Application licence

Who this is between

This agreement is between Oktul OÜ (Oktul LLC), registry code 17589681, of Seebi tn 1-703, 11316 Tallinn, Harjumaa, Estonia (“Oktul”, “we”), and the organisation that installs or uses the application (“you”). It covers every Oktul application whose Atlassian Marketplace listing names this document as its end user licence agreement, together with that application’s own documentation, release notes and privacy policy.

You accept it by installing, evaluating or using an application. If you are accepting it for an organisation, you confirm you are authorised to bind it. If you do not accept it, uninstall the application, which is the whole of what is required of you.

“Application” means the Forge application named on the listing, including its modules, updates and documentation. “Customer data” means the data in your Atlassian site, including work items, field values, page content and properties. “Installation” means one installation of one application on one Atlassian site.

Relationship to Atlassian, and which document wins

Every Oktul application is distributed, licensed and billed through the Atlassian Marketplace. Your use of the Marketplace, of Jira and Confluence, and of the Atlassian Forge platform is governed by your own agreement with Atlassian, not by this one. Atlassian is not a party to this agreement, Oktul is not an agent of Atlassian, and nothing in an application or its marketing implies that Atlassian endorses it.

Where a listing names this document, it stands in place of the Atlassian standard end user agreement for that application. Where a term here cannot be reconciled with the Atlassian Marketplace Terms of Use, the Atlassian terms prevail for the subject matter they cover and the rest of this agreement continues to apply. After that, the order is this document, then the application’s documentation and listing.

The licence

Subject to this agreement and to payment of the fees, Oktul grants you a non-exclusive, non-transferable, non-sublicensable, worldwide licence, for the term of your subscription, to install and use the application on your installations for your own internal business purposes, for the tier and user count your subscription covers.

An evaluation or trial is granted on the same terms for the length of the evaluation Atlassian provides, to evaluate the application rather than to carry production workloads. The source code is proprietary and confidential and is not licensed to you.

An application, or a capability inside one, may be offered as a beta. A beta is identified as one on the listing or in the documentation, is provided for evaluation and feedback, carries no warranty and no service level, and may change or be withdrawn. Do not put customer data you cannot afford to re-enter through a beta capability. Everything else in this agreement applies to it.

What the licence does not allow

You may not, and may not permit anyone else to:

• copy, modify, translate or create derivative works of the application;
• reverse engineer, decompile or disassemble it, or attempt to derive its source code, except so far as that restriction cannot lawfully be imposed;
• resell, rent, lease, sublicense, distribute or provide it to a third party as a service;
• remove or obscure a proprietary notice;
• use it to build, or to help anyone build, a competing product;
• circumvent the licence check or the Marketplace licensing model, or use the application beyond the tier you have paid for;
• use it in breach of applicable law or of your own agreement with Atlassian.

Fees, renewal, and what a lapsed subscription does

Fees, currency, invoicing, renewal and refunds are Atlassian’s, under the Atlassian Marketplace Terms of Use and Atlassian’s published refund policy. We take no payment directly and hold no payment details of yours.

When a subscription lapses, the application’s user-facing features stop and say where to fix it. The lapse does not delete, alter or export your data: field values and any index the application maintains stay as they were and work again as soon as the subscription is active. Where an application can block a workflow transition, it is built to let the transition through rather than turn a billing lapse into an outage, and each application’s documentation states what it does on that path.

What an application does, and what it does not

An application is provided as described in its documentation, which is the description this agreement warrants against. The documented limitations are part of that description rather than exceptions to it, and we publish them next to the capability they bound for the same reason we publish the scopes: an evaluation that has to discover a limit after purchase is one we would rather lose earlier.

Two things hold across our applications and are worth stating here, because the opposite is commonly assumed. A configuration option that decides what an application offers a user is not an access control, and your Atlassian permission scheme remains what governs access. An index an application maintains in the background is eventually consistent, so it settles shortly after a save rather than instantly.

How an application may be used

You are responsible for the customer data an application is pointed at and for having the right to process it. Our applications are ordinary business software: they are not designed, tested or licensed for use where a failure could lead to death, personal injury or environmental damage, including life support, emergency services, nuclear facilities, aircraft or vehicle control, and you may not use them there.

They are not designed for special category personal data within the meaning of Article 9 of the GDPR, and whether your Atlassian site holds any is a question about your site rather than about the application.

Security testing of a Forge application is testing of Atlassian’s platform too, so it follows Atlassian’s own policy rather than a permission we can give. A vulnerability you find is welcome: report it through our Help Center, where it gets a reference and a response target, and we will answer it as a security report rather than as feedback.

