Skip to main content

ZenUML Privacy Policy

Effective date: Mar 23, 2023
Last updated: Oct 23, 2026

ZenUML ("us", "we", or "our") is operated by P&D Vision Pty Ltd, an Australian company, and provides the ZenUML product family — including apps for Atlassian Confluence, the web app at app.zenuml.com, JetBrains and Visual Studio Code plugins, desktop apps, and the ZenUML MCP server that connects AI assistants such as Claude and ChatGPT to Confluence (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. By using the Service, you agree to the collection and use of information in accordance with this policy.

Information Collection And Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected

Usage Data

We may also collect anonymous information (non identifiable) how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Tracking & Cookies Data

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. Cookies are files with small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyze our Service. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service. Examples of Cookies we use:

  • Session Cookies. We use Session Cookies to operate our Service.
  • Preference Cookies. We use Preference Cookies to remember your preferences and various settings.
  • Security Cookies. We use Security Cookies for security purposes.

Data Handled by the ZenUML MCP Server

The ZenUML MCP server (https://conf-lite.zenuml.com/agent-link/mcp) lets an AI assistant that you connect, such as Claude or ChatGPT, read and change ZenUML diagrams and Confluence pages on your behalf. It is also distributed as the ZenUML plugin for those assistants. When you use it:

  • Your Atlassian authorization. When you connect, you sign in with Atlassian and approve access to read and write Confluence pages and ZenUML diagrams (the Confluence scopes read:page:confluence, write:page:confluence, read:custom-content:confluence, write:custom-content:confluence, and offline_access). We store the resulting Atlassian refresh token encrypted (AES-GCM), the short-lived access token (valid for about one hour), and the granted scopes, keyed to your Atlassian account ID, so the assistant can keep working between conversations. The server acts only as you: it can reach only the sites, spaces and pages your Atlassian account can already reach.
  • Connection records. We store the name and callback addresses of each AI assistant that registers with the server, a record that you approved a given assistant, and the access tokens we issue to it. Our own access and refresh tokens are stored only as one-way hashes.
  • Diagram and page content. Diagram source and page content that the assistant reads or writes pass through our server to and from Confluence. We do not store this content; Confluence remains the only copy. What the assistant does with content it receives is governed by that assistant provider's own privacy policy.
  • Rendered previews. When the assistant shows a diagram inline, the preview renders in your assistant's window. Sequence and Mermaid diagrams render locally in that window. PlantUML diagrams are rendered by loading an image from the public PlantUML server at www.plantuml.com, which receives the diagram's encoded source in the image address.
  • Usage analytics. For each connection and tool call we record your Atlassian account ID, the Confluence site ID, the assistant's name and version, which tool ran, how long it took, and whether it succeeded. We do not record diagram source, page content, or your prompts.

Retention: the stored Atlassian authorization is deleted automatically 100 days after it was last renewed, or as soon as Atlassian reports it is no longer valid, for example after you remove ZenUML from the connected apps in your Atlassian account settings. Our access tokens expire after one hour and our refresh tokens after 30 days. Assistant registrations and approval records are deleted after one year. To have your stored authorization and connection records deleted sooner, contact us at the address below.

Use of Data

ZenUML uses the collected data for various purposes:

  • To provide and maintain the Service
  • To provide customer care and support
  • To provide analysis or valuable information so that we can improve the Service
  • To monitor the usage of the Service
  • To detect, prevent and address technical issues

Transfer Of Data

Your information, may be transferred to — and maintained on — computers located outside your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. ZenUML will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Disclosure Of Data

ZenUML may disclose Usage Data in the good faith belief that such action is necessary to:

  • To comply with a legal obligation
  • To protect and defend the rights or property of ZenUML
  • To prevent or investigate possible wrongdoing in connection with the Service
  • To protect the personal safety of users of the Service or the public
  • To protect against legal liability

Security Of Data

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. We strive to use commercially acceptable means to protect your Usage Data. The Service works over encrypted Secure Socket Layer (SSL) technology.

Service Providers

We may employ third party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analyzing how our Service is used. These third parties have access to your Usage Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Analytics

We may use third-party Service Providers to monitor and analyze the use of our Service.

  • Mixpanel: we use Mixpanel to record the MCP server usage analytics described above. For more information on Mixpanel's privacy practices, please visit https://mixpanel.com/legal/privacy-policy

  • Google Analytics: Google Analytics is a web analytics service offered by Google that tracks and reports anonymous website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visits activity. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en

Hosting and Processing for the MCP Server

  • Cloudflare hosts the ZenUML MCP server and stores the authorization and connection records described above.
  • Atlassian receives the requests the server makes to Confluence on your behalf, under your authorization.
  • The public PlantUML server (www.plantuml.com) receives the encoded source of PlantUML diagrams shown as inline previews.
  • Sentry may receive error reports from the server, which can include request metadata such as the address requested, with credentials removed.

Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes To This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "effective date" at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us: