BLOOMLOGIC LTD
Who we are
BLOOMLOGIC LTD is a company registered in England and Wales, company number 11173973, registered office 82a, James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.
Registered with the Information Commissioner's Office under reference ZC255403.
Contact for anything in this policy: privacy@bloomlogic.co.uk.
How this policy is arranged
Part one is about the company and is true of everything we do.
Part two covers each product we make, because what a product reads and stores depends on what it is. Today there is one: Canopy, an app for Jira.
The short version
We hold very little about anybody. We use no analytics provider, no advertising and no third-party tracking, and we set no cookies on our website beyond what it needs to work. If you switch the website between light and dark, your browser remembers that choice for the site; it is never sent to us. We do not sell or rent personal information, and the only companies that handle it for us are the two that run our email and our website, named below.
Two different roles
When you use one of our products inside your own systems, your organisation decides what is held there and why. Your organisation is the controller; we act on its instructions as a processor. What that means for each product is set out in part two.
For our own records we are the controller. That covers three things, and only these: people who email us for support, report a security issue, or correspond with us about a product; visits to our website; and the contact details Atlassian passes to us when an organisation licenses one of our products.
What we hold about you directly
If you write to us, we hold your message, your email address, and whatever you chose to tell us, for as long as it takes to deal with the matter and for two years afterwards. We use it to answer you and for nothing else.
If your organisation installs one of our products, Atlassian makes the billing and technical contact details your organisation gave it available to us through the Marketplace licence records. We use them only to contact your organisation about that product — service, security and licensing notices — and never for marketing. Atlassian holds those records; any we copy into our own email or files we keep while the licence is active and for six years after it ends, the period UK businesses normally keep contract records.
Why we are allowed to hold it
For all three, the legal basis is our legitimate interests: answering people who write to us, running the licences organisations have bought from us, and keeping our website working and safe. We have weighed those interests against yours; we hold only what each needs, and use it for nothing else. You can object to any of it (see "Your rights"), and we will stop unless we have a compelling reason to continue.
Who else is involved
We use no analytics provider, no advertising network and no artificial intelligence service of our own. Two companies handle personal information for us, on our behalf:
- Google runs our email. A message you send us — your address, what you wrote and anything attached — is held in our Google mailbox.
- Cloudflare hosts our website and carries every visit to it, so it receives each visitor's IP address and browser details with each request, as any web host does. Cloudflare also asks visitors' browsers to report to it when a page of the site fails to load; such a report carries the page address, the kind of failure and the time, and goes to Cloudflare, not to us.
Both are based in the United States, so your information may be held or reached there. Each moves it under its own data protection terms: the UK's approved contract clauses (the International Data Transfer Addendum) and, for the United States, the UK Extension to the EU-U.S. Data Privacy Framework, under which both are certified.
Where a product depends on a supplier, that product's section names it.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct or delete it, or object to our holding it on the basis of our legitimate interests. Write to privacy@bloomlogic.co.uk and we will answer within one month.
Where the information is inside your own organisation's systems, your organisation is the right first contact, because it decides what is held there. We will help it answer you promptly.
You can also complain to the Information Commissioner's Office at ico.org.uk.
Children
Our products are tools for workplaces. They are not directed at children and we do not knowingly hold information about them.
Changes to this policy
If this policy changes we will update this page and the date at the top. Where a change matters to how your data is handled, we will say so on the page rather than change it quietly.
Canopy, for Jira
Canopy is an app installed into your own Atlassian site. It runs entirely inside Atlassian: there are no servers of ours, no database of ours, and no connection to any other company. We cannot open your issues; what does reach us is set out under "What we can see".
What it reads
When somebody opens Canopy, it reads from Jira using that person's own Jira permissions and nothing more:
- Issues and their fields: key, summary, description, type, status, priority, dates, estimates, labels, components, versions, sprint, reporter, and supported custom fields, including rich-text fields shown in the details panel and extra fields selected for display
- Comments, attachments and issue history, read as needed to display details, compare baselines and check whether an undo is safe
- The links between issues, which is how Canopy knows the shape of the plan
- Who work is assigned to, so a card can show it
- Project, board and sprint details
- The name and avatar of the signed-in person and of assignees
This is read when it is needed and shown on screen. It does not leave Atlassian, and it is not copied to us apart from what the app's log carries, described under "What we can see".
What it stores
Canopy keeps a small amount of its own information in Atlassian's Forge storage, inside your site. Each person's entries are labelled with their Jira account identifier, so the right settings reach the right person:
- Saved Views, Branches, colour palettes and templates — the filters, focus points, colour rules and reusable branch outlines a person has saved, for themselves or for the team. A template keeps the title and type of each of its cards. Where Jira hides some work items from some people, a template saved for the team cannot hold any of them; one saved for yourself is read by you, and goes into the data download a Jira admin can take (described below), titles of restricted work items included
- Preferences — which card details, extra fields and outline columns are shown, which branches are open, which filter sections are pinned, the View and palette last applied, and the branch chosen on a large project
- Keyboard learning counters — how often each shortcut has been used, so the app stops offering a hint someone no longer needs, and which one-off notices a person has switched off
- Baselines — a name, a moment and who set it, saved deliberately by a person so the plan can later be compared with how it stood at that moment. No copy of the plan is kept: the comparison is rebuilt from Jira's own history of the issues when someone opens it
- A short-lived change journal — records that a card was created, moved, reordered, archived or deleted, and by whom, so other people's screens update. These expire automatically after fifteen minutes and are not a history of your project
- An archive record — which items have been archived, by whom and when, kept for about four months
- A first-edit marker — whether a person's first edit has been counted and on which day, whether their return within a week has, and the last week in which their opening Canopy was counted, so the usage counters described below count each person once
- A project-size marker — whether a project's size has been counted, so it is counted once; it holds the day it was counted and nothing about a person
- A reporting record — which people Canopy holds anything for, and one date for each: when Canopy first held something for them, or last refreshed it after Atlassian said their account had changed (see "When someone's Atlassian account is closed")
- The site's subscription state, as Atlassian reports it
Some things are stored in Jira itself rather than in app storage: as properties on each issue, sibling order, whether a card is archived (with who archived it and when), and whether a card was moved to the top level on purpose; and, on the project, a note that it uses Canopy's own hierarchy and when that choice was made — it names nobody.
