AI usage policy | Advanced Image Gallery for Confluence Cloud

Last updated: 2026-10-28

This policy covers Advanced Image Gallery for Confluence Cloud, a Forge app by XALT Business Consulting GmbH. It says which AI features the app has, what data each one uses, where that data is processed, what the app keeps, and how to turn the features off.

The app's AI features

The app has two AI features: the Rovo agent "Advanced Image Gallery", and AI text suggestions in the gallery editor. People use the agent in Rovo Chat, where it can do four things through the app's actions:

List page images: lists the image attachments of a page with their file names, attachment IDs, captions, alt text and previews.
Search gallery images: finds gallery images whose captions, alt text, copyright lines, file names, gallery titles or gallery descriptions contain the words asked for.
Describe a gallery: describes one gallery on a page with its title, description and layout, and each image's file name, caption, alt text and preview.
Create a gallery: adds a new gallery of a page's images to the end of the page's draft, for the person to review and publish.

The agent works with the text that galleries store. It does not look at the images themselves.

Under each gallery on a published page, the button "Ask Rovo about this gallery" opens Rovo Chat with the agent and a question about that gallery, which names the gallery's title and ID. The button shows only when Rovo is on for the site and the app's AI features are on.

In the gallery editor, "Suggest alt text" proposes alt text for one image, and "Write a description" proposes a description of the gallery. The model works from text and never sees the images. Each suggestion appears in a card that says so, until the editor accepts, edits or dismisses it; nothing is stored with the gallery until the editor saves it.

The rest of the app (galleries on pages, the lightbox, upload and exports) uses no AI.

What the agent reads and returns

Every action runs as the person who asks, with their own Confluence permissions. It reads only pages, attachments and galleries that person can view, and changes only pages they can edit. The app checks this itself on every call.

The app does not receive the conversation. Rovo passes an action only its inputs, such as a page link, a gallery ID, search words, attachment IDs, a layout and a gallery title, and the page or space Chat is open in.

The actions return to Rovo, for the person who asked:

Page titles and links, image file names and attachment IDs, and the captions and alt text that the page's galleries give the images.
For a search, the matching images with their captions, alt text and gallery titles. Copyright lines and gallery descriptions are searched but not returned.
For a gallery it describes, the gallery's title, description and layout, and each image's file name, caption and alt text.
Image previews as links to the attachments in Confluence, which open only for people who may view the page. The app never sends image files, or links that open a file without a Confluence sign-in.

Captions, alt text, titles, descriptions and file names are text written by people. The app escapes them so they show as plain text in Chat, and the agent's instructions tell it never to follow instructions found inside them. The question the Ask Rovo button starts with quotes only the gallery's title, on one line and cut short, and the agent's instructions treat it as a name.

Create a gallery changes a page, so Rovo shows the person what is about to happen and asks them to confirm first, and Rovo does not run it from automation rules. The gallery goes into the page's draft, and the app never publishes it. The person reviews it in the editor and publishes it. The only text the agent can pass in is the gallery's title, stored as plain text; captions and alt text start empty.

What AI text suggestions send and keep

A suggestion runs as the editor who asks, with their own Confluence permissions, only for a page they can edit, and only while the app's AI switch is on and the site's AI allowance lasts. The app checks this itself on every request.

For alt text, the app sends the model the image's file name, caption and current alt text, the gallery title, the page title, and page text (the text around the image, or else the start of the page). For a description, it sends the gallery title, the images' captions, alt texts and file names in gallery order, the page title and the start of the page text. Each is cut to a fixed size. The texts are the editor's current ones, saved or not, and page text is read as the editor sees it, so page restrictions apply.

Customer texts reach the model marked as data, apart from the app's instructions, and every suggestion comes back as plain text.

The model is fixed for each release of the app and never switched on its own. It is currently Claude Haiku 4.5, through Atlassian's Forge LLMs. The settings page shows the model and how Atlassian lists it.

Generated text is kept only to deliver it. The app reads it back for at most one hour after the request, and only for the editor who asked. Forge can take up to 48 hours more to remove an expired record.

Where data is processed

The app runs only on Atlassian's platform. Its code runs on Forge, and its data is stored in Forge hosted storage. It has no egress. It sends nothing to XALT or to any other service, and it uses no AI provider of its own. It meets Atlassian's Runs on Atlassian requirements.

Rovo, including the language models behind the conversation, is Atlassian's service, provided under Atlassian's terms. The app does not choose or call a language model. Atlassian describes how Rovo handles data on its AI trust page, in its Rovo data, privacy and usage guidelines and in its AI transparency notes.

