Vesper Privacy Policy

Effective date: 23 August 2026
Last updated: 23 August 2026

This Privacy Policy explains how Vesper processes personal data when the Vesper app for Jira Cloud is installed or used, and when someone contacts Vesper.

1. Provider and contact

Vesper is provided by Abhay Bharadwaj, an individual developer operating Vesper, based in Bengaluru, Karnataka, India.

Privacy, security, support, and legal questions may be sent to contact@vesperfocus.com.

2. Privacy roles

For personal data contained in a customer's Jira environment, the customer ordinarily acts as the data controller or, under Indian law, the Data Fiduciary. Vesper acts as the customer's processor or Data Processor when it processes that data to provide the app. If the customer processes data for another controller, Vesper may act as a subprocessor.

Atlassian provides the Marketplace and Forge platform. For Forge processing on Vesper's behalf, Atlassian ordinarily acts as Vesper's processor or subprocessor. Atlassian separately acts as a controller for Atlassian accounts, Marketplace transactions, and its own platform administration under Atlassian's privacy terms.

Abhay Bharadwaj acts as an independent controller or Data Fiduciary for information submitted directly to Vesper, including support emails, privacy requests, security reports, and legal or business correspondence.

3. Authentication

Vesper does not create a separate user account and does not collect Atlassian passwords or Jira API tokens. The app runs inside Jira and uses the invoking user's Atlassian authentication through Forge.

4. Jira data processed

To produce delivery views, Vesper reads Jira data that the invoking user is permitted to access, including:

• the current user's Atlassian account ID, display name, groups, application roles, and Jira permissions;
• selected Scrum boards, projects, active and completed sprints, sprint goals, and sprint dates;
• issue keys, summaries, types, priorities, status and status category, assignee, reporter, due date, labels, hierarchy, issue links, fix versions, timestamps, and mapped custom fields;
• comments and comment-author information when comment evidence is enabled;
• attachment and linked-resource metadata needed for readiness and story views; and
• Jira users searched by a site administrator for manual Vesper persona assignment.

Comment text is analysed deterministically for Standup and question or waiting signals. Vesper does not send Jira content to a large language model, advertising network, or third-party analytics service. The production Forge manifest declares no external data egress.

5. Data stored in Forge

Vesper does not operate a separate production database. It stores the following limited app data in Atlassian Forge hosted storage for each installation.

Installation-scoped data

1. Monitored board and project identifiers, mapped custom-field identifiers, role aliases, business timezone, comment setting, blocking phrases, and release mappings.
2. The account ID and display name of the administrator who last saved the configuration, with the save time.
3. Manual persona assignments containing an Atlassian account ID, display name, personas, update time, and the updating administrator's ID and name.
4. A bounded audit of manual role changes containing the actor's ID and name, the roles applied, the number of affected people, and up to 50 sampled affected account IDs and display names.
5. Small assignment revision, lock, commit, licence-cache, and privacy-reporting markers.
6. A portfolio comparison baseline containing per-board health and bottleneck counts. It contains no issue keys or personal identifiers.

Account-scoped data

1. A cleared-queue record containing the Jira issue key, or issue key and comment timestamp, for rows that a named user has marked as handled, along with the time of that action.
2. A My Work baseline containing Jira issue keys assigned to that user when the page was last opened and identifiers for mentions already seen.

These records are keyed by Atlassian account ID. Vesper refuses to serve an account-scoped record when its stored account ID does not match the requesting user.

Vesper does not persist complete Jira issue, comment, sprint, or attachment snapshots in Forge storage. Jira payloads otherwise exist only during the Forge invocation and in the authorised user's Custom UI session.

6. Purposes and lawful bases

Vesper processes customer-controlled Jira data only on the customer's instructions to provide, secure, maintain, troubleshoot, and support the app. The customer is responsible for establishing an applicable lawful basis and providing required notices to its Jira users.

For information Vesper controls directly, processing may be necessary to:

• perform or take steps connected with a customer agreement;
• respond to support, privacy, security, or legal communications;
• protect Vesper, customers, users, and the Forge platform;
• comply with legal obligations; and
• pursue legitimate interests in operating and improving a secure business service, where those interests are not overridden by individual rights.

Vesper does not sell personal data or use it for targeted or cross-context behavioural advertising.

