Privacy Policy

Draft, legal review pending. This text has not yet been reviewed by a lawyer and may change before the first app is published.

1. Operator

MAKOA LLC
3833 Powerline Rd, Suite 201
Fort Lauderdale, FL 33309
United States
Email: support@makoa.ch

MAKOA LLC is a limited liability company registered in Florida, United States, document number L20000170991.

2. Scope

This policy covers two things, and they are treated separately throughout the text:

The website makoa.ch, including the documentation at makoa.ch/docs.
The Atlassian Marketplace app Residual: Audit Ready Risk Register for Jira, which runs inside the Atlassian cloud of the customer who installed it.

Sections 3 to 7 describe the app. Sections 8 and 9 describe the website and the support mailbox. Sections 10 and 11 apply to both.

3. Roles

For the data inside Residual, the Jira customer who installed the app is the controller. That organisation decides which risks are recorded and who may see them. MAKOA LLC acts as a processor for that data and has no access to it in normal operation.

For the website makoa.ch and for messages sent to the support address, MAKOA LLC is the controller.

4. What Residual processes

Residual stores the data your users enter into the risk register:

Risk data: titles, descriptions, categories, status, review dates and asset references.
The ID of the Jira project the register belongs to, and the keys of linked Jira work items, for example KAN-12.
Assessments: probability, impact and optional detection ratings, the written rationale, the model version and the time.
Treatments: title, status, due date, evidence text and evidence links.
Audit trail: every change with the old value, the new value, the person and the time.
Atlassian account IDs of the people who create, own, assess or change risks and treatments.

Residual does not store the names of your users. It stores the Atlassian account ID and asks Jira for the matching display name each time a page or a report is built, so a name changed in Jira is correct everywhere at once.

5. Where the data is stored

All register data lives in Forge Hosted Storage, which is part of the Atlassian cloud of the customer who installed the app. MAKOA LLC operates no server and no database for the app, and no app data is transferred to third parties. The storage region follows the Atlassian site of the customer, so the data stays where that site is hosted.

Residual has no network access to the outside. The app declares no external domains, and PDF and CSV exports are generated in the browser of the user who starts them.

6. Subprocessors

Atlassian is the only subprocessor for the app. Atlassian hosts the code, the functions and the storage of Residual as part of the Forge platform. MAKOA LLC engages no further subprocessor for app data.

7. Retention and deletion

Risks deleted inside the app are removed from the register; the audit trail keeps the record of the deletion, which is what keeps the register auditable.

When the app is uninstalled, its data is not erased at once. Atlassian first marks it as soft deleted. If the customer installs the app again within 21 days, they can relink the old data and carry on with the register as it was. After that window the data is deleted within the retention period that Atlassian describes in its SOC 2 report. Atlassian documents this atdeveloper.atlassian.com/platform/forge/storage-reference/hosted-storage-data-lifecycle/.

8. Website

The website makoa.ch is hosted by Vercel. Vercel writes technical request data such as the IP address, the requested page and the time into server logs and keeps them for a short period, to deliver the pages and to defend against abuse.

The site sets no cookies, uses no analytics and loads no external scripts or fonts. There is no tracking of any kind. This is not a promise but a property of the site: no analytics package is part of the project. The documentation remembers your choice of light or dark theme in the local storage of your browser; that value stays on your device and is never sent anywhere.

9. Support email

The address support@makoa.ch runs on Microsoft 365. Your message, your address and anything you send with it are stored there for as long as it takes to handle the request and to answer follow up questions about it.

10. Your rights

You can ask for access to your data, for correction of data that is wrong and for deletion of your data.

For data inside Residual, your first point of contact is the Jira customer who installed the app, because that organisation is the controller and the only party with access to the register. MAKOA LLC supports them with any such request. For the website and for the support mailbox, write to support@makoa.ch.

11. Changes

This policy will change as the app changes and once the legal review is done. The version line below always says which text is in force. Material changes are announced on this page and carry a new date.

Version: 20 September 2026