Data Processing Addendum: Answerpane: Questions & Answers (Q&A) for Confluence
Effective date: September 29, 2026
This Data Processing Addendum ("DPA") forms part of the agreement under which you use the App, the Bonterms Standard End User Agreement with our Provider-Specific Terms (see Terms), between Brainstatic Threads ("Processor", "we") and the customer using Answerpane: Questions & Answers (Q&A) for Confluence (the "App") ("Controller", "you"). It applies when we process Personal Data on your behalf through the App, as defined in the EU General Data Protection Regulation 2016/679 ("GDPR") or the UK GDPR.
1. Scope of processing
| Subject matter | Running questions and answers in Confluence |
| Duration | While the App is installed, plus the deletion periods in section 7 |
| Nature and purpose | Creating and reading question pages and answer comments on users' behalf, recording votes, and producing exports on request |
| Types of Personal Data | Names, account IDs and any Personal Data people write into questions and answers; account IDs recorded with votes |
| Data subjects | Your personnel and other Confluence users, and any individuals mentioned in questions or answers |
The App doesn't process special categories of Personal Data unless people write them into questions or answers. They shouldn't.
2. Instructions
We process Personal Data only on your documented instructions. These Terms and your use and configuration of the App (the spaces you enable, the questions and answers your users post, and exports your admins request) are those instructions. We'll tell you if we believe an instruction breaks data protection law.
3. Confidentiality
Anyone we authorize to process Personal Data is bound by confidentiality.
4. Security
We maintain appropriate technical and organizational measures, including:
- hosting the App only on Atlassian Forge, with no servers of our own and no data sent outside Atlassian
- storing questions and answers as Confluence content under your Confluence permissions
- running searches and question creation with the person's own Confluence permissions
- limiting settings and exports to Confluence administrators, checked on the server
- logging errors only, never question or answer content
5. Sub-processors
You authorize the following sub-processor:
| Sub-processor | Purpose | Location |
|---|---|---|
| Atlassian (Forge platform and Confluence) | Hosting, storage and logging for the App | Per your Atlassian data residency settings |
We'll give at least 30 days' notice at https://brainstaticthreads.com/answerpane/privacy/ before adding or replacing a sub-processor. You may object on reasonable data protection grounds, and if we can't resolve the objection, you may stop using the App.
6. Assistance
Taking into account the nature of the processing, we'll reasonably help you:
- respond to data subject requests, most of which you can handle directly by editing or deleting pages and comments in Confluence
- carry out data protection impact assessments
- meet your security obligations
7. Deletion
- Questions, answers and exports: Confluence content, deleted when you delete the page, comment or attachment.
- Votes and space settings: when you uninstall the App, Atlassian deletes the App's stored data under Forge's data retention practices.
We keep no copies outside Atlassian.
8. Personal data breaches
We'll notify you without undue delay, and where feasible within 72 hours, after becoming aware of a Personal Data breach affecting your data. We'll include the information reasonably available to us.
9. Audits
We'll make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires. Because the App runs entirely on Atlassian Forge, audits of the hosting environment rely on Atlassian's published certifications and reports.
10. International transfers
Where processing involves a transfer of Personal Data out of the EEA, UK or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum are incorporated by reference.
11. Liability and precedence
Liability under this DPA is subject to the limitations of liability in the Standard End User Agreement. If this DPA conflicts with that agreement, this DPA prevails for Personal Data processing.
Contact
Brainstatic Threads support@brainstaticthreads.com