Data Processing Addendum: Quicksloth Q&A for Confluence

Last updated: 11 October 2026

1. Scope

This Data Processing Addendum ("DPA") is part of the Terms for the app "Quicksloth Q&A for Confluence" (the "App") between Quicksloth, the brand name of Alfredo Onori, an independent software developer based in Italy ("we", the "processor"), and the organization that installs the App ("you", the "controller" or, where you act as a processor for your own customers, the party that gives us instructions on their behalf). It applies to personal data that the App processes on your behalf ("Customer Personal Data") where the EU GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies.

You accept it when you accept the Terms; no signature is needed. If this DPA and the Terms conflict about Customer Personal Data, this DPA prevails. Terms such as "personal data", "processing" and "personal data breach" have the meaning given in the GDPR.

2. Details of the processing

3. Your instructions

We process Customer Personal Data only on your documented instructions. Your complete instructions are the Terms, this DPA and the way your admins and users configure and use the App. If a law that applies to us requires other processing, we will tell you before processing unless that law forbids it. We will tell you promptly if, in our opinion, an instruction breaks data protection law. We do not use Customer Personal Data for our own purposes, such as analytics, advertising or training AI models.

4. Our access and confidentiality

The App has no servers of its own and no permission to send data outside Atlassian. We do not access your Confluence content or the App's database for your site, and we do not add features that copy Customer Personal Data out of Atlassian without updating our privacy policy and this DPA first and giving you notice as in section 13.

Atlassian makes app logs available to us for troubleshooting; a site admin can turn this access off. Only Alfredo Onori works on the App, and he is bound by confidentiality. If anyone else ever gets access, they will be bound by confidentiality first.

5. Sub-processors

You give us general authorization to use the following sub-processor:

Your use of Confluence itself, including the questions, answers and comments that the App saves in your site, is covered by your own agreement with Atlassian.

Before we add or replace a sub-processor of our own, we will tell you at least 30 days in advance, by email to the contacts that Atlassian gives us for your license (or as described in section 9) and on this page. You can object on reasonable data protection grounds; if we cannot address the objection, you can stop using the App by uninstalling it. We remain responsible to you for our sub-processors' data protection obligations.

6. International transfers

We do not transfer Customer Personal Data outside the European Economic Area ourselves. Atlassian may process it in other countries under the Forge Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the provisions for UK and Swiss data, and under the EU-US Data Privacy Framework where Atlassian relies on it. The App's Forge hosted storage follows your site's data residency location.

7. Security

We take the measures required by Article 32 GDPR. The App's measures are:

• No egress: the App's manifest grants no permission to contact addresses outside Atlassian, and the App has no servers, web triggers or remote back ends.
• Isolation: Atlassian hosts a separate database for each installation of the App.
• Encryption: Atlassian encrypts data in transit (TLS 1.2 or higher) and at rest (AES-256), as described in the Forge Data Processing Addendum.
• Access control: every action a person takes runs with that person's own Confluence permissions. Before any list is shown, the App checks with Confluence which questions that person may see. Votes, accepted answers, edits and deletions are checked on the server side, never trusted from the browser.
• Data minimization: the App stores Atlassian account IDs, not names or email addresses. Comments are not copied into the App's database. Logs are designed to contain no question, answer or comment text, names or email addresses.
• Deletion that follows Confluence: when a question or answer is deleted in Confluence, the App removes its index entry, its votes and, for a question, its topics. A trashed item is kept but hidden until it is restored or deleted in Confluence.
• Development: automated tests for permissions and input validation, a dependency audit before each release, and checks for secrets before each commit. Our developer account uses two-factor authentication.
• Incidents: we follow the response plan on our security page.

8. Help with people's rights

Your site admins control the content in your site and can answer most requests with Confluence's own tools; when content is deleted in Confluence, the App removes the related data from its database. When an Atlassian account is closed or changed, the App follows Atlassian's personal data reporting process and erases or updates the account IDs it stores.

If someone sends us a request about Customer Personal Data, we will pass it to you without undue delay and will not answer it ourselves unless you authorize us. Taking into account the nature of the processing and the information we have, we will help you with requests, data protection impact assessments and consultations with supervisory authorities, mainly by giving you the information in this DPA, our privacy policy and our security page and by answering your written questions.

9. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay, and no later than 72 hours after becoming aware of it, by email to the contacts that Atlassian gives us for your license. Where Atlassian gives us no contact for your installation, for example on a free plan, we publish the notice on our security page, and you can give us a contact address at support@quicksloth.dev. We will describe the nature of the breach, the categories and approximate number of people and records concerned where possible, the likely consequences and the measures taken or proposed, and give you a contact point. If we cannot give all the information at once, we will give it in stages without further undue delay. We will help you meet your obligations under Articles 33 and 34 GDPR.

10. End of the processing

When the App is uninstalled, Atlassian marks the App's database for your site for deletion and deletes it under its hosted storage data lifecycle, normally within 60 days after your subscription ends; if your admin asks within 21 days, it can be relinked to a new installation. App logs are available to us for 30 days. We keep no copies.

The questions, answers, comments and topics stay in your Confluence site as Confluence content, under your control, until you delete them; this is how the data is returned to you. Votes exist only in the App's database and are deleted with it. The App has no export function today: if you need a record of the votes, note them before uninstalling (each question shows its score).

11. Information and audits

We will give you the information needed to show that we meet this DPA and Article 28 GDPR. You can send written questions to support@quicksloth.dev, and we will answer within 30 days.

At reasonable intervals, or if there are signs of non-compliance, you or an independent auditor bound by confidentiality can audit our compliance, with at least 30 days' notice and at your cost. We run no servers, so audits of the platform rely on Atlassian's independent reports at atlassian.com/trust/compliance.

12. Your responsibilities

You are responsible for having a lawful basis for the personal data your users post, for informing your users, and for the way your organization configures and uses Confluence and the App.

13. Liability, changes and law

The limitation of liability in the Terms applies to this DPA to the extent the law allows. Nothing in this DPA limits the rights of the people whose data is processed.

We may update this DPA to follow the law or changes in the App. We will publish the new version on this page with a new date, and changes that reduce the protection of Customer Personal Data take effect 30 days after we tell you as described in section 9. This DPA is governed by the same law as the Terms.

Contact

support@quicksloth.dev · Security: security@quicksloth.dev