1. Controller

1.1Oktul OÜ (“Oktul”) is the controller of the personal data described in this policy within the meaning of Regulation (EU) 2016/679 (the “GDPR”).

1.2Oktul has not appointed a data protection officer, as Article 37 of the GDPR does not require one for its processing. Requests under this policy must be sent to legal@oktul.com.

Controller: Oktul OÜ
Registry code: 17589681
Registered office: Seebi tn 1-703, 11316 Tallinn, Harjumaa, Estonia
Contact: legal@oktul.com
This version: 2.4, effective 17.10.2026

2. Purposes and legal bases

2.1Oktul processes the personal data below for the purposes stated, on the legal basis stated under Article 6(1) of the GDPR.

2.2Where Oktul relies on legitimate interests, those interests are responding to persons who contact Oktul, administering the licences of its applications, securing oktul.com and its applications, and receiving vulnerability reports. Oktul has assessed each interest against the interests and rights of the data subjects. Oktul does not use personal data for profiling or advertising. You may object to processing based on legitimate interests under clause 10.3.

2.3Providing personal data is neither a statutory nor a contractual requirement. If you do not provide a name and an email address with an enquiry, Oktul cannot respond to it.

Enquiries and support requests: Name, email address, and the content of the message, whether sent by the contact form, by email or as a request in the Oktul Help Center. Article 6(1)(f), legitimate interests, and Article 6(1)(b) where the enquiry concerns entering into a contract.
Licence information from Atlassian: Article 6(1)(b), performance of the licence, and Article 6(1)(f), legitimate interests in keeping records of licensed installations. Set out in clause 3.
Vulnerability reports: The content of the report, the identity of the reporter and the action taken. Article 6(1)(f), legitimate interests in the security of software on which other organisations rely.
Requests to oktul.com: The request log Cloudflare keeps for the website, which records each request and may include the IP address and the browser’s user agent. Article 6(1)(f), legitimate interests in delivering the website, protecting it against abuse and diagnosing errors.
Analytics and the support widget: Article 6(1)(a), consent. Neither is loaded before consent is given. Consent is also the basis under Article 5(3) of Directive 2002/58/EC for storing information on your device that is not strictly necessary.
Oktul’s pages on other platforms: Article 6(1)(f), legitimate interests in presenting Oktul and its applications. Set out in clause 5.
Public posts in the Atlassian Community: Article 6(1)(f), legitimate interests in identifying demand for new applications. Set out in clause 6.

3. Personal data received from Atlassian

3.1When you install or subscribe to an Oktul application through the Atlassian Marketplace, Atlassian provides Oktul with the licence record and the information given when the order was placed. That information is the organisation, the Atlassian site, the tier and user count, the licence status and dates, and the names, company name, addresses, including email addresses, and telephone numbers of the persons named in the order, including the technical and billing contacts. Oktul does not determine the content of that record.

3.2Oktul uses the licence record to administer licences, to respond to support requests from licensed installations and to notify you of changes to applications you have installed. Oktul does not disclose it to third parties other than the recipients in clause 7.

3.3Oktul contacts the persons named in the licence record only about the licence, the application, support, security and changes to these documents. Oktul does not send them marketing.

3.4This clause provides the information required by Article 14 of the GDPR. The source of the data is Atlassian. Where Oktul has not otherwise been in contact with you, it provides this information within one month of obtaining the data, or at the latest at the time of the first communication with you.

3.5Atlassian is the controller of the processing relating to your use of the Atlassian Marketplace, including your payment details, which Oktul does not receive. Atlassian’s privacy policy applies to that processing.

3.6With your consent given on the Atlassian Marketplace, Atlassian loads Google Analytics on Oktul’s Marketplace listing pages with Oktul’s measurement ID. Oktul receives the resulting statistics through Google Analytics under the terms set out in clause 4.2. The consent choices are made and managed on the Atlassian Marketplace, and Atlassian’s cookie policy applies to them.

4. Use of oktul.com

4.1With your consent, oktul.com uses Google Analytics 4 to measure which pages are read. The analytics script is not loaded until you consent. Refusing consent does not affect the use of the website.

4.2Google Ireland Limited acts as processor. Advertising features, Google Signals and data sharing with other Google products are disabled. Oktul holds no advertising identifier and builds no profile across visits. According to Google’s documentation, Google Analytics 4 does not log or store IP addresses; the IP address is used to derive an approximate location and is then discarded.

4.3oktul.com uses no session recording, heatmaps, A/B testing or tag manager.

4.4One cookie, which records your consent choice, is set without consent. The cookie notice lists every cookie, local storage entry and third-party script used on oktul.com.

