Privacy and security

Advanced Image Gallery for Confluence Cloud is a Forge app by XALT Business Consulting GmbH. This page says what data the app keeps, where, for how long, and who can reach it. The AI usage policy covers the AI features in detail.

Runs on Atlassian

• The app runs only on Atlassian's platform. Its code runs on Forge, and its data is stored in Forge hosted storage.

• It has no egress. It sends nothing to XALT or to any other service, and XALT runs no server for it.

• It meets Atlassian's Runs on Atlassian requirements.

• XALT uses no sub-processors of its own for the app. Rovo and Forge LLMs, which the AI features use, are Atlassian services under Atlassian's terms.

What the app stores

On the page

The gallery macro in the page holds only the gallery's ID. It is kept as long as Confluence keeps the page and its versions.

Images

Images stay Confluence attachments. The app copies no image files; Atlassian's image service resizes them when they are shown.

In Forge hosted storage

Each installation has its own store. It holds:

• Galleries: the title, description and settings, and the list of images with their captions, alt text, copyright lines, file names, sizes and edits, plus the IDs of the page, the space and the attachments. Kept until the page or the attachment is purged, or the app is uninstalled.

• The admin's AI setting. Kept until the app is uninstalled.

• Usage counts for the settings page: per space, a number of AI calls and since when they were counted. No content and no account IDs. Kept until the app is uninstalled.

• For the AI allowance, what AI suggestions have cost per site, and on sites with the Advanced edition per editor and month. An editor's monthly total is stored under a keyed hash that changes every month, never under an account ID. The month's records expire a day after the month ends, and Forge can take up to 48 hours more to remove them.

• A gallery description being written, under a hash of the editor and the request, until it is delivered. The app reads it back for at most one hour, and Forge can take up to 48 hours more to remove it.

In the user's own browser

Each user's browser holds:

• Links to the images a reader has viewed, so the gallery loads faster next time. Each link is kept for at most 23 hours, and at most 500 are kept. They never leave the browser.

• An editor's unsaved changes, so they can be restored after the editor closes. Kept until the editor saves or discards them, for at most 7 days. They never leave the browser.

Nothing else holds customer data.

Who can reach the data

• Readers see a gallery only when they may view its page. The app checks this as the reader on every request, and Confluence checks every image request.

• Anonymous visitors see a gallery only on a page Confluence confirms is open to anonymous visitors. They can never save or change a gallery.

• Editors save a gallery only when they may edit its page. Uploads run as the editor, so Confluence checks their permission to attach files.

• Confluence administrators reach the settings page. The app checks on every request that the person is a Confluence administrator.

• The Rovo agent acts as the person who asks, with their own permissions. It reads only pages, attachments and galleries they can view, and changes only pages they can edit.

• XALT cannot see the galleries stored on your site, because Forge gives app developers no access to production storage. XALT sees the app's logs and metrics as described below.

• Atlassian hosts the storage, encrypts it at rest and keeps each installation's data separate.

Personal data

• The app's storage holds content IDs, never Atlassian account IDs, names or email addresses.

• The AI allowance tells editors apart by a keyed hash of their account ID that changes every month, as described above.

• In the browser, the stored image links and unsaved changes are filed under keys that contain the user's own account ID. They stay in that user's browser and are never sent anywhere.

• Captions, copyright lines, alt text, descriptions and file names may name people. They stay in the app's storage and on the page, and never go into logs, metrics or error messages.

Logs and metrics

• The app's logs record IDs, counts, statuses, timings and the platform's own error messages. They never record captions, copyright lines, alt text, descriptions, file names, page titles, search words, account IDs or image links.

• XALT can read the logs of a production site for 30 days, unless an admin turns off the app's logs access in Atlassian Administration.

• The app counts events such as agent actions and AI suggestions with Forge custom metrics, which XALT sees in Atlassian's developer console. Each counter carries a name and a number only. An admin can turn off XALT's access to them.

Data residency

• The galleries, the AI setting, the usage counts and the AI allowance records are stored in Forge hosted storage, which Atlassian pins to your product's location and moves with it.

• The app's functions run on Forge. Atlassian aims to run them in the same location, but they may sometimes run elsewhere.

• Atlassian states where Rovo and Forge LLMs process data; see the AI usage policy.

How long data is kept

• When a page or blog post is trashed, its galleries stay, so restoring the page brings them back. When it is purged, its galleries are deleted.

• When an attachment is trashed, its image keeps its place in the gallery. When it is purged, the image is removed from every gallery.

• A gallery removed from a page keeps its data while the page exists, so restoring an older page version brings it back.

• Some galleries stay in storage because Confluence gives the app no proof that they are gone: galleries of pages purged while the app could not see them, of never-published drafts that were discarded, and of deleted spaces.

• When the app is uninstalled, Forge's data lifecycle applies to everything the app stored. The data is first soft-deleted and then kept until the end of Atlassian's retention period. A new installation can be relinked to it only on a request to Atlassian made within 21 days of uninstalling.

• When the site is removed, all of the app's data is deleted.

• To have the app's data deleted, uninstall the app. XALT has no tool to delete or read a customer's stored data.

• Logs are kept for 30 days.

Backups, exports and copies

Gallery data lives in the app's storage, not in the page, so it does not travel with every Confluence copy:

• Atlassian Backup and Restore does not back up Marketplace app data, so galleries are not in its backups.

• A sandbox data copy does not copy Marketplace apps or their data.

• Atlassian does not document that a site backup file or a space export and import carries app data. Expect galleries not to arrive.

Where the galleries do not arrive, the page keeps its gallery macro and readers see "This gallery's data could not be found." Editing the gallery starts a new, empty one.

Security

• The app checks the user's own Confluence permission on every request, as that user.

• The app treats inputs from Rovo as untrusted. It validates them and checks the user's permissions before it reads or changes anything.

• Captions and other texts people write are shown as plain text, in galleries and in Rovo Chat.

• The app never asks for or stores passwords, API tokens or other credentials.

• An image link opens one file for about 23 hours and is issued only to a reader Confluence has just authorized. The app never stores such links in its storage and never logs them.

• The app's functions keep no customer data between requests, and each installation's data is kept apart.

• Atlassian's platform encrypts the data at rest and in transit.

Permissions the app asks for

Report a security issue

Report security issues to XALT through XALT support.

More

• AI usage policy

• XALT data protection

• Imprint