ZenUML Privacy Policy

1. Information We Collect

A. Confluence App

• Authentication: You sign in through Atlassian Confluence. We do not collect your email address or Atlassian account password. Our backend receives an opaque Atlassian account identifier and your Confluence site (cloud) identifier so the app can function.
• Diagram content: When you create, edit, or save a diagram macro, the diagram is stored in Atlassian Confluence, which remains the system of record for your content. In addition, on each save we mirror a verbatim copy of the diagram source (for example ZenUML text, Mermaid, PlantUML, DrawIO XML, or an OpenAPI/AsyncAPI specification) together with the diagram title into our own backend database (Cloudflare D1), with full version history. This copy supports current and planned product features (such as diagram relationships and freshness detection). It is not currently displayed back to you and does not replace Confluence storage. We retain this mirrored copy for as long as the app remains installed on your site, after which it is deleted within 90 days of uninstallation (or earlier on request). You can request deletion of this copy through our support portal (see Contact Us).

The sections below describe additional, feature-specific data flows in the Confluence app. Several of them (AI features, Live Agent Link) are optional and off by default.

B. IntelliJ IDEA & VS Code Plugins

• Authentication: No login is required.
• Personal Data: We do not collect email addresses or user account details.
• Usage Data: No personal data is collected. Diagrams are processed locally.

C. Web App (SaaS)

• Personal Data: When you sign up, we collect your email address to create and manage your account.
• Usage Data: We may collect data such as IP address, browser type, pages visited, and time spent, to improve the service.
• Cookies: We use cookies and similar technologies to remember preferences and support analytics.

2. Enhanced Page Capture (a small number of enterprise customers)

For a small number of enterprise customers who have arranged for enhanced page capture, the Confluence app captures the full body of a Confluence page when that page is updated and stores it in our backend object storage (Cloudflare R2). This behaviour is limited to an explicit allowlist of customer sites.

For all other customers, no page body is captured or stored — page-update events are received but discarded without being retained. Where enhanced page capture is active, we retain captured page content for no longer than 90 days on a rolling basis (in current operation, captured snapshots are automatically deleted after 7 days).

3. AI Features (optional, opt-in)

ZenUML offers optional AI features — AI diagram generation, AI repair, and AI update. These are off by default and controlled by feature flags; they run only when you actively use them.

• Generation, repair, and update: When you use these features, the relevant diagram source and any related error text are sent from our backend to Diagramly.ai (our sister product), which orchestrates the request. Diagramly.ai in turn calls third-party AI model providers — OpenAI (GPT-4o) and Anthropic (Claude Sonnet family) — to produce the result. Diagramly.ai retains the inputs of AI-repair jobs in its database.
• Model-provider terms: Under their terms, neither OpenAI nor Anthropic uses this content to train their models. OpenAI does not train on API inputs by default and deletes API inputs/outputs within about 30 days; Anthropic's commercial terms state it may not train on customer content and automatically deletes API inputs and outputs within 30 days.
• AI title suggestion: A separate feature sends only the diagram text to our backend, which calls Cloudflare Workers AI (Meta Llama models running on Cloudflare's infrastructure) to suggest a title. This inference is ephemeral and not stored. It does not go to Diagramly.ai, OpenAI, or Anthropic.

Because AI features send diagram content to the providers named above, do not use them for content you are not permitted to share with those providers.

4. Live Agent Link (optional, opt-in)

Live Agent Link is an optional feature that is off by default. When you explicitly start a session, your diagram source is streamed in real time over an encrypted secure WebSocket connection (wss://*.zenuml.com) through a relay running on our Cloudflare infrastructure, and is made available to an external AI agent or MCP client that you have authorized on your own device.

The relay holds session state only transiently, for the duration of the session. Because you are connecting your diagram to a third-party AI agent of your own choosing, that agent's own privacy terms govern what it does with the content it receives.

5. PlantUML Rendering (PlantUML diagrams only)

If you render a PlantUML diagram, the PlantUML source is URL-encoded and sent over HTTPS to the public PlantUML rendering service at plantuml.com. This occurs during editing (syntax validation), on each render, and on PNG export.