5. Oktul’s pages on other platforms

5.1Oktul maintains pages on LinkedIn, YouTube, Reddit and Google Business Profile. When you visit or interact with those pages, the operator of the platform processes your personal data as controller under its own privacy policy.

5.2For the statistics LinkedIn provides about Oktul’s LinkedIn page (Page Insights), Oktul and LinkedIn Ireland Unlimited Company are joint controllers under Article 26 of the GDPR, on the terms of LinkedIn’s Page Insights Joint Controller Addendum, whose essence LinkedIn publishes at legal.linkedin.com/pages-joint-controller-addendum. LinkedIn is responsible for responding to data subject requests concerning Page Insights, and Oktul forwards any such request it receives to LinkedIn. You may exercise your rights against either of them.

5.3From YouTube, Reddit and Google Business Profile Oktul receives aggregated statistics that do not identify individual visitors. Oktul processes the content of a comment or message you send to its page on those platforms to respond to it.

6. Public posts analysed for product research

6.1Oktul collects public posts from the Atlassian Community (community.atlassian.com) that describe problems with Atlassian products, to identify demand for new applications. The personal data collected is the author’s public username and the content and date of the post.

6.2The posts are analysed with the OpenAI API. Oktul does not use the collected data to contact the authors, does not publish their names and does not combine the posts with other data about them. Oktul may reply to a post publicly in the Atlassian Community, as any member may, and such a reply is not made from the collected data.

6.3A post is retained until the idea to which it relates is closed, either by being rejected or by being released as an application, and is then deleted.

6.4This clause provides the information required by Article 14 of the GDPR. Informing each author individually would involve a disproportionate effort within the meaning of Article 14(5)(b), as Oktul holds no contact details for the authors. You may object to this processing, or request access to or erasure of your posts, at legal@oktul.com.

7.1Oktul discloses personal data only to the recipients below. Each acts as a processor on Oktul’s instructions unless stated otherwise.

7.2Oktul does not sell personal data and does not disclose it for advertising.

Cloudflare, Inc.: Hosting and delivery of oktul.com, the request log, transmission of the contact form to Zoho Mail, and the Turnstile check on the contact page. Turnstile returns to Oktul a pass or fail result and no personal data. Cloudflare processes the IP address and browser signals to perform the check.
Google Ireland Limited: Google Analytics, only with consent. Google LLC may process data outside the EEA.
Atlassian Pty Ltd: The Oktul Help Center, the support widget and the Marketplace licence records. Requests are stored in the European Union under the data residency of the service desk.
Functional Software, Inc. (Sentry): Error reports sent by the support widget from your browser, only if you consented to the widget. Sentry acts for Atlassian and not for Oktul. Oktul does not receive these reports.
OpenAI Ireland Limited: Analysis of the public posts described in clause 6 through the OpenAI API. According to OpenAI’s documentation, data sent through the API is not used to train OpenAI’s models.
Zoho Corporation Pvt. Ltd: The hello@oktul.com and legal@oktul.com mailboxes, and sending contact form messages to hello@oktul.com through Zoho Mail. The account is hosted in Zoho’s EU data centre.

8. Retention

8.1Oktul retains personal data for the periods below.

8.2Oktul erases personal data on request unless the law requires its retention, in which case Oktul states the law and the retention period.

Enquiries and support requests: Until the correspondence ends, and two years after that.
Vulnerability reports: Five years from closure of the report. The period exceeds the three-year limitation period under § 146 of the General Part of the Civil Code Act (Tsiviilseadustiku üldosa seadus).
Licence information: For the duration of the licence and three years after it ends. Where the information forms part of an accounting source document, seven years under § 12 of the Accounting Act (Raamatupidamise seadus).
Public posts in the Atlassian Community: Until the idea to which the post relates is closed.
Request log: Three days, the retention period of Cloudflare Workers Logs for the plan oktul.com uses.
Consent choice: Six months, in the cookie that stores it.

9. Security

9.1Oktul operates no server and no database of its own. Oktul applications run on Atlassian Forge. The personal data Oktul holds is stored with Atlassian and Zoho in the European Union. Access is limited to named personnel, each using multi-factor authentication, full-disk encryption and automatic screen lock. Accounts are not shared.

9.2Oktul notifies the Estonian Data Protection Inspectorate of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk to the data subjects concerned, Oktul notifies them without undue delay.

9.3Oktul’s CSA STAR Level 1 self-assessment is published on the trust page. It is a self-assessment and not an independent audit.

