Dortus

Privacy policy

Two platforms, two very different data stories. Arrears runs on servers Dortus operates. The Atlassian apps run inside your own Atlassian site. Both are described below.

Last updated: 13 October 2026

1. Who we are

Dortus ("we", "us") is an independent software vendor. We publish Arrears for Shopify, AskSpace and Mermaid Live Preview for Atlassian Confluence, and MailView for Atlassian Jira.

Contact for privacy questions and data requests: support@dortus.com

2. Our role

For business data inside our apps, you are the controller and Dortus is the processor. You decide which companies, contacts, questions, pages or attachments exist. We process that data only to deliver the features you switched on.

For your own contact with us (support email, billing questions), Dortus is the controller of that correspondence.

Short version. Arrears stores merchant and B2B contact data on Dortus-operated infrastructure in the EU, because a collections desk needs a database. The Atlassian apps store nothing on Dortus servers at all, and MailView stores nothing anywhere.

3. Arrears for Shopify

3.1 What the app does

Arrears is an embedded Shopify app for business-to-business collections. It reads your companies, company locations, contacts, orders, and payment terms through the Shopify Admin API, and turns them into aging views, statements, reminders, payment allocations, and credit holds.

3.2 Where it runs

Unlike our Atlassian apps, Arrears needs a server. We host it on Fly.io in the Amsterdam region (EU), with the application database on a persistent volume attached to that machine. Access to the production environment is limited to Dortus.

3.3 What data Arrears processes and stores

  • Your shop domain and the Shopify access token issued during install
  • Company names, company locations, and payment terms as configured in Shopify
  • Company contact names and email addresses, used to address statements and reminders
  • Order references, amounts, currencies, due dates, and payment schedule status
  • Reminder records: recipient address, subject, message body, send time, and result
  • Payment records you enter, including allocation across open invoices
  • Credit limits, hold and release events, and the staff action behind them
  • App settings, such as sender name, dunning policy, and automation switches

Arrears does not ask for or store payment card details. Subscription charges are handled by Shopify billing.

3.4 Protected customer data

Business contact data (company contact names and email addresses) is used only to produce and send the statements and reminders you request, and to show you who was contacted. We do not use it for our own marketing, we do not sell it, and we do not share it with anyone outside the subprocessors listed in section 5.

3.5 Email sending

Statement and reminder emails are delivered through Resend. That means the recipient address, subject, and message body pass through Resend in order to be delivered, along with normal delivery metadata.

3.6 Shopify data requests and deletion

Arrears implements Shopify's mandatory compliance webhooks:

  • customers/data_request: we respond to the merchant with the data we hold for the requested person.
  • customers/redact: we delete or anonymise the stored personal data for that person.
  • shop/redact: we delete the shop's stored data after Shopify's redaction window.

Uninstalling the app also revokes our access: the stored session for your shop is removed when we receive the app/uninstalled webhook.

4. AskSpace, Mermaid Live Preview and MailView for Atlassian

4.1 Where the data lives

These apps are built on Atlassian Forge and run entirely inside Atlassian's cloud. AskSpace and Mermaid Live Preview keep their data in Forge app storage in your Atlassian site. MailView and MailView for Confluence have no storage at all. We do not operate an application server for these apps, and app content is not sent to Dortus.

These apps are built for Atlassian's "Runs on Atlassian" programme: there is no required data egress to Dortus for normal use of the apps.

4.2 What AskSpace processes

  • Question and answer text people enter, and the tags they add
  • Votes and best-answer marks
  • Space settings, for example who may ask, who may answer and who may moderate
  • Questions and answers imported from Questions for Confluence or a CSV file, and a record of each import so it can be undone
  • Atlassian account identifiers, needed to show authors and enforce permissions
  • Display names and avatar URLs provided by Atlassian APIs, so authors can be shown
  • In-app notification records, for example that someone answered your question

AskSpace reads Confluence content only to import questions from Questions for Confluence, when a space admin starts an import. It reads as that admin, so it sees only what they can see in Confluence, and it does not change anything in Questions for Confluence. Of what it reads, it keeps only the imported questions and answers, in Forge app storage.

4.3 What Mermaid Live Preview processes

  • The diagram source you type in the macro
  • Earlier versions of that source, kept so you can step back after a bad edit

Rendering happens in the browser and in the Forge environment. Diagram content is not sent to Dortus and is not sent to any third party for rendering.

4.4 What MailView processes

MailView shows .eml and .msg email attachments on a Jira work item. When the panel opens, the app reads the work item's email attachments, and files without a known file type to see whether they are emails, from your Jira site in your browser, with your own Jira permissions, and renders the one you open there. The email, its headers, its inline images and the files inside it are processed only in your browser and only for as long as the panel is open.