What is kept on your own device
For speed, Canopy keeps a copy of what it last displayed in your browser's own storage, on your own computer: issue data it has already fetched, copies of saved Views, Branches, palettes and templates, your display preferences such as theme and text size, and a local record of errors and sync problems the app hit, which can include a card's key and field values. This never leaves your browser unless you copy the support details into a message yourself. Clearing your browser's data for the site removes it. On a browser several people share, the copies of issue data and of saved Views, Branches, palettes and templates are filed per person and cleared when a different person opens Canopy; display preferences and the local record of errors stay with the browser.
Who else is involved
Atlassian, and nobody else. Atlassian hosts the app and its server-side storage. Canopy uses no artificial intelligence service of any kind. Typefaces and every other resource are shipped inside the app rather than fetched from elsewhere.
What we can see
We cannot open your issues. Two things reach us, both held by Atlassian:
- The app's log, which Atlassian keeps for 30 days and lets us read. Canopy writes account identifiers and project and issue keys there when work is changed or archived. When a card keeps disagreeing with Jira it adds the card's key and the differing values of fields such as its status, dates and estimate — never its title, description or the people on it. A refused save never quotes the name typed for a saved View, Branch, palette or template.
- Usage counters in Atlassian's app metrics: a person's first edit (counted once per person), that person opening Canopy again on a later day within a week of it (also once per person), a person opening Canopy in a week (once per person per week), the size of a project, as one of five bands from "under 100 work items" to "20,000 and over" (once per project), a picture exported, and the note for a Jira administrator copied. Each carries its name and the number one, and no identifier, key or text. The per-person counts are approximate: rarely, one person is counted twice.
Where the information is held
Everything Canopy stores is held by Atlassian, within your own Atlassian site's platform storage. Where that sits geographically, and any data residency option, is governed by Atlassian's arrangements with your organisation, not by us.
The app's log is the exception: Atlassian decides where it is kept, your data residency setting does not cover it, and Atlassian does not publish its location. We read it from the United Kingdom.
How long it is kept
The change journal expires automatically after fifteen minutes, the archive record after about four months, and the app's log after 30 days. Everything else is kept until it is deleted in the app, or until the app is removed.
- If you uninstall the app, see "What happens if you uninstall" below.
- If a subscription or trial ends without renewal, it follows the same path as an uninstall, described below.
When someone's Atlassian account is closed
On Atlassian's required schedule, normally weekly, Canopy tells Atlassian which people it holds anything for, as Atlassian requires of every app. When Atlassian answers that a person's account has been closed, Canopy erases what it kept about them: their own saved Views, Branches and preferences are deleted, and their identifier is removed from anything shared — a team View that filtered on them, a baseline or archive record they made — while the shared item itself stays for everyone else. Text a person typed into a saved filter is left as they wrote it, the rule Jira applies to its own saved filters.
When Canopy deletes one of its own stored records — a saved View you delete, or a closed person's records during the erasure above — the app can no longer read or restore it. Atlassian keeps a deleted copy, and its backups, for a limited time so that it can recover from accidents, then destroys them.
What happens if you uninstall
Before uninstalling, a Jira admin (someone with Jira's Administer Jira permission) can download everything Canopy keeps for a project as one file: Canopy's menu, Download Canopy's data. It includes everyone's private saved Views, Branches, palettes and templates, and a private template keeps the titles of its work items even where Jira hides them from the admin, so it is offered to Jira admins only.
Removing Canopy makes its saved Views, Branches, palettes, templates, preferences, baselines, archive record and journal unavailable, but does not erase them at once.
When an admin uninstalls, Canopy keeps running until the subscription or trial ends, plus 60 days; then Atlassian deletes it. An admin can choose to remove it at once instead. A subscription that simply ends follows the same path.
Atlassian says it keeps the stored data for 28 days after that deletion. When it, and Atlassian's backups of it, are finally destroyed is set by Atlassian's own retention policy.
Reinstalling does not bring it back by itself. If you need it back, tell us straight away: with your organisation's consent we can ask Atlassian to recover it, but the request must reach Atlassian within 21 days of the deletion. Recovery is not guaranteed.
Your Jira work is untouched — the hierarchy lives in Jira's own issue links and issue properties, so every issue, and the structure connecting them, remains exactly as it was.
What Canopy wrote into Jira stays there, because it is part of your Jira data: the Canopy Hierarchy links and the dependency links made in it, each card's place among its siblings, the mark on a card moved to the top level on purpose, the project's note that it uses Canopy's own hierarchy, and the archive mark on each archived item — which includes the account identifier of the person who archived it. The regular erasure described above stops when the app is removed, so if that person's account is closed later, their identifier stays on those items until someone removes the mark in Jira.
Copies may remain in each person's browser after an uninstall; see "What is kept on your own device" for how to remove them.