At a glance
Runs on Forge
Our apps execute on Atlassian's Forge platform, not on servers we operate.
Stored with Atlassian
App data lives in Forge hosted storage and follows your product's data residency.
Only what's needed
We access the minimum data each feature needs and never sell it.
Deleted on request
Ask us at any time and we will delete your data, or it goes when you uninstall.
Who we are & scope
"Vico", "we" and "us" refer to Vico, a software studio based in Ho Chi Minh City, Vietnam, and the publisher of the apps listed on our Atlassian Marketplace vendor page.
This policy applies to all of Vico's Atlassian Marketplace apps (for example, UML for Confluence) and to this website. It does not cover Atlassian's own products; Atlassian's handling of your data is described in the Atlassian Privacy Policy.
When your organisation installs one of our apps, your organisation is the controller of the data in its Atlassian site, and Vico acts as a processor on its behalf. Atlassian provides the Forge platform our apps run on.
Data the apps access
Forge apps can only reach the data allowed by the permission scopes declared in their manifest, which are shown to an administrator before installation. Depending on the app and the features you use, our apps may access:
- Content you put in the app
- The text of a macro or app block — for example diagram source (PlantUML), Markdown, or chart data — and the page or issue it is placed in, so it can be rendered.
- App configuration
- Settings you choose, such as templates, display options, and the repository, branch and file path for a Git import.
- Integration credentials (optional)
- If you connect GitHub, GitLab or Bitbucket, the access token or credentials you provide so the app can fetch the files you select. These are stored in Forge hosted storage and used only for that purpose.
- Atlassian identifiers
- Technical identifiers supplied by Atlassian, such as your Atlassian account ID, site (cloud) ID and site URL, and the app installation ID. We do not request your email address or name unless you contact support.
- Support information
- If you contact us, the details you choose to share — name, email, site URL, screenshots and the description of your issue.
- Device & technical information
- Our apps do not collect device fingerprints, IP addresses or location. Atlassian may process standard technical information (such as browser type and IP address) when you use its products and the Forge platform, as described in Atlassian's privacy policy. Forge invocation logs we can see may include technical metadata such as timestamps, error messages and the app's own log output.
How we use data
- To provide the app — render diagrams, charts and Markdown, save configuration, and import files from your Git provider when you ask it to.
- To support you — investigate and answer the requests you send us.
- To keep the app secure and reliable — diagnose errors, prevent abuse and fix vulnerabilities.
- To meet legal obligations — for example, respond to a valid legal request.
We do not sell personal data, use your content to train AI models, build advertising profiles, or use your data for any purpose you would not reasonably expect from the app.
Where data is stored
Our apps are deployed on Atlassian Forge. App code runs in Atlassian's Forge runtime and any data the app needs to persist is stored in Forge hosted storage, which Atlassian operates on its cloud infrastructure. Data stored this way is segregated per installation, so one customer's site cannot read another's.
Data residency. Forge hosted storage supports Atlassian data residency: app data is stored in the same location as the Atlassian product it is installed on, and moves with it if your administrator changes the product's location. Where an app uses only Forge hosted storage for in-scope data, this is shown on the app's Privacy & Security tab on the Marketplace.
We do not operate our own databases or servers for these apps and do not copy your Atlassian content to infrastructure outside Atlassian.
Data minimisation & anonymisation
Each app requests only the Forge permission scopes it needs for its features, and stores only the configuration and content required to do its job. We avoid writing personal data or page content to application logs. Where we look at usage or error trends, we use aggregated or de-identified information rather than data about identifiable individuals.
Retention
| Data | How long we keep it |
|---|---|
| Macro / block content | Stored in your Atlassian product as part of the page or issue; it stays as long as that content exists and is governed by your product's retention. |
| App configuration & integration credentials (Forge hosted storage) | While the app is installed. After uninstall it is removed according to Atlassian's Forge data lifecycle, or sooner on request. |
| Forge logs | Kept by Atlassian for a limited period under the Forge platform's log retention; we do not export them to other systems. |
| Support conversations | For as long as needed to resolve your request and up to 24 months afterwards, unless you ask us to delete them earlier. |
Your rights & choices
Depending on where you live (including under the EU/UK GDPR), you may have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct or update inaccurate data;
- Delete your data;
- Restrict or object to certain processing;
- Data portability — receive your data in a machine-readable format;
- Withdraw consent where processing is based on consent;
- Complain to your local data protection authority.
Most data can be viewed, changed or removed directly in the app — edit or delete the macro, change the app's settings, or disconnect a Git integration. For anything else, send a request to [email protected] or through our support portal. Please include your Atlassian site URL. We may need to verify your identity, and if your organisation installed the app we may involve your site administrator, as the controller. We respond within 30 days.
Deletion & uninstall
On uninstall: when an administrator uninstalls one of our apps, it stops running and can no longer access your site, and the app's data in Forge hosted storage is deleted according to Atlassian's Forge data lifecycle.
On request: you can ask us to delete your app data at any time, whether or not the app is still installed. We will confirm once deletion is complete. Content that lives inside your pages or issues (such as macro source) is part of your Atlassian product, and you can delete it there at any time.
International transfers
App data is stored by Atlassian in the location described above. Vico is based in Vietnam, outside the European Economic Area. If we need to access personal data from the EEA, UK or Switzerland — for example, to investigate a support request — we rely on an adequate transfer mechanism, such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with appropriate safeguards.
Data processing terms (GDPR)
Customers in the EEA (and others who need them) can request a Data Processing Agreement with terms consistent with Article 28 of the GDPR. Email [email protected] with your company name and Atlassian site URL and we will send it to you.
Security
- Encryption in transit — all communication between the app, Atlassian APIs and connected services uses HTTPS (TLS 1.2 or later).
- Encryption at rest — data in Forge hosted storage is encrypted at rest by Atlassian.
- Least privilege — apps request only the permission scopes they need, and access to our Forge developer accounts is limited and protected with multi-factor authentication.
- Secrets — credentials are never hard-coded; they are stored in Forge's secure storage and environment variables.
- Vulnerability management — we keep dependencies up to date and take part in the Atlassian Marketplace Security Bug Bounty Program.
We follow Atlassian's security requirements for Marketplace partners and its app security incident management guidelines; see Atlassian's data privacy guidelines for developers for the related requirements. To report a security issue, email [email protected].
Incidents & breaches
If we become aware of a security incident affecting your data, we will act promptly to contain and investigate it, notify affected customers without undue delay, coordinate with Atlassian, and notify regulators where applicable law requires (for example, within 72 hours under the GDPR, where we are responsible for doing so).
Consent & marketing
We do not use data from our apps for marketing. If we ever want to use your data for marketing, share it with third parties for their own purposes, or use it in a way you would not expect, we will ask for your separate, explicit consent first — it will not be assumed from this policy.
Our apps are intended for business use and are not directed at children.
This website
This website is a static site with no analytics, advertising trackers or cookies. Your light/dark theme choice is saved only in your browser's local storage. Fonts are loaded from Google Fonts, so your browser connects to Google's servers, which receive your IP address under Google's privacy policy.
Changes to this page
We may update this page as our apps or legal requirements change. The "Last updated" date at the top shows the latest version. For material changes we will give notice through the app listing or by email where we have a contact for you.
Contact
Questions, requests or concerns about privacy — we read every message.