We will not bring or support a claim against you for research carried out in good faith under that policy, where you avoid privacy violations and service degradation, act only against your own installation and data, give us reasonable time to fix what you find before disclosing it, and do not exploit the issue beyond what is needed to demonstrate it. If a third party brings a claim about such research, we will make it known that it was authorised. Say who you are and we will credit you by name unless you ask us not to. There is no paid bounty, and we say so rather than implying one exists.

Your side of it

Configuration is where these applications are made safe or unsafe, and it is yours. You are responsible for:

• how each application is configured, including any option that widens what a user is shown, and for knowing who that exposes what to;
• your own permission schemes, screens, workflows and automation rules;
• the lawfulness of the customer data the application reads or writes;
• keeping your Atlassian administrator accounts secure;
• testing the application against your own requirements during the evaluation, which is what it is for.

Data protection, and which role each of us is in

Stated rather than left to be worked out, because the roles are not the same for both kinds of data and a document that leaves that open is one procurement stops at.

For customer data an application touches inside your Atlassian site, you are the controller and Oktul is the processor. For the Marketplace licence and contact detail Atlassian passes us, and for support correspondence you send us, Oktul is the controller. Our privacy policy covers the second; the data processing addendum covers the first.

That addendum is published at oktul.com/legal/dpa and is incorporated into this agreement by reference. It is published rather than available on request, deliberately: Article 28(3) requires the processor contract to be in place rather than obtainable, and a document you have to ask for is one your reviewer cannot read during the evaluation, which is exactly when they need it. If your organisation requires a signed counterpart, ask through the Help Center and we will sign the published version unchanged.

What an application does with data is decided per application and is stated in that application’s own privacy policy and documentation, not here. Some of our applications keep every byte inside your Atlassian tenancy and declare no external permissions; one that sends data to a named third party says so, names it, and says why. Read the listing you are installing from, because a promise made for the portfolio is one we would have to break.

Support

Support runs through our Help Center for installations with an active subscription or evaluation. A initial response within 24 hours, Monday to Friday, from the people who wrote the code, with resolution targets by severity in the service level agreement published on our trust page. Raise a request in the portal rather than by email, because that is where the clock is measured. Email to support@oktul.com reaches the same service desk and the same measurement.

We support each application against the Atlassian platform it runs on, which includes keeping it working when Atlassian changes that platform. What we do not promise is an unchanged interface: a platform change that forces a visible change is announced in the release notes. Nor do we promise availability, which is Atlassian’s: a Forge application has no server of ours in its path.

Intellectual property and feedback

The applications, their source code and design, and all intellectual property in them are and remain ours and our licensors’. You keep every right in your customer data and nothing here transfers any of it to us.

If you send us an idea, a suggestion or a defect report we may use it without restriction and without owing you anything, and we will not name you as its source without your permission. An application may include open source components, each licensed by its own holders under its own terms, and those terms govern those components rather than this agreement.

We will not use your name or logo as a customer reference without your written permission, which includes a case study, a listing on our website and a mention in a pitch. Permission given for one of those is not permission for the others.

Warranty, and the disclaimer that bounds it

We warrant that an application will perform materially as its documentation describes. Tell us within ninety days of the defect first appearing in your installation and we will use reasonable efforts to correct it or provide a workaround. That trigger is deliberately something a date can be put on: the previous version ran from when you noticed, which nobody can evidence and which, being our drafting, would be read against us.

If we cannot correct it or work around it, either of us may terminate the licence for that application and you may seek a refund from Atlassian under its refund policy. Where Atlassian does not refund, Oktul will refund the unused portion of the fees for that application directly. That is your exclusive remedy for a breach of this warranty.

Otherwise, and so far as the law permits, an application is provided as is, without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, or that operation will be uninterrupted or error free. We do not warrant that an application meets a requirement we have not agreed in writing, or that it will keep working unchanged if Atlassian changes Forge or the product APIs it depends on.

Nothing in this agreement excludes liability that cannot lawfully be excluded, including for death or personal injury caused by negligence, or for fraud.

Limitation of liability

So far as the law permits, neither of us is liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, goodwill or anticipated savings, or for indirect loss or corruption of data. Direct liability for loss or corruption of your data caused by our gross negligence or intentional act is not excluded: an application that writes values into your Jira should not be sold on terms that disclaim what happens when it writes the wrong ones.

Our total aggregate liability arising out of or in connection with this agreement, whether in contract, tort or otherwise, is limited to the fees paid for the application for the installation concerned in the twelve months before the event that gave rise to the claim.

