This Privacy Policy explains how Next Orbit OÜ ("Next Orbit", "we", "us", or "our") handles information in connection with our website at nextorbit.app and the software products we provide, including applications we publish on the Atlassian Marketplace (the "Services").
We are committed to data minimisation: we collect as little personal data as possible, and our Marketplace apps are designed so that your content never leaves Atlassian's infrastructure.
1. Who we are
Next Orbit OÜ is a private limited company registered in Estonia.
- Registry code (registrikood): 17501338
- Registered address: Sepapaja 6, 15551 Tallinn, Estonia
- Contact: hello@nextorbit.app
For the purposes of the EU General Data Protection Regulation (GDPR), Next Orbit OÜ is the data controller for personal data processed through our website and our direct communications with you.
2. Our Atlassian Marketplace apps
Our Marketplace apps are built on Atlassian Forge and participate in the Runs on Atlassian programme. This has direct, concrete privacy implications:
Your content stays inside Atlassian. Our apps read data from your Atlassian products (such as Jira issues, sprints, and boards) only to compute the features shown to you inside the product. All processing happens within Atlassian's own cloud infrastructure.
No external transmission. Our apps do not send your data to Next Orbit servers or to any third party outside Atlassian. We operate no separate backend that receives your content.
No personal data storage by us. Our apps do not store personal data. Where an app saves configuration (for example, which board or sprint a dashboard gadget should display), that configuration is stored by Atlassian on our behalf using Atlassian-provided storage, and contains no personal data beyond the settings you choose.
Read-only where possible. Our apps request the minimum permissions (scopes) needed for their function and, where the feature allows, request read-only access only. The permissions each app requests are shown to your Atlassian administrator before installation.
When you use our apps, Atlassian processes your data as described in the Atlassian Privacy Policy. For personal data contained in your Atlassian content, your organisation is the data controller and Atlassian acts as its processor; to the extent our app processes such data on your behalf inside Atlassian, we act only as a sub-processor and do not retain or export it.
3. Information we collect through the website
Our website is a static informational site. We do not use tracking cookies or advertising trackers, and we do not run analytics that profile you.
- Server logs: our hosting provider may record standard technical information (such as IP address, browser type, and time of request) for security and to keep the site running. These logs are kept only as long as needed for those purposes.
- Web fonts: the site loads fonts from Google Fonts. When your browser requests a font, Google may receive your IP address. See the Google Privacy Policy.
- Direct contact: if you email us, we process the information you choose to send (such as your email address and message) to respond to you.
4. Why we process personal data and our legal bases
- To provide and secure our website and Services — legal basis: our legitimate interest in operating and protecting our Services (Art. 6(1)(f) GDPR).
- To respond to enquiries you send us — legal basis: our legitimate interest in communicating with you, or steps taken at your request prior to entering a contract (Art. 6(1)(f) / 6(1)(b) GDPR).
- To comply with legal obligations — legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
5. Sharing
We do not sell your personal data. We share personal data only with:
- Infrastructure providers that host our website and run our apps (including Atlassian and our hosting provider), acting as our processors under appropriate agreements;
- Authorities, where we are legally required to do so.
6. International transfers
We are based in the European Union and prefer EU/EEA processing. Where a provider processes data outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. Data retention
We keep personal data only for as long as necessary for the purposes described above or as required by law. Email correspondence is retained for as long as needed to handle your request and for a reasonable period thereafter.
8. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You may exercise these rights by contacting hello@nextorbit.app. You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon).
9. Security
We use reasonable technical and organisational measures to protect information, and we rely on the security of the Atlassian platform for our apps. No method of transmission or storage is completely secure, but we design our Services to minimise the personal data at risk.
10. Children
Our Services are intended for use by businesses and are not directed to children.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, where appropriate, provide additional notice. Continued use of the Services after an update constitutes acceptance of the revised policy.
12. Contact
For any question about this Privacy Policy or your personal data, contact us at hello@nextorbit.app.