  • MailView keeps no copies: it has no app storage and no server.
  • Nothing is sent to Dortus or to any third party. The app makes no outbound connections; images and other resources that an email tries to load from the internet are blocked.
  • Emails usually contain personal data (names, addresses, message text). That data stays in your Jira attachment, under your organisation's control, exactly as before you installed the app.
  • The app asks for one permission: read access to work items and their attachments. It cannot change, send or delete anything.
  • In Atlassian's development environment the app can show technical diagnostics to the developer (timings, status codes, sizes). These never contain email content, subjects or addresses, and they are not shown in the published version.

4.5 What MailView for Confluence processes

MailView for Confluence shows .eml and .msg email attachments on a Confluence page. It only reads the email attachments of the page you open, with your own Confluence permissions and with one permission for the app: read:attachment:confluence. The email is rendered in your browser and only for as long as it is open.

  • To find the emails, the app reads the list of attachments of that page. Files without a known file extension are opened only to check whether they are an email (the 10 newest). Files with a known extension, such as .pdf, and images are not opened.
  • When a page is exported to PDF or Word, the email chosen in the macro is read and turned into a static version inside Atlassian's Forge platform, with the permissions of the person who exports, and handed back to Confluence for the export file. Nothing is kept afterwards.
  • MailView for Confluence keeps no copies: it has no app storage and no server.
  • Nothing is sent to Dortus or to any third party. The app makes no outbound connections; images and other resources that an email tries to load from the internet are blocked.
  • Emails usually contain personal data (names, addresses, message text). That data stays in your Confluence attachment, under your organisation's control, exactly as before you installed the app.
  • The permission is read-only and covers attachments only. The app cannot read page text, and it cannot change, send or delete anything.
  • In Atlassian's development environment the app can show technical diagnostics to the developer (timings, status codes, sizes). These never contain email content, subjects or addresses, and they are not shown in the published version.

4.6 Billing

Marketplace billing is handled by Atlassian. We never see card details.

5. Subprocessors

  • Shopify Inc.: platform, app hosting surface, and billing for Arrears.
  • Fly.io: application hosting and database storage for Arrears, EU (Amsterdam) region.
  • Resend: delivery of statement and reminder email from Arrears.
  • Atlassian Pty Ltd: platform, Forge runtime, storage, and billing for AskSpace, Mermaid Live Preview and MailView.

We do not use advertising networks, session recording, or third-party analytics inside our apps.

6. This website

This site is a static set of pages. We do not set tracking cookies and we run no analytics script. Fonts are served from this site. Your browser does not contact Google or any other third party to load them.

The product walkthrough on the Arrears page is a YouTube embed served from youtube.com. It loads only when you open that page, and playing it means YouTube receives your IP address and player data under Google's own terms.

7. Why we process data

Only to provide the features you enable: showing aging, producing statements, sending the reminders you approve, allocating payments, applying credit holds, storing and displaying questions and answers, rendering diagrams, and showing email attachments. Our legal basis is the performance of our agreement with you, and our legitimate interest in keeping the service running securely.

8. Retention

  • Arrears: data is kept while the app is installed. It is deleted on shop redaction, and on request. Reminder history is kept so you can prove what was sent, until the shop data is deleted.
  • AskSpace and Mermaid Live Preview: content stays in Forge storage for your site. Uninstall and deletion follow Atlassian's platform rules for app storage.
  • MailView: nothing is retained. Closing the work item is enough.
  • Support email: kept only as long as needed to help you and to keep a record of the issue.

9. Security

Traffic to Arrears is served over HTTPS only. Platform credentials and API keys are held as environment secrets, not in source code. Access to production is limited to Dortus. MailView removes scripts, forms, embedded frames and remote resources from an email before showing it, and renders it in an isolated area. We are a small vendor and we do not claim certifications we do not have: if you need a security review or a data processing agreement, email us and we will answer concretely.

10. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete personal data.

  • For data inside Confluence, Jira or Forge, start with your Atlassian site administrator.
  • For data inside Arrears, start with the merchant that installed the app, or contact us directly.

You can always email support@dortus.com and we will answer within one business day.

11. International transfers

Arrears is hosted in the EU. Some subprocessors listed in section 5 are established outside the EU and may process limited data there under their own transfer mechanisms.

12. Children

Our apps are intended for workplace use, not for children.

13. Changes

We may update this policy. The "last updated" date at the top of the page changes when we do, and material changes will be noted in the app release notes.

14. Contact

Dortus
support@dortus.com
Home · Support · Terms of service