Pulse: Privacy Policy

1. Overview

Bytera ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how Pulse, our Confluence app listed on the Atlassian Marketplace, accesses, processes, and protects your data.

Bytera is the data controller and is fully responsible for the privacy, security, and integrity of any data processed by Pulse. Atlassian is not responsible for our data practices.

Pulse runs on Atlassian Forge. Everything it stores is kept in the Forge database of your Confluence site, hosted by Atlassian in your site's location. Pulse has no server of its own, and Bytera keeps no copy of your data.

2. Data We Access

Pulse scores Confluence pages for Health and AI readiness and coaches authors while they edit. To do this it reads the following through Atlassian's APIs.

2.1 Confluence Content

• Pages and blog posts: titles, bodies, versions and dates, to count what a score is made of (words, headings, links, images, placeholder text). Pulse keeps the counts, not the text.
• The draft you are editing: while a page is open in the editor, Pulse's coach reads your draft, as you, to score it as you write.
• Spaces: the spaces each person can open, their names and keys.
• Page views: how many people read a page, for the reader numbers.
• Labels and permissions: a page's labels, and whether the signed in person may edit a page or administer a space.
• Names of a page's owner and last editor: looked up by the viewer's own browser, as the viewer, and kept only in that browser window. A name never reaches Pulse's server, its database, its logs or its analytics.

Pulse's screens make their requests to Confluence as the person using them, so Confluence applies that person's own permissions. Pulse's background work, which keeps its page index current, reads as the app; nothing it reads is shown to a person until Confluence has answered for those pages as that person.

2.2 Changes Pulse Can Make

Pulse changes Confluence in three ways and no other. Each change is made as the signed in person, so Confluence checks that person's rights, and only after that person confirms it with one click. Nothing Pulse runs by itself changes a page.

• Apply a fix: links by page id to pages Confluence shows that person in the trash become their plain words, or a quoted placeholder becomes words the person typed. Pulse shows the change first and saves it as a new version marked "with Pulse". It can be undone for 10 minutes, and the page history keeps every version.
• The label needs-review, added or removed by someone who may edit the page.
• A footer comment that mentions the page owner, with the person's own words, posted as that person. Confluence notifies the owner.

2.3 People

• Atlassian account ID: used in memory to check permissions and limits. Pulse does not store account IDs in its page index or in the rows it keeps for a person. It stores a keyed hash instead (HMAC SHA-256 with a secret made once per installation), so it can tell that two rows belong to the same person without keeping who that is. Section 4.2 lists the exceptions.
• Pulse never stores display names, email addresses or profile pictures.

3. Data Processing

3.1 Scoring

Scores are computed by Pulse's own code inside the Forge platform. No AI is used to score a page.

3.2 AI Features (Advanced edition)

On the Advanced edition, Pulse's similar meaning check finds pages that cover the same topic under different words. It uses Forge LLMs, models hosted by Atlassian inside its platform. The Standard edition sends nothing to a model; the edition is checked on Pulse's server.

• While you write a new page: Pulse sends the title of your draft and up to 150 titles of pages you can open. Pulse's screens send no page text. Every match is checked with Confluence as you before it is shown.
• For Clean up: a background job sends lists of up to 150 page titles from the page index. A pair it finds is shown only to a person who can open both pages.
• What is kept: the model answers with numbers from the list and a short reason. Pulse keeps the reason, cleaned and cut at 80 characters, and never writes it to a log or sends it to analytics.
• Limits: 25 checks a person and 200 a site a day while writing, and 100 a day for the background job. Nothing is sent to a third party AI provider.

3.3 Forge Platform

• Forge SQL: the database of your installation, where Pulse keeps everything it stores (Section 4).
• Forge LLMs: the AI features of the Advanced edition (Section 3.2).
• Forge storage: Pulse holds the storage:app permission, but this version keeps all of its data in Forge SQL and makes no call to Forge's key value store.

