Legal

Privacy Policy

Effective date: 22 September 2026

Provider: GxP Seal, LLC — a Delaware limited liability company (file no. 7890123), registered agent 1201 North Orange Street, Suite 700, Wilmington, DE 19801, USA (“we”, “us”).

Governing law: Delaware, USA. Where we process personal data of individuals in the EU/UK, the GDPR also applies (see §§9 and 11).

EU Representative (GDPR Art. 27): EU Verify (Euverify Ltd), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, Ireland. Individuals in the EU/UK may contact our EU representative on GDPR matters.

Contact: [email protected]

1Scope

This policy covers (1) the GxP Seal app — a Confluence Cloud app on Atlassian Forge that adds electronic signatures and audit evidence to Confluence pages — and (2) the GxP Seal website, gxpseal.com. We handle data very differently in each, so they are described separately.

2Our role

App data: your organisation is the data controller; we act as a processor on your behalf, only to provide the app’s function. Atlassian hosts the underlying infrastructure and storage.
Website data: we are the controller for the limited contact information you choose to send us (see §8).

3What the app processes

The minimum needed to produce a compliant signature and its audit trail:

Data	Why	Stored?
Atlassian account ID of the signer	Signer identity	Yes, in the signature record
Signer printed name and email	To manifest who signed	Yes
Signing credential you set	Second signature component	Only as a salted scrypt hash — never plaintext, never logged
Hash of the page content at signing	Bind a signature to an exact version	Yes (the SHA-256 hash only — not the page body)
Signature records and audit chain	The tamper-evident audit trail	Yes, append-only
Group memberships of the caller	Verify admin/authority at action time	Read transiently; not stored
Account IDs you notify, and who triggered a notification	Approval-flow notifications and their audit log	Yes, in the flow-event log

The app reads a page’s body at signing time to compute its hash; it does not store the page body.

4What the app does not do

No external egress. No remote backend, no third-party service, no email. Your data never leaves Atlassian’s infrastructure.
No tracking, analytics, profiling or advertising in the product.
No sale or sharing of personal data.

5Where app data is stored

All app data is stored in Atlassian-hosted Forge storage. Because storage is Atlassian-hosted, it inherits your Atlassian site’s data-residency controls — we add no storage location of our own.

6Sub-processors

Beyond Atlassian (the platform on which the app runs and stores data), the app uses no sub-processors. There is no third party in the data path.

7Retention and deletion

Signature and audit records are append-only by design — they are the compliance evidence and are not edited or deleted by the app in the ordinary course. You control retention through the app’s compaction/export features and your own procedures.
Signing credentials can be reset by the user or cleared by an administrator; the app keeps only the current salted hash.
On uninstall, Atlassian removes the app’s storage for your site in accordance with the Atlassian Forge data-lifecycle.

8The website (`gxpseal.com`)

We collect only the information you choose to send us — for example, your email address and message when you request access or contact support.
No cookies, no analytics, no third-party trackers. The site sets no advertising or analytics cookies and embeds no tracking scripts.
We use your contact information only to respond to you and, if you opt in, to send product updates.

9Your rights

Requests to access, correct, export or delete personal data held in the app are directed to your organisation (the controller), which we support as processor. For website contact data (where we are the controller):

EU/UK residents (GDPR): rights of access, rectification, erasure, restriction, portability and objection; we respond within one month. You may contact our EU representative (see top) or complain to your local supervisory authority.
US state-privacy residents (e.g. California CCPA/CPRA): where applicable, rights to know, access, correct and delete, and to opt out of the “sale” or “sharing” of personal information — we do neither.

To exercise any of these, email [email protected].

10Security

How we protect data — credential hashing, tamper-evidence, and the no-egress architecture — is described in our Security Statement.

11International transfers

We are a US (Delaware) company. Where we process personal data of EU/UK individuals, the GDPR applies and any EU→US transfer relies on an appropriate safeguard such as the Standard Contractual Clauses. In practice the app introduces no cross-border transfer of its own — all app data is stored in Atlassian-hosted storage and inherits your site’s residency, so transfer exposure is limited to Atlassian’s arrangements. Our only sub-processor is Atlassian.

12Changes

We may update this policy; we will change the effective date above and, for material changes, provide reasonable notice.

13Contact

[email protected] · GxP Seal, LLC — 1201 North Orange Street, Suite 700, Wilmington, DE 19801, USA.