Link Health - Broken Link Checker for Confluence · by Basis Ventures

Data Processing Addendum

Version 1.0 · 25 August 2026

This Addendum applies where Basis Ventures (“Basis”) processes personal data on your behalf through the Link Health - Broken Link Checker for Confluence app (the “App”). It forms part of the Terms of Service and should be read with the Privacy Policy.

The unusual thing about this App, stated plainly. It runs entirely on Atlassian Forge and declares no external permissions and no remote hosts, so no data reaches Basis at all — we operate no servers for it and cannot read its storage. That is a strong security and data-residency position, and we market it as one. It does not take us out of the processing chain, and this Addendum does not pretend otherwise.

1. Roles

You are the controller. Basis is a processor acting on your instructions. Atlassian is a sub-processor, consistent with Atlassian's own Forge Data Processing Addendum, under which the developer of a Forge app is a controller or processor and Atlassian acts on the developer's behalf. Your instructions are: run the App as documented.

2. Subject matter, nature and purpose

Scanning a Confluence Cloud space you select, on demand, to identify broken internal links and present them for repair. Processing is limited to what that requires.

3. Personal data and data subjects

Category	Detail
Confluence content identifiers	Page titles, page IDs, space identifiers and link targets. Page titles are free text authored by your users and may incidentally contain personal data.
Atlassian account identifier	The account ID of the administrator using the App, stored as the key of a single preference — the last space selected (`lh:user:<accountId>:lastSpace`). An online identifier, and therefore personal data. The App does not read names, email addresses or profile data.

Data subjects: your Confluence users whose page titles or account identifiers appear in scan results.

4. Where processing happens, and storage

All processing and storage occur on Atlassian's Forge platform. Scan results are held in Atlassian-hosted Forge storage (KVS) scoped to your installation and readable only by the App — not by Basis, and not browsable by your own administrators. Persistent Forge storage follows the location of the host Atlassian product, so your data residency configuration governs it.

5. Duration, deletion and return

Processing lasts as long as the App is installed. Uninstalling the App deletes its storage, and the data described above goes with it. Because no data ever reaches Basis, there is no copy for us to return or destroy.

6. Our obligations (Article 28(3))

Documented instructions. We process only to provide the App as documented, and will tell you if an instruction appears to us to infringe applicable data protection law.
Confidentiality. Anyone authorised to process is bound by confidentiality.
Security. See §7.
Sub-processors. See §8.
Data subject rights. Only the App can read its own Forge storage. Write to support@basis-s.co.il and we will tell you what is held for a given person and help you remove it; uninstalling removes all of it.
Assistance. We will help you with security, breach notification and impact assessments so far as the App is concerned, taking into account that we hold none of the data ourselves.
Breach notification. We will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting the App.
Demonstrating compliance. We will provide the information reasonably necessary to demonstrate compliance with this Addendum and allow for audits, which may be satisfied by documentation given the App's architecture.

7. Security measures

The App inherits Atlassian Forge's platform security and tenancy isolation.
No egress. The manifest declares no external permissions and no remote hosts; this version is eligible for the Runs on Atlassian program.
Read-only. Only read scopes plus the App's own storage are requested; the App cannot modify your content.
Administrator-only. Both App pages check administrator permission before rendering.
Storage is scoped per installation and readable only by the App.

8. Sub-processors

Atlassian Pty Ltd is our sole sub-processor, providing the platform, compute and storage. Atlassian's own sub-processors are listed at atlassian.com/legal/sub-processors. You give general authorisation for this sub-processor; we will give notice before adding another, and you may object.

9. International transfers

Basis is established in Israel. Because no data is transmitted to us, the App creates no transfer of your data to Israel. Where a transfer mechanism is required for any processing under this Addendum, the parties will rely on the mechanism then lawfully available, and will enter into Standard Contractual Clauses on your request.

10. Contact

Basis Ventures — Basis Gova Binyan Veyazamut Ltd., a company registered in Israel.
support@basis-s.co.il