docs: revise privacy policy — accurate data-practice disclosures

[MrCoder]

Summary

Replaces the live ZenUML privacy policy (privacy-policy/privacy-policy.html, source for https://app.zenuml.com/privacy-policy/privacy-policy.html, linked from the Full/Lite/AsyncAPI Marketplace listings) with a revised version whose data-practice disclosures were reviewed and verified against primary sources today. The current live text under-discloses several practices; this PR corrects that.

Key changes:

• Diagram-content mirroring now disclosed with retention — the Confluence app mirrors a verbatim copy of each saved diagram (with version history) to our backend; the live policy said content is "stored within Confluence, not our systems," which is no longer accurate. Retention (installed lifetime, deleted within 90 days of uninstall) is now stated.
• AI features + model providers disclosed — AI diagram generation/repair/update route through Diagramly.ai to OpenAI and Anthropic; AI title suggestion uses Cloudflare Workers AI (Meta Llama). Neither was mentioned in the live policy. Training/retention terms per each provider's own terms are cited.
• Live Agent Link disclosed — the opt-in feature that streams diagram source to an external AI agent/MCP client over a secure WebSocket relay was entirely absent from the live policy.
• PlantUML rendering disclosed — PlantUML source is sent to the public plantuml.com service (no DPA, no SOC 2); not previously mentioned.
• Analytics wording corrected — the live policy claims "anonymous usage events" / "no PII." The revised text describes the identifiers as pseudonymous (opaque account ID + site domain can identify an org/individual) rather than anonymous, and discloses session replay (a percentage of sessions, via Mixpanel).
• Enhanced page capture disclosed generically — a small number of enterprise customers have full page-body capture arranged; stated as a policy-level allowlisted behavior with retention, without naming any customer.
• Security section expanded with verified facts — in-transit (TLS/WSS, Forge signed invocation tokens) and at-rest (AES-256 GCM on Cloudflare D1/R2/KV; Confluence's own TLS 1.2+/AES-256; Neon's AES-256/TLS 1.2-1.3 for the AI sister product) — replacing the old one-line "SSL/TLS" claim.
• Sub-processor table added — Cloudflare, Atlassian, Diagramly.ai, OpenAI, Anthropic, Cloudflare Workers AI, Mixpanel, plantuml.com, each with purpose, transit/at-rest encryption, and compliance notes.
• "Last updated" set to July 23, 2026; "Effective date: February 23, 2019" preserved unchanged.

Site chrome (head/style/layout wrapper) from the live file is preserved as-is (plus one additive CSS rule, .table-scroll, for the new sub-processor table's horizontal overflow on mobile) — this is a content-only revision, not a redesign.

No customer or tenant is named anywhere in this PR or the policy text.

Deployment note

This PR does not deploy anything. Per this repo's pipeline (docs/adr/0001-release-pipeline-imitating-conf-app.md), merging to master deploys to staging only; production (app.zenuml.com) requires publishing the subsequent draft GitHub Release. The Marketplace-linked URL will keep serving the old text until that production release is published after merge.

Test plan

• Diffed against the current live file; verified only additive/corrective content changes, chrome preserved
• Grepped for leftover [PUBLISH_DATE] / [PLACEHOLDER] / TBD / TODO — none found
• Validated HTML tag balance (div/table/thead/tbody/tr/th/td/ul/li) and streaming-parsed the file — no mismatched or unclosed tags
• Verified href="#contact" resolves to id="contact" on the contact section
• Confirmed app/, extension/, web/dist/ copies of this file are gitignored build outputs — only privacy-policy/privacy-policy.html is tracked, so this is the only file that needed changing
• Manual review of legal/business accuracy by a human before merge (recommended given this is a public-facing privacy policy)

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

https://claude.ai/code/session_012CBW73f7EgWuGmc5SL87L6