That cap does not apply to any of the following, which stand outside it: our indemnity for intellectual property infringement below; a breach of the confidentiality section; our obligations under the data processing addendum and applicable data protection law; our gross negligence or intentional breach; and death or personal injury caused by negligence. A cap that swallowed the indemnity would make the indemnity decorative, which is a thing to notice before signing rather than after.

An earlier version of this document set the cap at 100 euros where no fee had been paid. That is gone. For an unpaid evaluation the cap is therefore the fees paid, which is nothing, and the carve-outs above are what carry the protection: a named figure that small next to an indemnity was worse than the maths, because it read as the measure of what we thought the promise was worth.

These limits are part of the price. The applications are priced on the basis that they carry them, and a customer who needs a different allocation of risk should raise it before purchase rather than after an incident.

Indemnities

We will defend you against a third-party claim that an application, used as this agreement permits, infringes that party’s intellectual property rights, and will pay the damages finally awarded or the settlement we agree, provided you tell us promptly and assist us reasonably.

We conduct the defence. You may take part with your own counsel at your own cost, and we will not settle in a way that admits your liability, imposes an obligation on you or fails to release you, without your consent. If such a claim is made or looks likely we may modify the application, obtain a licence for your continued use, or terminate the licence and refund the unused portion of your fees. This does not cover a claim arising from your modification of the application, from use outside what is permitted here, or from your customer data.

You will defend us on the same terms against a claim arising from your customer data, or from use of an application in breach of the section on how an application may be used.

Confidentiality

Each of us will use the other’s confidential information only to perform this agreement, protect it with at least reasonable care, and disclose it only to people who need it and are bound to keep it confidential, or where the law requires disclosure and, where we may, after telling the other. This does not apply to information that is public, already known, received from a third party without restriction, or independently developed.

Term, suspension and termination

This agreement runs for as long as you have an application installed or a subscription active. Either of us may terminate for a material breach that is not cured within thirty days of written notice, and we may suspend or terminate immediately for a breach of the licence restrictions.

On termination you must uninstall the application. Uninstalling removes the application’s field types and the values stored against them, in the same way Atlassian removes any other custom field, so export what you need first. The sections on restrictions, intellectual property, warranty, liability, indemnities, confidentiality and general terms survive, along with anything that by its nature should.

Changes to an application and to this agreement

A Forge application is updated for every installation when a new version is deployed, so you are always on the current one. We may change what an application does, and we may change this agreement. The version and date at the top are when this document last changed.

Where a change to this agreement is material and adverse to you, we will publish it here and in the application’s release notes, and tell you by email where we hold an address for your installation, at least thirty days before it takes effect. Continuing to use the application after that date is acceptance. If you do not accept it, uninstall and seek any refund from Atlassian. We will not remove a material capability without saying so in the release notes, and where a capability is deprecated we will say how long it will keep working.

General

The clauses that decide where a dispute is heard, how notice is given and what happens when part of this document fails.

• Governing law. Estonian law, without regard to its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. The courts of Estonia have exclusive jurisdiction, with Harju County Court as the court of first instance, save that either of us may seek injunctive relief in any competent court.
• Consumers. These applications are sold to organisations for business use. If you are a consumer, the mandatory consumer law of the country you live in still applies and nothing here limits it, and the exclusive jurisdiction above does not apply to you: you may bring proceedings in the courts of the country you live in, and may only be sued there.
• Notices. To us, hello@oktul.com, which reaches a person rather than a queue. To you, the contact address on the installation or the one Atlassian provides. A support request belongs in the Help Center instead.
• Export and sanctions. You confirm that you are not located in, and will not use or re-export an application in or to, a country or in favour of a person subject to European Union, United Nations or United States sanctions or export controls that would prohibit its supply, and that you are not a person with whom dealing is prohibited under those regimes.
• Assignment. You may not assign this agreement without our written consent, which we will not unreasonably withhold. We may assign it to a successor of our business, on notice to you.
• Subcontractors. We may use subcontractors and remain responsible for their compliance with this agreement. The sub-processors that touch data, if an application has any, are named in that application’s privacy policy and in the data processing addendum.
• Force majeure. Neither of us is liable for a failure caused by an event outside its reasonable control, including a failure or a change of the Atlassian platform.
• Entire agreement. This document, the application’s privacy policy and the data processing addendum are the whole agreement about the software and replace anything said before it. They do not limit a right you have under your agreement with Atlassian. No third party has rights under this agreement, and we are independent contractors rather than partners or agents.
• Severability and waiver. If a provision is unenforceable the rest stands. Not enforcing a right is not a waiver of it.
• Language. Written in English, and the English text governs. The Estonian version is a translation offered for convenience.