7. Retention and deletion

Vesper applies the following retention rules:

• work-queue entries expire after 14 days;
• daily Standup cleared state expires at the end of the configured business day;
• cleared state is capped at 400 entries per account;
• expired cleared entries are hidden and pruned on the next read and are also physically pruned by the weekly privacy job, normally within seven days after their logical expiry;
• manual role-change audit history is capped at 20 events, with no more than 50 sampled affected users per event;
• a My Work baseline is replaced whenever that user next opens the page;
• configuration, current manual assignments, bounded audit history, portfolio baselines, and required privacy-reporting markers remain until replaced, deleted, or the app is uninstalled; and
• support, privacy, security, and legal correspondence is retained for up to 12 months after the matter is closed, unless longer retention is reasonably necessary for an active investigation, dispute, contractual obligation, or legal requirement.

Vesper's weekly Atlassian privacy process reports every account ID for which personal data remains stored. When Atlassian identifies a closed account, Vesper deletes that account's user-scoped state and removes or anonymises its identity in configuration and audit data. When Atlassian identifies updated profile data, Vesper erases stale display names and user-scoped Jira-derived state without using app-level Jira access.

A normal Forge pre-uninstall event requests deletion of all Vesper-owned active storage for that installation. Atlassian may retain recoverable platform copies for up to 28 days after uninstall under its documented Forge recovery process, unless longer retention is legally required.

8. Recipients and subprocessors

Vesper uses:

• Atlassian Pty Ltd and relevant Atlassian affiliates for Marketplace, Forge compute, hosted storage, app delivery, platform security, and related services; and
• Cloudflare, Inc. for its Cloudflare Email Routing service; and
• Microsoft Corporation for the Microsoft 365 mailbox used to receive, retain, and respond to messages sent to contact@vesperfocus.com.

Atlassian's current Forge subprocessors and locations are published at https://www.atlassian.com/legal/sub-processors. Vesper does not permit these providers to use Customer Personal Data for their own advertising.

9. International processing and data residency

Vesper is offered worldwide through Atlassian Marketplace. Forge hosted storage follows Atlassian's applicable data-residency and realm-pinning capabilities. Forge compute and Atlassian subprocessors may process data in other locations as described by Atlassian.

Where required, Vesper's Data Processing Addendum uses the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, and other legally recognised safeguards for international transfers.

10. Security

Vesper uses granular read-oriented Jira scopes, the invoking user's Jira permissions, Forge installation isolation, administrator checks, bounded storage, automatic expiry, uninstall deletion, and automated build and test controls. Vesper is read-only with respect to Jira and does not request a Jira data-write scope.

No internet service can guarantee absolute security. Suspected vulnerabilities or incidents should be reported privately to contact@vesperfocus.com.

If Vesper confirms a Security Incident affecting Customer Personal Data, it will notify the affected customer or Jira site administrator without undue delay and, where feasible, within 72 hours, with available information about the scope, likely consequences, mitigation, and follow-up contact.

11. Privacy requests and grievances

Requests for access, correction, erasure, restriction, objection, portability, or another applicable privacy right may be sent to contact@vesperfocus.com.

The request should include the requester's name, Jira site URL or cloud identifier, Atlassian account ID where available, the relevant Vesper installation, and the requested action. Vesper may request additional information reasonably necessary to verify the requester and prevent disclosure or deletion of another person's data.

Vesper will respond to a verified request within 30 days. Where applicable law permits an extension because of complexity or the number of requests, Vesper will explain the extension within the initial 30-day period.

For Jira data controlled by a customer, Vesper will ordinarily direct the requester to the customer's Jira administrator or assist the customer in responding. Vesper will directly handle information it controls, such as support correspondence. Privacy grievances and appeals may be submitted to the same contact.

Individuals may also complain to the privacy or data-protection authority that has jurisdiction over them.

12. Children

Vesper is a workplace delivery application for organisations and is not directed to children. Customers must not intentionally use Vesper to process children's data unless they have established all legally required authority and safeguards.

13. Policy changes

Vesper may update this Policy when the app, Forge platform, subprocessors, or legal obligations change. Material changes will be announced through the Vesper website, Marketplace listing, app, or another reasonable customer communication channel before they take effect where practicable. The effective date and last-updated date above identify the version in force.