End User Terms, CRA Clock for Jira

These terms form the agreement between Memo Labs ("we", "us"), the business name of Guillaume Flambard, a sole trader (entreprise individuelle) established in France under SIREN 924 107 469, whose business address is 27b rue du Surmelin, 75020 Paris, France, and the organisation that installs or uses the Atlassian Marketplace app CRA Clock for Jira ("the app", "you"). We, not Atlassian, license the app to you. Atlassian is not a party to this agreement.

By installing or using the app, you accept these terms. If you are accepting on behalf of an organisation, you confirm you are authorised to bind it.

1. Licence

We grant you a non-exclusive, non-transferable, non-sublicensable right to install and use the app on the Atlassian cloud sites covered by your subscription, for your internal business purposes, for as long as that subscription is active and these terms are respected.

You may not reverse engineer the app, resell or rent access to it, remove attribution, or use it to build a competing product. Nothing here restricts a right you hold under mandatory law, including the right to decompile for interoperability.

2. Subscription, fees and billing

The app is sold through the Atlassian Marketplace. Pricing, currency, billing cycle, taxes, invoicing and refunds are handled by Atlassian under your agreement with Atlassian, and are governed by that agreement rather than by this one. We do not process your payment details and never see them.

If your Atlassian subscription for the app lapses, your right to use the app ends with it.

3. What the app does

The app adds a panel to a Jira issue that lets your team:

• record whether the two conditions of Article 3(42) are met, so that a merely exploitable vulnerability under Article 3(41) does not start a clock that should not run;
• derive the 24 hour, 72 hour and final report deadlines from the moment of awareness, applying the rule that actually governs the track in question;
• keep drafts of the fields Article 14 requires at each stage, and freeze a report once it is marked as sent;
• receive an escalation comment on the issue ahead of each deadline, checked on a recurring schedule;
• export a dossier of what was qualified, by whom, when, and what was declared.

4. What the app does not do

These limits are deliberate. They are not disclaimers bolted on afterwards, they describe how the app is built.

4.1 It does not notify anyone on your behalf

The app sends nothing to ENISA, to a CSIRT, to a market surveillance authority, or to any other recipient. It cannot: it makes no outbound network calls of any kind. When your team marks a report as sent, that records your statement that you sent it. Actually sending it remains entirely your action, through whatever channel the authority requires.

4.2 It is not legal advice

Whether a vulnerability is actively exploited, whether an incident is severe, when you became aware, and whether you fall within the scope of the Regulation at all are legal and factual judgements that belong to you and your advisers. The app structures those judgements, timestamps them, and preserves them. It does not make them, and a deadline it displays is a calculation from the inputs you supplied, not an opinion on your obligations.

4.3 It does not guarantee compliance

Using the app does not make you compliant with Regulation (EU) 2024/2847 or with any other law, and does not shield you from enforcement. Only the market surveillance authority decides that, under Article 52.

4.4 Escalations depend on the platform

Escalation comments are posted by an Atlassian scheduled trigger. Atlassian distributes those executions across the interval rather than running them at an exact time, and a platform outage or a permission change on your side can delay or prevent one. Treat escalations as a helpful reminder, never as your only line of defence on a legal deadline.

5. Your responsibilities

• Entering accurate information, in particular the moment of awareness, since every deadline derives from it.
• Deciding what to declare, and declaring it to the right authority in time.
• Controlling who in your organisation can see and act on the issues where the app is used. The app follows Jira's own permissions and adds none of its own.
• Exporting any dossier you need to keep before uninstalling the app. See section 6 of the Privacy Policy.
• Not entering personal data into report fields where the Regulation does not require it.

6. Data

How the app handles data is set out in the Privacy Policy, which forms part of these terms. In summary: the data stays inside Atlassian's infrastructure, we operate no server for this app, and we cannot read your incident records.

You are the controller of that data and we are your processor. On request we will enter into a Data Processing Addendum under Article 28 of the GDPR.

7. Support

Support is provided by email at contact@memolabs.dev, in English or French. We aim to acknowledge within two business days. We do not offer a contractual response or resolution time, and we do not offer support outside business days.

Because a defect that misstates a deadline is the one failure that matters in this app, a credible report of a miscalculated deadline is treated ahead of everything else.

8. Intellectual property

We retain all rights in the app. You retain all rights in your data. Nothing here transfers ownership in either direction.

If you send us feedback or a suggestion, we may use it to improve the app without owing you anything for it. We will not identify you as its source without your permission.

9. Warranties and their limits

We warrant that we will provide the app with reasonable skill and care, and that we will not knowingly include malicious code.

Beyond that, and to the maximum extent permitted by law, the app is provided as is. We do not warrant that it will be uninterrupted or error free, that a deadline it calculates is correct for your circumstances, or that it will meet a requirement we have not agreed in writing. Statutory warranties that cannot be excluded are not excluded.

10. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect or consequential loss, loss of profit, loss of business, or loss of data that could have been avoided by the exporting described in section 5.

Our total aggregate liability arising out of or in connection with this agreement is limited to the fees you paid for the app in the twelve months preceding the event giving rise to the claim.

Nothing in this section limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited.

In particular, and given section 4, we are not liable for a fine, penalty, or enforcement measure imposed on you under Regulation (EU) 2024/2847 or any other law.

11. Term and termination

This agreement runs for as long as the app is installed on any of your sites.

You may terminate at any time by uninstalling the app and cancelling the subscription through the Atlassian Marketplace. We may terminate on thirty days' written notice, or immediately if you materially breach these terms and do not remedy the breach within fourteen days of being told about it.

Sections 6, 8, 9, 10 and 13 survive termination.

12. Changes to these terms

We may update these terms. We will change the date at the top, and announce a material change in the app's Marketplace release notes at least thirty days before it takes effect. Continuing to use the app after that date means you accept the change. If you do not, uninstall the app and cancel the subscription.

13. Governing law

This agreement is governed by French law, and the courts of Paris, France have exclusive jurisdiction, except that either party may seek injunctive relief in any competent court. If you are a consumer, this does not deprive you of the protection of the mandatory law of your country of residence.

14. Contact

Memo Labs, the business name of Guillaume Flambard, a sole trader (entreprise individuelle) established in France under SIREN 924 107 469.
Business address: 27b rue du Surmelin, 75020 Paris, France.
Email: contact@memolabs.dev.