Wezy JSM: Data Processing Addendum

Version dated 3 October 2026. This addendum forms part of the Wezy JSM terms for the customer subscription.

1. Parties, scope and instructions

The customer identified in the Marketplace order determines the purposes of its JSM customer voting and is the controller, or a processor acting with authority from its controller. LooksPretty, operating Wezy, processes customer personal data on the customer's behalf to provide Wezy Customer Voting for Jira Service Management Cloud. If the customer acts as a processor, corresponding instructions and protections pass through this addendum.

The order, this addendum, the product documentation, and authorized project configuration and actions form the documented processing instructions. Wezy will not use voting records for advertising, sell them, train AI models on them or combine them with Shopify customer data. Wezy will inform the customer if an instruction appears to conflict with applicable data-protection law. The customer remains responsible for the lawful collection, request content, sharing settings and organization membership it administers in Jira.

2. Processing schedule

3. Access and security

Wezy will limit access to people authorized to operate or support the service and require confidentiality for that access. The app checks permissions and licenses on the server, separates installation storage, rejects operations when access cannot be established, and checks permissions during exports. Authorized erasure restricts affected Wezy views while source and derived copies are processed. Numeric Jira fields remain subject to Jira permissions.

Wezy will maintain measures appropriate to the processing and review relevant security findings. The customer controls its Atlassian account security, project permissions and downloaded copies.

4. Hosting, subprocessors and transfers

The authorized app-hosting subprocessor is Atlassian for Forge services, under the provider's applicable Forge agreement and Forge DPA. Atlassian's own subprocessor and transfer documentation applies to those platform services. Wezy will maintain equivalent data-protection obligations in its subprocessor arrangements and remain responsible for its own obligations to the customer.

Before appointing a different direct subprocessor for app data, Wezy will notify the customer's designated contact, describe the processing and provide a reasonable opportunity to object on data-protection grounds before that processing begins. The parties will seek a suitable alternative where possible. An unresolved objection that prevents lawful provision of the affected service must be addressed before the new processing is enabled.

App records in persistent Forge SQL follow Atlassian's supported hosted-storage residency controls. This does not represent a guarantee that all execution, operational logs or voluntary support communications remain in that same location. Any restricted international transfer must use the applicable lawful safeguards; a residence claim alone is not a transfer mechanism.

Email and Crisp support are separate channels initiated by the person contacting Wezy. Customer voting data is not automatically transmitted to them by the app. Production diagnostic logs containing customer identifiers remain in Atlassian or on the operator’s computer. Only verified anonymized excerpts or synthetic examples are used in external tools, including AI tools. Local production diagnostic copies are deleted within 30 days after the issue is resolved. Customers should initially submit redacted information through support channels.

5. Requests, incidents and assistance

The customer can request assistance through wesy@wezy.app. Wezy will verify the requester's authority and assist with relevant access, correction, erasure and export requests using the available app functions and records. Project administrators can request request/organization erasure; authorized Jira administrators can request account erasure across projects. Atlassian account privacy responses can also queue erasure. Maintenance may need several runs; initiating erasure is not confirmation that all affected copies are already removed.

Wezy will notify the customer's designated contact without undue delay after becoming aware of a personal-data breach affecting customer data under this addendum, provide known relevant facts, and supply updates as investigation proceeds. Wezy will assist the customer with applicable security, breach, impact-assessment and authority-consultation duties to the extent of the processing and information available. The customer retains responsibility for its own notifications and decisions.

6. Retention, return and deletion

Daily analytical snapshots have the documented 90-day Standard and up-to-365-day Advanced retention, subject to coverage and the 30-day recovery period after a confirmed downgrade. Current voting state, activation anchors and configuration can remain during the installation's lifetime unless erased. The raw-event compaction target is 35 days subject to verified checkpoints; compaction preserves necessary retained state and is not deletion of all older personal data.

At the customer's choice, Wezy will return available customer data through authorized exports or delete customer personal data at the end of the relevant service, and remove retained copies unless applicable law requires retention. The parties will arrange this while Forge data remains accessible and reconcile the applicable platform lifecycle. Wezy will explain any lawful retention or platform restriction and will not represent a lost restoration window as a successful return. Customer-held exports and Jira content outside Wezy's control remain the customer's responsibility.

7. Information and audits

Wezy will provide relevant information to demonstrate compliance with this addendum and cooperate with authorized audits or inspections. The parties will coordinate the scope and method to protect other customers and platform security. App records and evidence do not authorize unrestricted access to other installations or Atlassian infrastructure. This coordination does not remove an audit right required by applicable law.

8. Separate provider administration

Wezy separately determines the purposes of its supplier administration and voluntary support-contact records as described in the applicable privacy notice. Such records are not automatically covered by treating all app voting data as provider-controlled data. A support request containing customer personal data requires the handling described above.

9. California customer data

Where Wezy processes California personal information for a customer subject to the CCPA, Wezy acts as the customer’s service provider. The customer discloses that information only for customer voting, organization attribution, demand scoring and analysis, configuration, exports, recovery and erasure described in Section 2.

Wezy will not sell or share that information as defined by the CCPA, use it for unrelated commercial purposes, retain or disclose it outside this service relationship, or combine it with information from other customers or its own consumer interactions, except where the CCPA permits. Wezy will comply with applicable CCPA requirements and provide the required level of privacy protection. The customer may take reasonable steps to verify compliance and, on notice, stop and remedy unauthorized use. Wezy will notify the customer if it can no longer meet these obligations, assist with applicable consumer requests and assessments, and require appropriate written restrictions for subprocessors. A direct consumer request will be handled under the customer’s instructions or referred to that customer.