According to PlantUML's own FAQ, it does not store diagrams on its servers — rendering is stateless and the diagram is encoded in the request URL — though it may keep transient HTTP traces for performance and then remove them. The public PlantUML service is a community service with no data processing agreement and no SOC 2 certification; PlantUML recommends self-hosting for sensitive diagrams. This applies only to PlantUML diagrams; other diagram types are not sent to plantuml.com.

6. Analytics (Mixpanel)

We use Mixpanel to understand how the Confluence app is used. The events we send contain metadata only — for example an opaque Atlassian account identifier, your Confluence site domain, space key, macro identifiers, opaque page/content identifiers, product type, timings, and counts. We do not send diagram source content to Mixpanel; where the size of your input matters we send only length values (such as prompt length or the size of a text change).

These identifiers are pseudonymous, not anonymous: an opaque account identifier combined with a site domain can relate to an individual or an organization. We therefore describe this data as pseudonymous rather than claiming it contains no personal data.

Two features send limited free text:

• Accepted AI title: if you accept an AI-suggested diagram title, that title text is recorded.
• Feedback: if you submit feedback, your free-text feedback is recorded.

Session replay: For a configurable percentage of sessions, Mixpanel records a replay of the session (a reconstruction of on-screen interactions). This is controlled by a server-side setting and uses Mixpanel's default masking behaviour. Session replay is separate from the event analytics described above.

7. How We Use Your Data

We use collected data to:

• Provide, maintain, and improve our services
• Deliver the specific features you use (including the optional AI and Live Agent Link features)
• Notify you about changes or updates
• Support customer service requests
• Analyze usage to improve features and performance
• Ensure security and prevent abuse

8. Data Residency & Retention

• Confluence app — Confluence storage: Your diagrams remain stored in Atlassian Confluence under Atlassian's own data residency and retention.
• Confluence app — our mirrored copy: The verbatim copy of each saved diagram (with version history) is stored in our Cloudflare backend and retained for as long as the app remains installed on your site, after which it is deleted within 90 days of uninstallation (or earlier on request). Cloudflare D1 supports data-localization jurisdictions at creation time; regional residency is a configuration option and is not currently configured.
• Confluence app — enhanced page capture: Where active (see Section 2), captured page content is retained for no longer than 90 days on a rolling basis (in current operation, captured snapshots are automatically deleted after 7 days).
• Web App: Your account and diagram data are stored on our servers. We retain data only as long as necessary to provide the service, unless required otherwise by law.
• Requests: You can request access to or deletion of data we hold about you, or opt out where applicable, via our support portal: https://zenuml.atlassian.net/servicedesk/customer/portals.

9. Disclosure of Data

We share data with the sub-processors listed in Section 10 to operate the service. Beyond that, we may disclose information only if required to:

• Comply with legal obligations
• Protect and defend our rights or property
• Prevent or investigate potential misuse
• Ensure the safety of our users and the public

10. Sub-processors

We use the following sub-processors to deliver the service. Some (OpenAI, Anthropic, plantuml.com) receive data only when you use the specific feature noted.

We may also use Google Analytics for anonymous web-traffic analysis on our marketing website only (not inside the Confluence app). You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on.

11. Security

In transit: All data sent to our services is encrypted with TLS/HTTPS, including secure WebSockets (wss) for Live Agent Link. Requests to our backend are authenticated using Atlassian Forge signed invocation tokens (RS256).

At rest: Content stored in our primary backend (Cloudflare D1, R2, and KV) is encrypted using AES-256 in GCM (Galois/Counter Mode), applied automatically, with keys managed by Cloudflare. Atlassian Confluence — the system of record for your diagrams — encrypts data in transit (TLS 1.2+ with perfect forward secrecy) and at rest (AES-256). Our AI sister product's database (Neon) encrypts data at rest with AES-256 and in transit with TLS 1.2/1.3.

12. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal data from children. If you believe we have done so, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page, and we will notify users of material changes.