Roll-up Reports
Data Processing Addendum
Effective 24 October 2026
How we handle personal data for you when you use Roll-up Reports for Jira. This addendum is part of the Roll-up Reports terms of use and applies automatically. There's nothing to sign.
1. Who's who
- You (the customer): the organisation that installs Roll-up Reports on its Jira site. For the personal data in your Jira site, you're the controller, or a processor acting for your own client.
- We (Stray Anchor): Stray Anchor Pty Ltd (ABN 22 700 917 111), Perth, Western Australia, the maker of Roll-up Reports. We process that data for you, as your processor.
- Data protection law means whichever of these applies: the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the Australian Privacy Act 1988.
If this addendum and the terms of use disagree about personal data, this addendum wins. If this addendum and the Standard Contractual Clauses in section 6 disagree, the Clauses win.
2. What we process, and why
Roll-up Reports shows your Jira issues as pivot tables and roll-up reports, and keeps a daily history of the reports you choose. That's the only purpose. We don't sell or share the data, analyse it for anything else, or use it to train AI.
| People | Your Jira users (report owners, people reports are shared with, people named in issues, such as assignees and people who logged work), and anyone named in your issues' fields and summaries. |
|---|---|
| Data | Atlassian account IDs; display names; issue keys and summaries; field values used in reports; worklog authors and times. Live reports read these from Jira as the person looking and don't store them. Saved reports store their settings and sharing lists; history stores each day's totals per group, whose names can include people's names, issue keys, summaries and field values. |
| Sensitive data | None is needed. Anything in a Jira field a report groups by can appear as a group's name. |
| What we do with it | Read issues from Jira when a report is opened or its history is taken, add them up, and show the result to people allowed to see it. This goes on while Roll-up Reports is installed. |
| How long | Reports: until deleted (the last 50 saved versions of each). History: 90 days on a paid plan. Daily view counts: about 13 months. Data kept between history runs: two days at most. Everything: until Roll-up Reports is removed from your site, or retired, as in section 4. |
3. Sub-processors
| Atlassian Pty Ltd (ABN 53 102 443 916) and its affiliates | Run Roll-up Reports on Atlassian's Forge platform, and store its reports, history and settings for your site. Stored data follows your Jira site's data residency. This is the only sub-processor for your Jira data. |
|---|---|
| Cloudflare | Receives email sent to our support address. Only if you contact support. |
| Microsoft Azure | Hosts our support desk, where support conversations are kept. Australia. Only if you contact support. |
| Amazon Web Services (Amazon SES) | Sends our replies to support requests. Sydney, Australia. Only if you contact support. |
- We run no servers of our own, and Roll-up Reports sends nothing outside Atlassian.
- Each sub-processor is bound by terms that protect the data at least as well as this addendum, and we stay responsible for them.
- We'll give at least 30 days' notice before adding or replacing a sub-processor, by email to the contacts on your Roll-up Reports subscription and on this page.
- You can object on reasonable data protection grounds. If we can't resolve it, you can uninstall Roll-up Reports, and we'll refund anything you've prepaid for the time after that date.
4. Our promises
We will:
- Process the data only on your documented instructions: these terms, the reports and settings you make in Roll-up Reports, and your use of it. If a law makes us do anything else, we'll tell you first, unless that law forbids it. If we think an instruction breaks data protection law, we'll tell you.
- Make sure everyone who can reach the data is bound to keep it confidential, and that only people who need it to run Roll-up Reports can reach it.
- Keep the security measures in section 7.
- Use only the sub-processors in section 3, on the terms set out there.
- Help you answer people's requests to see, correct or delete their data. Much of it is self-service: report owners and Jira admins can delete reports and turn history off. Each week, accounts Atlassian reports as closed are removed automatically. For anything else, email us.
- Tell you without undue delay, and within 48 hours of becoming aware, about a personal data breach that affects your data. We'll say what we know and what we're doing, and keep you updated.
- Help with data protection impact assessments and with questions from regulators, where the information is ours.
