Legal

Microapps privacy policy

This policy explains what personal data SMART EDU ONLINE LTD collects when you use our microapps or these documentation pages, why, and what your rights are. The short version: the content you put into our apps stays in your own Atlassian site, and we can't see it.

Last updated 2026-11-07

Who we are

SMART EDU ONLINE LTD, trading as Smart Engineering and Development, is a company registered in England and Wales under number 13282889. Registered office: Flat 5 Upton Court, 21 Alwynn Walk, Birmingham, England, B23 7YY.

For the personal data described in What we receive we are the controller. We are registered with the Information Commissioner's Office under reference ZB029029.

Contact: office@smarteduonline.co.uk.

This policy covers the microapps listed at smarteduonline.co.uk/microapps and these documentation pages.

In short

  • Your content stays in Atlassian. Our apps run on Atlassian Forge and keep their data in your own Atlassian site. They call nothing outside Atlassian, and we can't see that data.
  • Some apps record who did what. Signworthy, Readworthy and Clockworthy keep the Atlassian account IDs of the people who approve pages, confirm they have read them or own a schedule, inside your Atlassian site, because that is their record.
  • We receive only what we need to run the business: licence details and contacts from the Atlassian Marketplace, the emails you send us, and technical error information without your content.
  • No analytics, advertising or tracking cookies on these pages or in our apps.
  • We don't sell personal data.

Content you put into our apps

Content you create in an app, such as glossary terms and definitions, is stored in your Atlassian site: in the app's storage (Atlassian Forge storage) or, for Riskworthy's risk assessments, on your Jira issues themselves. Atlassian hosts both. Our apps don't send it anywhere else, and we have no access to it.

Some apps read content you can already see in order to work. For example, Glossworthy reads the text of the page you are viewing to find glossary terms on it. That reading happens as you, inside Atlassian, and the text is not stored.

Some apps also record which Atlassian account did something, because that is what they are for. Signworthy stores the Atlassian account IDs of the people who request, approve, reject or withdraw a page approval, with the time and the page version, to keep its audit trail. Readworthy stores the account IDs of the people asked to read a page and of those who confirmed it, with the time, the page version and the result; in its privacy mode it keeps only the result, the score and the time, not people's answers. Clockworthy stores the account ID of each schedule's owner and of the assignee of the issues it creates. These apps don't store names or email addresses: Atlassian shows current names when a page, issue or report is viewed. As Atlassian requires of apps that store account IDs, they report them to Atlassian every week, and when Atlassian says an account has been closed they replace that account ID with "(deleted user)". This data stays in your Atlassian site, and we can't see it.

Clockworthy creates each scheduled issue as the schedule's owner, using Atlassian's user impersonation for Forge apps, so the owner is the issue's reporter. Atlassian manages that permission; the app never sees a password or token.

Your organisation decides what goes into its Atlassian site and controls that content, and Atlassian hosts it under its own terms. To access, correct or delete it, use the app itself or ask your Confluence or Jira administrator.

Each app's documentation page lists exactly what that app stores and reads: Glossworthy, Signworthy, Riskworthy, Clockworthy and Readworthy.

What we receive, why, and for how long

InformationWhere it comes fromWhy we use itLawful basisHow long we keep it
Licence details: organisation name, Atlassian site address, licence type and tier, dates, and the names and email addresses of the technical and billing contactsAtlassian Marketplace, when your organisation evaluates or buys an appTo manage licences, keep accounts, answer questions about your licence and send essential service notices about the appContract; legal obligation (accounting records)While the licence is active, then 6 years for accounting records
Support messages: your name, email address, what you write and anything you attachYou, when you email usTo answer your request and fix problemsLegitimate interests (supporting our customers); contract where you have a licence24 months after we close the request
Technical error information: error type, HTTP status code, time, app version and site identifier. Never your contentAtlassian, through the Forge developer consoleTo find and fix faultsLegitimate interests (keeping the apps working and secure)As long as Atlassian keeps Forge logs; we don't copy them elsewhere
Website request data: IP address, browser type and the page requestedYour browser, when you open these pagesTo deliver the pages and keep the site secureLegitimate interestsAs set by our hosting and font providers (below)

We don't make decisions about you based solely on automated processing.

Who we share it with

WhoWhat for
AtlassianRuns the Marketplace (sales, billing, licensing) and hosts our apps and their data
Microsoft (Microsoft 365)Our email, including the support mailbox
NetlifyHosts this website
Google (Google Fonts)Serves the fonts these pages use. Your browser requests them from Google, which sees your IP address
Our accountants and professional advisersWhere needed to run the company and meet legal obligations
Courts, regulators and law enforcementOnly when the law requires it

Atlassian, Microsoft, Netlify and Google may process data outside the UK, including in the United States. Where they do, the transfer relies on a safeguard recognised by UK data protection law, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum.

Cookies

These pages and our apps don't set cookies or use analytics, advertising or tracking.

Our hosting provider, Netlify, may show a small Netlify badge on the site. If you choose to hide it, your browser remembers that choice in its local storage for a week. Nothing is sent to us.

How we protect it

Our apps are designed so that your content never leaves Atlassian, and their logs record only error types, status codes and counts. We keep the personal data we hold to a minimum, limit who can access it, and protect the accounts that hold it with strong authentication.

Your rights

Under UK data protection law you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or transfer it to someone else. Some rights apply only in certain circumstances.

Email office@smarteduonline.co.uk. We reply within one month. For content stored inside an app, contact your organisation's Confluence or Jira administrator, because your organisation controls it.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

Our apps are business software and are not intended for children.

Changes to this policy

We'll update this page when our practices change and show the date of the latest version at the top. If a change materially affects how we use personal data, we'll also tell licence contacts by email before it takes effect.