Approval Gate for Jira — Privacy Policy

Last updated: 29 July 2026.

The short version

Approval Gate is a pure Atlassian Forge app. Its manifest declares no external.fetch permissions at all, so the app cannot make any outbound network call — your data never leaves Atlassian's infrastructure. There is no vendor server, no database of ours, and no account to create.

What data the app accesses

• read:jira-work — to identify the issue the Approval Gate panel is open on and to read the approval data the app itself has stored on that issue.
• write:jira-work — to save approval requests, decisions, reassignments and cancellations onto the issue, and to post a mirroring comment on the issue when something is decided.
• read:jira-user — to look up the display names of the approvers you pick, so the panel can show "Jane Doe" instead of an opaque identifier.

The approval records the app writes contain: the request title and optional description you type, the decision rule (one approval or unanimous), timestamps, any comments you add to a decision, and the Atlassian accountId of the requester, the approvers and every actor in the audit trail. Display names and e-mail addresses are not written into the record — names are resolved fresh from Jira each time the panel loads (/rest/api/3/user/bulk) and are discarded afterwards.

Where data is stored and processed

Approval Gate does not request the storage:app scope and does not use Forge Storage. All approval data is stored inside Jira itself, as a Jira issue property with the key greenlight-approvals on the issue the approval belongs to. Decision mirrors are stored as ordinary Jira issue comments. A second issue property, approval-gate-exceptions, records the moments the workflow validator allowed a transition through without being able to enforce the gate — for example when the subscription was inactive or Jira did not return the approval data. Each entry holds a timestamp, a reason code and the issue id; it contains no personal data beyond that. Processing happens in the Forge function running in Atlassian's cloud environment; nothing is copied anywhere else.

What the app does not do

• No data is sold, shared or transferred to any third party — technically impossible here, since the app has no egress.
• No analytics, telemetry, tracking pixels or advertising identifiers.
• No e-mail addresses are read or stored by the app.
• No external scripts, fonts or images are loaded into the panel.

Data retention and deletion

Because approval data lives on the Jira issue, it follows that issue's lifecycle: when the issue is deleted, its greenlight-approvals property is deleted with it. The audit trail is append-only by design — entries are never rewritten or silently removed, and a request that has been approved, rejected or cancelled can no longer be modified.

Uninstalling the app removes its access to your site and the panel disappears, but it does not by itself erase data already written into Jira: the issue property and any mirrored comments remain part of the issue. A Jira administrator can remove them at any time — comments through the normal Jira UI, and the issue property through the Jira REST API (DELETE /rest/api/3/issue/{issueIdOrKey}/properties/greenlight-approvals, and DELETE /rest/api/3/issue/{issueIdOrKey}/properties/approval-gate-exceptions for the exception log). We can neither reach nor retain that data ourselves.

Contact

Questions about this statement or about data handling: info@kyc-checks.nl.