Access Review Privacy Policy
Access Review for Jira, published by Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.
Last updated: 1 September 2026.
The short version
The app runs inside Atlassian's cloud, makes no network calls outside Atlassian, and stores no permission data. Bobook Limited never receives your Jira content or your configuration.
What data the app processes
When you run a report, the app reads — as you, with your permissions — the list of projects on your site, each project's permission scheme, and the grants inside those schemes. It works out who holds the permission you selected, returns that result to your browser, and discards it.
Permission grants name groups and project roles, not the people inside them. The app does not expand group membership and cannot: doing so would need an administrative scope it deliberately does not request.
One exception, stated plainly. Jira allows a permission to be granted to a
single named individual. Where your site has such a grant, that person's
display name appears in the report as User: Jane Doe, because concealing a
grant would defeat the purpose of an access review. That name is read, shown to
you, and discarded — it is never stored and never leaves Atlassian.
This processing happens inside Atlassian Forge. The data does not leave Atlassian's infrastructure.
What data the app stores
Only which permission you last chose to review — for example
BROWSE_PROJECTS. That is a single short string.
Stored in Atlassian Forge storage. Removed when the app is uninstalled.
No project list, no scheme, no grant and no name is ever stored.
What Bobook Limited receives
Nothing automatically. We receive personal data only if you choose to send it — for example by emailing support. In that case we hold your email address and whatever you write, use it solely to answer you, and delete it when the matter is closed and no longer needed for our records.
If you send us an exported CSV to help diagnose a problem, please redact it first if it contains individual names.
Legal basis and your rights (GDPR)
Bobook Limited is established in Ireland and processes personal data under the EU General Data Protection Regulation.
For support correspondence, the legal basis is our legitimate interest in answering you. For data processed inside your Jira site, Bobook Limited acts as a processor on behalf of your organisation, which is the controller. A Data Processing Agreement is published and available to sign.
You have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. Exercise any of these by writing to support@bobook.club. You also have the right to lodge a complaint with the Irish Data Protection Commission.
Sub-processors
Atlassian Pty Ltd, which hosts the app and your Jira site. There are no others — no analytics, no error-reporting service, no advertising, no third-party APIs.
Cookies and tracking
The app sets no cookies and performs no tracking or analytics of any kind.
Changes
Material changes will be reflected here with an updated date, and noted in the app's Marketplace release notes.
Contact
support@bobook.club — Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.