Privacy Policy
Effective date: 2026-09-10 · Last updated: 2026-10-13
Scope. This policy covers only Arkidor for Confluence, the Atlassian Forge app distributed through the Atlassian Marketplace. It does not cover the standalone Arkidor web application at arkidor.io, which has its own separate privacy policy and a different data flow. The two products are legally distinct.
1. Who we are
Arkidor for Confluence is published by Knaap, owned by Arthur van der Knaap.
- Address: Itäinentie 50, 06100 Porvoo, Finland
- Business ID: 2183315-9 · VAT: FI-21833159
- Contact: support@arkidor.io
- Governing law: Finland
- Supervisory authority: Office of the Data Protection Ombudsman (Finland)
Our role depends on the processing activity (see §5). For your architecture content inside your Confluence tenant we act as a processor on your behalf; for error-monitoring telemetry we act as a controller in our own right.
2. How Arkidor for Confluence works
Arkidor for Confluence is a Forge app that runs inside your Atlassian (Confluence Cloud) tenant.
- Your models live in your tenant. Each ArchiMate model is stored as page attachments on a dedicated Confluence page inside your own tenant — the editable source, metadata, and rendered previews. These attachments are owned by you, governed by Confluence's own permission model, and they survive uninstalling the app.
- Views can be embedded on other pages, which reference the model's source page.
- Reads and writes stay inside your tenant. When the app displays a model, it reads the attachments from your Confluence tenant. When you save, the app writes the updated model source, metadata, and view previews back as attachments — using your own Confluence session, so Confluence's version history attributes each change to you. We do not operate a separate server-side database for your model content, and the reads/writes do not route through any Knaap-operated server.
- Error telemetry is sent to Sentry. To detect and fix defects, the app sends technical error reports to Sentry. Your model content and page titles are designed to be removed on your device from error and breadcrumb messages and from the report page URL and breadcrumb URLs before the report is sent; this client-side scrubbing is a best-effort control, not an absolute guarantee. Technical identifiers such as page, space or model IDs may appear in error and breadcrumb messages. Stack traces contain only the app's own code locations (function names and line numbers). The browser's
Referervalue is not sent. Your Confluence site address (domain only) can still appear in a report (see §4). The reports do still carry limited diagnostic personal data — your IP address (for delivery), pseudonymous device metadata, and stack-trace function names — which is the only category of data about your use of the app that is sent to a third-party service used by us. See §4 for exactly what is and is not sent.
3. Personal data we handle inside your Confluence tenant
When you use the app, it handles the following inside your tenant:
| Data | Purpose | Notes |
|---|---|---|
Confluence account IDs (read:user:confluence) |
Resolve author display names in a model's version history | Account IDs are Atlassian identifiers; we look up names via Confluence's own users API |
| Page titles, page and space identifiers | Create model pages, embed views, index references | Handled to place and link diagrams; stored in Confluence, not on our systems |
| ArchiMate model content (element names, documentation, diagrams) | The content you author | Stored as attachments in your tenant; we do not extract, copy, or store it on our own systems |
The only data about your use of the app that leaves your tenant to a third-party service used by us is the cleaned error telemetry described in §4. We do not sell it, use it for advertising, profile individuals, or aggregate it with other sources.
4. Error monitoring (Sentry)
To keep the app reliable, its interface reports runtime errors to Sentry (Functional Software, Inc.), configured for the EU region (ingest host *.ingest.de.sentry.io). Error telemetry is classified as out-of-scope End-User Data under Atlassian's Forge framework; it is nevertheless personal data under the GDPR and is handled as described in this section.
Model content is cleaned on your device before sending. Your ArchiMate model content and page titles are designed to be removed on your device by client-side hooks from error and breadcrumb messages and from the report page URL and breadcrumb URLs before the report is sent to Sentry — they are not "sent then deleted". This client-side scrubbing is a best-effort control, not an absolute guarantee. Technical identifiers such as page, space or model IDs may appear in error and breadcrumb messages. Stack traces contain only the app's own code locations (function names and line numbers). Breadcrumb data other than the URL, request method, status code and logger name is discarded. The browser's Referer value is removed in the same step (see the Page URL row below). This client-side scrubbing does not mean that no personal data leaves your browser: to make an error report useful, a limited set of diagnostic personal data is still transmitted to Sentry — namely your IP address (sent with the HTTPS request; with sendDefaultPii: false it is not attached to the stored event payload), pseudonymous browser/OS metadata, and stack-trace function names. Because Sentry (Functional Software, Inc.) is a US-based processor, that diagnostic data may be processed in the United States; any such transfer is safeguarded by the EU-U.S. Data Privacy Framework and, as a fallback, the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor) under Sentry's Data Processing Addendum (v5.1.0). See §7 for transfers. The table below sets out exactly what is and is not sent.
