Textgram
Textgram Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the agreement under which a customer ("Customer") uses Textgram – Mermaid & PlantUML Diagrams with AI ("the app"), provided by Jorge Carreras, trading as Falker, Spain ("Provider"). It applies to personal data that Provider processes on Customer's behalf, as defined in the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the California Consumer Privacy Act ("CCPA").
1. Roles
- Customer is the controller (CCPA: business). Provider is a processor (CCPA: service provider).
- Provider processes personal data only on Customer's documented instructions, which are given by using the app's features. Provider does not sell or share personal data, and does not use it for any purpose other than providing the app.
2. Scope of processing
- Subject matter and purpose: generating or changing a diagram with AI when a user clicks Generate.
- Data: whatever the user types into the AI description and, if "Change the current diagram" is selected, the current diagram code. Customers should not enter special categories of personal data.
- Data subjects: any person the user mentions in that text.
- Duration: transient. The request is processed and answered in real time; Provider stores no prompts or responses.
- Diagram rendering happens in the user's browser and is not processing by Provider. Diagram code is stored by Atlassian as part of the Confluence page, under Customer's agreement with Atlassian.
3. Sub-processors
- Customer authorises Atlassian Pty Ltd and its affiliates as sub-processor: the app runs on Atlassian Forge and AI requests are processed by Atlassian-hosted Forge LLMs.
- Provider will update this page at least 30 days before adding or replacing a sub-processor. Customer may object by email; if the objection cannot be resolved, Customer may stop using the app.
4. International transfers
AI requests may be processed outside the European Economic Area, depending on where Atlassian runs Forge LLM inference. Such transfers rely on Atlassian's transfer mechanisms, including the Standard Contractual Clauses in Atlassian's Data Processing Addendum. Where Provider itself transfers personal data outside the EEA, the Standard Contractual Clauses (Commission Decision 2021/914, Module 2 or 3 as applicable) are incorporated by reference.
5. Security
- Provider has no servers of its own; the app runs entirely on Atlassian's platform and inherits its security controls.
- Provider's error logs record only the error type and status, never prompts, diagram code or user identifiers.
- Access to the Forge developer account is protected with two-step verification.
6. Confidentiality
Only Provider has access to the app's developer account, and Provider is bound by confidentiality for any personal data it may encounter.
7. Assistance and data subject requests
Provider will assist Customer, taking into account the nature of the processing, with data subject requests, data protection impact assessments and consultations with supervisory authorities. Because Provider stores no personal data, most requests are fulfilled directly in Confluence.
8. Personal data breaches
Provider will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer's data, with the information Customer needs to meet its own obligations.
9. Deletion
Provider retains no personal data after an AI request completes. Uninstalling the app leaves no Customer data with Provider.
10. Audits
Provider will make available the information necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires, once per year or after a breach.
11. Contact
Falker (Jorge Carreras) · [email protected]