to those interactions. Tollgate makes no calls to any AI service outside your own Atlassian tenancy.

5. Security Measures

We implement industry-standard security practices.

Technical measures:

• Built entirely on the Atlassian Forge platform — runs on Atlassian infrastructure, with no external servers
• All API calls use Forge authentication and authorization
• TLS/HTTPS encryption for all data in transit
• Atlassian encryption at rest for all stored data
• Tenant isolation enforced by the Forge platform
• Server-side input validation for all user inputs
• No external egress: the App makes no outbound network calls outside your own tenant’s Atlassian APIs — no third-party services, SDKs, analytics, or cookies

Operational measures:

• Minimal data collection (only what’s necessary for governance)
• Regular security reviews of code and dependencies
• Automated dependency updates for security patches

Access controls:

• An access-governance model: per-project governance data is visible only to project members (project lead, charter seats, the project group, and project admins)
• The cross-project Portfolio Health view is restricted to Jira admins or a configured governance group
• Role-based access that respects Jira’s built-in permissions

6. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the following rights:

• Right to Access — request a copy of data we store about your Jira instance.
• Right to Rectification — request correction of inaccurate data (via the App’s editing UI).
• Right to Erasure (“Right to be Forgotten”) — request deletion of governance data (via record deletion, project deletion, or app uninstallation). When a user is permanently deleted from Jira, their accountId is scrubbed automatically; external participants are removed on request (see Section 3.3).
• Right to Restriction of Processing — request temporary suspension of data processing (contact support).
• Right to Data Portability — export the governance record yourself from inside the App. Export governance record produces a CSV of every decision, change, risk and audit event, per project or across the portfolio, plus a full-record XLSX. No request to us is required.
• Right to Object — object to data processing based on legitimate interest (contact support).

To exercise your rights, email help@softwired.com.au with your request and Jira instance URL.

7. Children’s Privacy

Tollgate is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately.

8. International Data Transfers

Data residency: Tollgate stores data in Atlassian-hosted Forge storage inside your own site’s tenancy, and makes no calls to any Softwired-operated server. Where Tollgate supports Atlassian data residency, app data follows your product’s pinned region; Atlassian may replicate data across regions under its own disaster-recovery arrangements. Contact us if your organisation needs a residency commitment in writing.

Standard Contractual Clauses (SCCs): Atlassian Forge uses SCCs for GDPR-compliant data transfers. See Atlassian’s privacy policy for details.