Privacy Policy: Assets In for Jira Service Management
Last updated: 2026-10-21
Assets In for Jira Service Management ("the app") is an Atlassian Forge app for Jira Cloud, published by Plainwork Apps ("the developer"). It adds an Assets Import page in Jira, available to Jira administrators, where a user selects an export ZIP file from their device, reviews a plan, and restores Assets objects from it on the same site. The app writes to Assets: it creates objects and, in Restore mode, changes attribute values. It never deletes objects and never changes schemas, object types, attributes, or statuses.
Summary
- The app has no developer-operated backend. Its interface runs in your browser inside Jira, is hosted on Atlassian Forge, and calls Jira through Forge Bridge.
- The app has no developer-operated data collection endpoint and does not send Jira or Assets data to the developer or an external service. It has no external egress and no analytics.
- Installing the app does not give the developer a separate account or access to your Jira site.
- The app stores no data. The package file is read from the user's device in the browser and its contents are sent only to the site's own Assets API.
- The app writes to Assets only after the user reviews and confirms a plan, and only with the user's own Assets permissions.
- The correctness and suitability of the package, the choice of mode, and the confirmation are the responsibility of the user and their organization.
Data the app accesses
The app reads this data from your site's Assets, using the permissions of the signed-in user:
| Data | Why |
|---|---|
| Assets workspace ID | To address the Assets REST API of the site |
| Object schemas | To find the schemas that the package refers to |
| Object types | To match the types in the package to the types on the site |
| Attribute definitions of the types in the package | To validate and format attribute values before writing |
| Objects, looked up by ID with AQL | To build the plan: to tell which objects are missing, unchanged, or different on the site |
| Forge context provided by Forge, such as the current user's account ID, locale, and site identifiers | To run the app inside Jira |
The app also reads the export ZIP file that the user selects from their device. The file is processed in the browser and is not uploaded anywhere except as described below.
The Assets object endpoints return more than the app uses. Their responses can include avatar data with media access tokens and, for user attributes, account IDs, display names, and email addresses when Assets makes them available. The responses are received in browser memory and are never written to any file.
The app writes to Assets using POST requests that create objects and, in Restore mode, PUT requests that change attribute values of existing objects. The values written come from the selected package and are sent only to the site's own Assets API. Writes happen only after the user confirms the plan. The app does not delete objects and does not change schemas, object types, attributes, or statuses. All writes are made with the signed-in user's own Assets permissions, so a user can change only what Assets allows that user to change.
Data the app stores
None. The application code does not persist Jira or Assets data to Forge storage, a separate database, cookies, or browser local storage, and does not implement logging of that data, analytics, or tracking. The package contents, API responses, and the plan are held in browser memory while the page is open. The browser may cache the app's static files; Jira and Forge manage their own authentication and platform operations.
Plan and report files
The app can generate a plan file and a report file. They are created in the browser and saved to the user's device. Depending on the package, they contain object IDs, keys, labels, attribute values, the Atlassian account ID and display name of referenced users, and the outcome of each object. They do not contain email addresses, avatars, or media access tokens.
These files can contain business data and personal data from your Assets. Once saved, a file is outside the app, Jira, and the developer's reach. Your organization and the user who saves it decide how it is stored, shared, and deleted, and are responsible for doing so in line with their own policies and applicable law.
Responsibility for changes to Assets
The app changes data in your Assets only as instructed by the user. The correctness and suitability of the package, the choice of mode (Create missing or Restore), and the confirmation of the plan are the responsibility of the user and their organization. Changes made to Assets are recorded and handled by Atlassian (for example in object history) under your agreement with Atlassian.
Permissions (scopes)
| Scope | Use |
|---|---|
read:servicedesk-request | Find the Assets workspace ID of the site |
read:cmdb-schema:jira | List object schemas |
read:cmdb-type:jira | List object types |
read:cmdb-attribute:jira | Read attribute definitions |
read:cmdb-object:jira | Read objects and run AQL lookups to build the plan |
write:cmdb-object:jira | Create objects and, in Restore mode, update attribute values |
All requests use Forge Bridge requestJira on behalf of the signed-in user. Access is limited by both the app's declared scopes and that user's Assets permissions. The app has no delete scopes.
Sharing and third parties
The app does not transmit Jira or Assets data to the developer or external services. It does not sell data or use it for advertising. If you contact the developer and supply information in a support request, that information is separate from the app's automatic data processing.
Your data is processed by Atlassian (Jira, Assets, and Forge) under your agreement with Atlassian. See the Atlassian Privacy Policy.
Data retention and deletion
The app has no developer-operated data store and stores nothing on your site. The package contents and Assets data are held in browser memory during use and are released when the page is closed or reloaded. Uninstalling the app removes its access; there is no app data to delete. Atlassian controls retention of Jira and Assets data, including the history of changes made through the app, under your agreement with Atlassian. Retention and deletion of the package, plan, and report files is up to your organization.
Security
The app calls Jira through Atlassian's Forge Bridge over HTTPS. It has no developer-operated server and does not require users to provide API tokens. Authentication for those requests is managed by Jira and Forge.
Children
The app is a workplace tool and is not directed at children.
Changes to this policy
If the app's data handling changes, for example if a backend is added, this policy will be updated and the date above changed.