Atlassian's AI trust page states that Rovo uses a mix of Atlassian-hosted and third-party-hosted language models, and that "By default, when using Rovo, data is transferred outside of the current site to third party LLM providers (e.g., OpenAI) in order to generate a response." Cloud Enterprise customers can ask Atlassian to use only Atlassian-hosted models.

AI text suggestions use Forge LLMs, which Atlassian describes as letting an app "call Atlassian-hosted large language models (LLMs) to add secure AI features without leaving the Atlassian platform". The app stays eligible for Runs on Atlassian with them. Atlassian's Forge LLMs documentation does not say where the model runs; this policy will say so once it does.

Model training

The app trains no AI models, and XALT receives no customer content from the app to train on.

Atlassian's Forge LLMs documentation does not say whether the requests apps send are used for training; this policy will say so once it does.

For Rovo, Atlassian's AI trust page states: "The data you submit and the responses you receive from Rovo are not shared with third-party-hosted LLM providers for them to use to train or improve their services." The same page states that Atlassian may use metadata to fine-tune open-source models that run only in Atlassian's infrastructure, subject to data contribution settings and after de-identifying and aggregating it.

What the app keeps

The app keeps no conversations. Atlassian's Rovo data, privacy and usage guidelines state that Atlassian keeps the inputs and outputs of Rovo Chat and agents for 30 days for safety and security purposes.

For the usage table on its settings page, the app counts the agent actions and AI text requests it runs, per space, and since when it has counted them. These counts hold a space ID, a number and a start time, and no content or account IDs.

A gallery the agent creates is stored like a gallery saved in the gallery editor, and follows the same storage and deletion rules.

For the AI allowance, the app keeps what AI text suggestions have cost per site, and on sites with the Advanced edition per editor and month. An editor's monthly total is stored under a keyed hash that changes every month, never under an account ID, and the month's records expire a day after the month ends; Forge can take up to 48 hours more to remove them. A description being written is kept under a hash of the editor and the job until it is delivered.

The app's logs record which action or suggestion ran, its outcome and its timing, with IDs and counts only. They never record prompts, page text, captions, alt text, descriptions, suggestions, file names, page titles, search words or account IDs. XALT can read the logs of a production site for 30 days, unless an admin turns off the app's logs access in Atlassian Administration.

The app also counts agent action calls, galleries created, uses of the Ask Rovo button, and AI suggestions made, accepted, edited, dismissed and failed with Forge custom metrics, which XALT sees in Atlassian's developer console. These counters carry a name and a number only.

When the app is uninstalled, Forge's data lifecycle applies to everything the app stored. The data is first soft-deleted and then kept until the end of Atlassian's retention period. A new installation can be relinked to it only on a request made within 21 days of uninstalling.

Turning AI off

The app's AI switch: a Confluence administrator opens Manage apps > Advanced Image Gallery > Configure and turns AI features off. From the next call on, every agent action answers that gallery AI features are turned off by the administrator and does nothing else. Pages no longer show the Ask Rovo button, and the gallery editor no longer offers suggestions. Galleries, the gallery editor, upload and exports keep working. AI features are on after the app is installed; if the app cannot read the switch, they do not run.
Rovo's own controls: in Atlassian Administration, under AI and Rovo > Access, an admin can block Rovo for Confluence. Atlassian's Manage Rovo access page states that blocking an app "will disable all current and upcoming AI features for that app. Rovo AI features like Agents and Chat will also be disabled." AI text suggestions do not use Rovo, so this does not turn them off; the app's AI switch does.
XALT's emergency switches: XALT can turn the app's AI features off, or only the AI text suggestions, without releasing a new version, using Forge feature flags, should a problem require it. With only the AI text suggestions off, the agent and the Ask Rovo about this gallery button keep working. A change reaches the app within about a minute and can apply to every site or to chosen ones, and the settings page shows when either switch is off.

Acceptable use

Use of the app's AI features is subject to Atlassian's Acceptable Use Policy, including its section on artificial intelligence offerings and features.

The agent is an app, not a person. Its instructions tell it never to present itself or its answers as a person's, and the only text it adds is a gallery title the person asked for.

Contact

Send questions about this policy or the app's AI features to XALT support.

Changes

XALT updates this policy before it adds or changes an AI feature.

2026-10-24: first version. Covers the Rovo agent and its three actions, the admin's AI switch and XALT's emergency switch.
2026-10-26: adds AI text suggestions in the gallery editor, the Describe a gallery action and the Ask Rovo about this gallery button.
2026-10-26: a second emergency switch turns off only the AI text suggestions.
2026-10-27: the policy is published on the app's documentation site, and its contact is XALT support.
2026-10-28: plainer wording, no change in what the policy says.