NF / Privacy / Atlassian

Approval Desk – Bulk Approvals for JSM — Privacy policy

Scope and product boundary

This policy explains how Approval Desk – Bulk Approvals for JSM handles information when it is installed in Jira Cloud. The app gives authorised JSM approvers a focused view of native approvals; it is not a separate identity, request or billing system.

Information processed

Approval Desk processes the minimum information needed to show and answer an approval:

Jira site and Atlassian Forge installation context.
Pending approval ids, issue keys, request titles, request type, service project and created date.
Requester display name and configured field values returned by JSM for the signed-in user.
Approval status, answerability and the metadata required to prevent stale or unauthorised actions.
Administrator configuration for service projects, request types, context columns and Safe Bulk rules.

What is stored

Tenant-scoped Forge Storage keeps configuration and minimal bulk-operation metadata: an operation id, installation context, signed-in account id, timestamp, item count, status and per-item result. Bulk metadata is short-lived, with a maximum retention target of 30 days. A monthly usage counter stores counts, not request content.

Request summaries, field values, amounts, justifications, comments and attachments are displayed transiently and are not stored permanently by Approval Desk. Jira remains the source of truth for request content and native approval history.

What we do not collect

Approval Desk does not ask for or store passwords, API tokens, personal access tokens, OAuth secrets or a separate service account. It has no external customer-data database, advertising use or configured third-party analytics endpoint.

Why we process it

We process this information to present approvals the signed-in user can answer, show the configured decision context, enforce administrator and plan boundaries, prevent stale actions, record bulk-operation outcomes and provide support. Approval decisions are sent through the official JSM approval workflow.

Authorisation and isolation

Customer-sensitive reads and approval decisions run in the signed-in user's Forge context. Configuration and operation records are scoped to the Jira installation. A configured field does not override the user's native JSM visibility.

Deletion and rights

When the app is uninstalled, associated Forge Storage is removed according to Atlassian's app-uninstallation policies. Native JSM requests and their approval history remain in Jira because Approval Desk does not own them. For questions about access, deletion or applicable privacy rights, use the support form or email support@narrowforge.com.