4. Data We Store

4.1 What Pulse Keeps

On each person's own device, Pulse's frames keep a few small notes in the browser's storage and send none of them anywhere: the coach setting, when an edit session started, a count of draft reads in the current hour, the rules of a space's policy for ten minutes, a space's review interval for a day, and similar. None holds an account ID, a name or text from a page.

4.2 Personal Data

• Keyed hashes of account IDs for page owners and last editors, and for every row Pulse keeps for a person. This is pseudonymous data: with the installation's secret, which is kept in the same database, a known account ID can be matched to its rows.
• A reader's note. "This looks wrong" lets a reader add an optional note of up to 280 characters. It is the one text a person types that Pulse stores. It is shown only to people who may edit the page and to the reader who sent it, the sender is kept as a keyed hash so the page owner reads "A reader", and it is never written to a log or sent to analytics. Kept up to 180 days while open and 30 days after it is closed.
• Titles, space names and labels, as people wrote them. A title can hold a person's name, for example the home page of a personal space.
• Keys of personal spaces, which contain a form of the owner's account ID. The page index stores them only as keyed tokens; the tables of earlier versions store them as they are.
• One older cache of the AI check of an earlier version, which no Pulse screen calls any more, keys its results by the caller's account ID. It is used for 24 hours and deleted by the weekly job.

The words of a comment and of a replaced placeholder go to Confluence as the person and are not stored by Pulse, logged or sent to analytics.

5. How We Use Data

We use the data Pulse accesses only to provide Pulse's features: scoring pages, coaching authors, listing the pages that need each person, the space and site reports, Clean up, and the three changes described in Section 2.2.

We do not sell, rent or share your data, and we do not use it for advertising or for any purpose other than providing Pulse.

6. Product Analytics

Pulse sends product-usage analytics to an analytics product on Atlassian's pre-approved allowlist: which pages, features and actions are used, marked with your site and the state of its subscription so installs can be told apart, never with a person. Pulse never sends page content, titles, names, email addresses, account IDs, text a person typed or AI prompts. Your Atlassian administrator can turn analytics off in Atlassian Administration (Connected apps, then Pulse), and Pulse keeps working normally. So that a fault cannot send a flood of events, Pulse keeps short-lived counts inside Atlassian.

7. Data Security

• Forge sandbox: Pulse runs in Atlassian's Forge environment, with tenant isolation.
• Every number is per person: lists, counts and reports are computed over the pages the person looking at them can open. Nobody sees a total over pages they cannot open, an admin included.
• Changes only as the person, after a confirmed click: see Section 2.2.
• Limits: requests, changes and AI calls are limited per person and per site.
• No page text stored: Pulse keeps counts and scores, not the text of your pages.

The Pulse security page describes the controls in detail.

8. Data Sharing and Sub-processors

We do not share your Confluence content with third parties. Scoring and AI processing stay within Atlassian's platform. Pulse uses two sub-processors:

• Atlassian: hosts Pulse on Forge, its storage and its AI models.
• PostHog (PostHog Inc., United States), an analytics product on Atlassian's pre-approved allowlist: receives only the product-usage analytics described in Section 6. It never receives your content or personal data.

No other sub-processor or external service handles your Confluence data.

We may disclose data when required by law, legal process, or to protect our rights or the safety of users.

9. Your Rights

In accordance with applicable data protection laws (including GDPR), you have the right to:

• Access: Request information about what data we process.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data. Uninstalling Pulse removes its data from your site, as described in Section 11.
• Data Portability: Request your data in a portable format.
• Objection: Object to the processing of your data.

To exercise any of these rights, please contact us at support@bytera.tech.

10. Permissions Explained

Pulse requests the following Atlassian API scopes:

11. Retention After Uninstalling

Pulse keeps nothing after it is uninstalled. Atlassian's Forge hosted storage keeps an installation's data for 28 days after an uninstall, so that a reinstall within that time can be linked to it, and then deletes it. Bytera has no copy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the "Last updated" date and, where appropriate, through our Atlassian Marketplace listing.

13. Contact

For any privacy-related questions, data requests, or security concerns:

• Email: support@bytera.tech
• Website: bytera.tech/contact
• Marketplace: Bytera on Atlassian Marketplace