What is sent (after cleaning):
| Data element | Notes |
|---|---|
| IP address | Transmitted to Sentry as part of the HTTPS request for delivery; with sendDefaultPii: false it is not attached to the stored event payload, and Sentry's server-side "do not store IP address" setting is enabled, so it is not stored by Sentry |
| Browser type/version, operating system | Pseudonymous context to identify environment-specific defects |
| Browser locale, time zone and calendar settings | Helps reproduce locale- and date-specific defects |
| Truncated error stack trace | Function and line context from the app's code only (potentially personal) |
| Page URL | The report's page URL is the address of the app's own interface (hosted by Atlassian Forge, not your Confluence page), reduced to its host and path (query string and hash removed). The browser's Referer value, and any other request header that contains a URL, is not sent. URLs in navigation and network-request breadcrumbs are reduced to the path for the app's own pages and to the site address (domain only, for example https://example.atlassian.net) for other addresses, such as your Confluence site. Your Confluence site address can therefore appear in a report; space keys, page IDs and page titles in Confluence URLs are removed before sending |
| App version + environment | Release/staging identifier |
What is designed not to be sent: your ArchiMate model content, page titles, names or email addresses, session replays, release-health session tracking, behavioural analytics, cookies, or device fingerprints. Sentry is configured with sendDefaultPii: false and no performance tracing.
- Lawful basis: legitimate interest (GDPR Art. 6(1)(f)) — ensuring service reliability and security.
- Data subjects include people who view a page containing an Arkidor macro, not only editors, because the interface initialises error monitoring when it loads.
- Retention: error events are retained for 90 days, then deleted.
- Right to object: you may object to this processing by contacting support@arkidor.io.
- Administrator opt-out. Arkidor for Confluence participates in Atlassian's Runs on Atlassian program and declares its Sentry error-monitoring egress under the
analyticscategory. A Confluence site administrator can disable the app's error-analytics egress to Sentry at any time using Atlassian's admin data-egress controls. When this egress is disabled, no diagnostic data is sent to Sentry.
5. Our role (controller vs. processor)
| Activity | Data | Our role | Your role |
|---|---|---|---|
| Storing/handling your models and user/title data in your tenant | Attachments, account IDs, page titles | Processor | Controller |
| Error monitoring via Sentry | Scrubbed technical error context | Controller | — |
Our customer Data Processing Agreement is published at dpa.html and applies automatically; contact support@arkidor.io for a counter-signed copy.
6. Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Atlassian | Forge hosting, app runtime, tenant storage, billing | Per Atlassian data residency |
| Functional Software, Inc. (Sentry) | Error monitoring | EU (*.ingest.de.sentry.io) |
| Amazon Web Services EMEA SARL (AWS) | Help/documentation page hosting (CloudFront/S3, incl. access logs); support communications (support@arkidor.io); product feedback board | EU (eu-west-1, Ireland) |
AWS does not process your in-tenant model content, and the app itself does not route data through AWS. Personal data reaches AWS only in two limited ways: (a) when you choose to email support, create a feedback-board account, or post to the feedback board; and (b) standard CloudFront access logs (IP address, user-agent, requested path, timestamp) generated when your browser loads our help/documentation pages. These access logs do not record cookies, and the help/documentation pages set no cookies. Access logs are retained for 90 days (see §8).
The current, authoritative list — with data categories and transfer mechanisms — is maintained on our sub-processors page.
7. International transfers
Error telemetry is ingested and stored in Sentry's EU region (*.ingest.de.sentry.io). Sentry (Functional Software, Inc.) is a US-based processor, so limited error-telemetry data may be processed in the United States; any such transfer is safeguarded by the EU-U.S. Data Privacy Framework and, as a fallback, the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor), together with the additional safeguards in Sentry's Data Processing Addendum (v5.1.0). Your model content remains in your Confluence tenant and is subject to Atlassian's data-residency configuration. All AWS infrastructure is in the EU (eu-west-1, Ireland). Where any other transfer outside the EEA occurs via a sub-processor, it relies on that sub-processor's transfer mechanism, as shown on our sub-processors page.
8. Retention
- Model content and tenant data: retained in your Confluence tenant under your control and removed when you delete it. Attachments persist after app uninstall — they are yours.
- Sentry error events: 90 days, then automatically deleted.
- Help-page access logs (AWS/CloudFront): 90 days, then automatically deleted; cookies are not recorded in these logs.
9. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and may object to processing based on legitimate interest. For data inside your Confluence tenant, you (or your organisation, as controller) manage most of these directly in Confluence; for Sentry telemetry, contact support@arkidor.io. You may also lodge a complaint with the Finnish Data Protection Ombudsman or your local supervisory authority.
10. Children
Arkidor for Confluence is a professional tool and is not directed at children.
11. Changes
We will update this policy as the product evolves and post the revised effective date above.
12. Contact
Knaap · Itäinentie 50 · 06100 Porvoo · Finland · support@arkidor.io