10. Your rights

10.1Under Articles 15 to 21 of the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection. Requests must be sent to legal@oktul.com. Oktul requests identification only to the extent necessary to confirm the identity of the requester. Requests are answered free of charge.

10.2Oktul responds within one month of receiving a request. Where necessary, taking into account the complexity and number of requests, the period may be extended by two further months, in which case Oktul informs you of the extension within the first month.

10.3Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests under Article 6(1)(f) of the GDPR, including the request log, vulnerability reports, licence records and the public posts in clause 6. Oktul then stops the processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

10.4Where processing is based on consent, you may withdraw consent at any time through the cookie settings link in the footer of every page of oktul.com. Withdrawal does not affect the lawfulness of processing before the withdrawal.

10.5Oktul does not carry out automated decision-making, including profiling, within the meaning of Article 22 of the GDPR.

10.6oktul.com and Oktul applications are directed at organisations and not at children. Oktul does not knowingly collect personal data from children under 13, the age set in § 8 of the Personal Data Protection Act (Isikuandmete kaitse seadus) for consent to information society services. Where Oktul becomes aware that it holds such data, it erases it.

10.7You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee) or with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement. You also have the right to an effective judicial remedy under Article 79 of the GDPR and to compensation under Article 82 of the GDPR.

11. Transfers outside the European Economic Area

11.1Oktul is established in Estonia and stores personal data in the European Union. The recipients below may process personal data outside the European Economic Area, on the transfer mechanism stated under Chapter V of the GDPR. The standard contractual clauses are published in Commission Implementing Decision (EU) 2021/914, and a copy of the clauses Oktul relies on may be requested at legal@oktul.com.

Google: Google LLC, United States: the adequacy decision for the EU-US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795, under which Google LLC is certified, and Google’s standard contractual clauses.
Cloudflare: Cloudflare, Inc., United States: the same adequacy decision, under which Cloudflare, Inc. is certified, and Cloudflare’s standard contractual clauses.
Atlassian: Atlassian Pty Ltd, Australia, for which no adequacy decision exists: the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, Modules Two and Three, incorporated in Atlassian’s data processing addendum. Requests are stored in the European Union, and the clauses cover access to them from outside it. The usage events and error reports sent by the support widget are transferred under Atlassian’s arrangements with its own sub-processors.
OpenAI: OpenAI, L.L.C., United States, which processes data for OpenAI Ireland Limited: the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, incorporated in OpenAI’s data processing addendum.
Zoho: Zoho Corporation Pvt. Ltd, India, for which no adequacy decision exists: mail is stored in Zoho’s EU data centre, and support access from outside the EEA rests on the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, Module Two, incorporated in Zoho’s data processing addendum.

12. Changes to this policy

12.1Oktul amends this policy when its processing changes. The version number and effective date at the top of this page identify the version in force. A change to the personal data collected, to the recipients or to the legal basis is recorded in the version history. Oktul notifies the technical contacts of installations and Atlassian of a material change to this policy.

Version history. 2.4, effective 17.10.2026: contact form messages are sent through Zoho Mail, which already hosts the mailboxes, instead of Cloudflare. 2.3, effective 16.10.2026: contact form messages are sent by Cloudflare instead of Zoho ZeptoMail; Zoho keeps only the mailboxes they arrive in. 2.2, effective 28.09.2026: the right to object stated separately under Article 21(4) of the GDPR; how to obtain a copy of the standard contractual clauses; the essence of the joint controller arrangement with LinkedIn; feedback and product emails to licence contacts removed, so that Oktul contacts them only about the licence, the application, support and security, as section 8.4(c) of the Atlassian Marketplace Partner Agreement allows; the licence record described as section 4.1 of the Atlassian Marketplace Terms of Use sets it out; notice of material changes to installations and Atlassian; Articles 79 and 82 of the GDPR. 2.1, effective 28.09.2026: restated in numbered clauses; the request log, feedback and product emails to licence contacts, public posts analysed for product research, Oktul’s pages on other platforms, the analytics on its Marketplace listings, the statement under Article 13(2)(e) of the GDPR, the contact details of the supervisory authority, the retention of accounting records and the legal name of Sentry added. 2.0, effective 09.09.2026: the legal basis for each purpose, the information under Article 14, Atlassian Pty Ltd and Zoho Corporation Pvt. Ltd with their transfer mechanisms, and retention periods added; the support widget made subject to consent. 1.0, effective 03.09.2026.

Questions about this document

Write to legal@oktul.com.

For what a specific application does with the data in your Atlassian ecosystem, see the privacy policy in its own documentation. Every application is listed on the applications page.