- At the end: when Roll-up Reports is removed from your site, Atlassian keeps its stored data for your site for 28 days, during which it can be recovered on request, and then deletes it. If we retire Roll-up Reports, it stops on every site after the notice in the terms of use, and Atlassian deletes its data within 30 days. We keep no copy anywhere else. Reports can be exported to Excel or CSV before then.
- Give you the information you need to show we keep these promises, and allow reasonable audits. First by written questions and this page. Then, if you still need it, a review at your cost on 30 days' notice, no more than once a year unless a regulator requires it or there's been a breach.
5. Your part
- Make sure you're allowed to process the personal data in your Jira site, and that your instructions follow the law.
- Decide who your reports are shared with, and keep access to your Jira site secure.
6. Data from Europe, the UK and Switzerland
Roll-up Reports's data stays in Atlassian's platform, in your site's data residency location. Stray Anchor is in Australia, which doesn't have an adequacy decision from the EU, the UK or Switzerland. So where data protection law treats your use of Roll-up Reports (or of our support) as a transfer of personal data to Australia, these apply and form part of this addendum:
- EU: the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914. Module 2 (controller to processor) applies where you're a controller, and Module 3 (processor to processor) where you're a processor. You're the data exporter and Stray Anchor is the data importer. Clause 7 applies. Under Clause 9, option 2 (general written authorisation) applies, with the 30 days' notice in section 3. The optional wording in Clause 11 doesn't apply. Under Clause 13, the supervisory authority is the one Clause 13(a) points to for you. Under Clauses 17 and 18, Irish law governs the Clauses and the courts of Ireland hear disputes. Annex I is sections 1, 2 and 6 of this addendum, Annex II is section 7, and Annex III is section 3.
- UK: the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner (version B1.0), filled in with the same details. Neither party may end it under its Section 19.
- Switzerland: the EU Clauses, adapted for the Swiss Federal Act on Data Protection. References to the GDPR mean the Swiss Act, the Federal Data Protection and Information Commissioner is the supervisory authority, and people in Switzerland can bring claims there.
For Annex I, the data exporter's details are those in your Atlassian account and Roll-up Reports subscription. The data importer is Stray Anchor Pty Ltd, Yangebup WA 6164, Australia. Contact: hello@strayanchor.com.au
7. Security measures
- Access: live reports call Jira as the person looking, so Jira's own permissions decide what they see. Reports are private until shared, and only a report's owner or a Jira admin can change who it's shared with. Admin actions check the person is a Jira admin on every call.
- History: each person sees only the projects they can see in full; totals from other projects are left out before anything is added up, and their issue names are hidden. Issues with a security level are never stored, and nor are their names.
- Separation: each site's data lives in its own Forge storage, and nothing about one site is kept in memory for another.
- In transit and at rest: within Atlassian's platform, over HTTPS, and encrypted at rest by Atlassian.
- Least privilege: the app asks Jira only for read access, and has no keys or passwords of its own.
- Keeping little: no copies of issues are stored; history keeps totals for 90 days; closed accounts are removed every week through Atlassian's personal data reporting.
- Checked input: every call from the app's pages is checked; queries are only ever run as the person or, for history, as the app with the report owner's query; the database is only queried with bound values.
- Testing: automated tests on every change, including permission tests, and a written security self-check.
8. Australian privacy law
Stray Anchor is an Australian company. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988. Where the Notifiable Data Breaches scheme applies to a breach, we'll notify the Office of the Australian Information Commissioner and the people affected, working with you.
9. Liability
Liability under this addendum is subject to the limits in the terms of use. Nothing limits people's rights under the Standard Contractual Clauses, or any liability the law doesn't allow to be limited.
10. Changes, transfer and contact
We may update this addendum when the law, our sub-processors or Roll-up Reports change. We'll change the date at the top and tell you at least 30 days ahead about any change that matters.
If another company takes Roll-up Reports over, we may transfer this addendum to it, with the terms of use, if it agrees to keep to them. It then becomes your processor, and the data importer under the Clauses in section 6. We'll tell you at least 30 days ahead, and you can object as in section 3.
Questions about privacy or this addendum: hello@strayanchor.com.au