nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Bitbucket ToS: granting of license for End User Data to Atlassian

Christian H.

The Bitbucket Terms of Service contain the following language in article 3.4 End User Data:

End User hereby grants Atlassian a non-exclusive license to copy, distribute, perform, display, store, modify, and otherwise use End User Data in connection with operating the Hosted Services.

How does this not endager the (I think) reasonable requirement that e.g. code in private projects is not shared with third parties? Would it be possible to clarify what "in connection with operating the Hosted Services" can and cannot mean? Thx & thx for a great service.

Accepted answers

aMarcus

Thanks for your question. I spoke with our legal department to get a direct answer to your question. This was their exact reply:

This language is intended to grant us all of the technical, legal rights that we need to run our hosted services, including Bitbucket. This is not intended to give us the right to disclose code in private repositories. We will clarify this point when we next revise our End User Agreement (expected in the next month), but given your concern, wanted to reassure you that we have no intention of using End User Data stored in a Bitbucket private repository in the manner you describe.

Please feel free to email sales@atlassian.com with any other questions regarding this that need clarification. As they note, the end user agreement is under review and we welcome the input on anything that may be unclear or that may be a cause for concern.

All comments

Rodrigo Girardi Adami

Hello,

I believe that these concerns may be better clarified by contacting our sales Team so they can explain and you can talk regarding this information.

You can contact them by sales@atlassian.com

Hope that helps!

Regards,

Rodrigo

Rodrigo Girardi Adami

Hello,

I believe that these concerns may be better clarified by contacting our sales Team so they can explain and you can talk regarding this information.

You can contact them by sales@atlassian.com

Hope that helps!

Regards,

Rodrigo

Christian H.

Thanks for your suggestion. I will do as you say, but frankly I think that if there is indeed reason for concern all users of Bitbucket (or Cloud services in general, for that matter) should pay serious attention.

I think one needs some kind of formal assurance outside the verbatim legal terms to the effect that hypotheticals such as the following will remain just that, hypotheticals: 1) definition of "Hosted Service" in ToS changes say after new acquisition, 2) "distribute" now interpreted as sale of "End User Data" to third parties, 3) Bitbucket users find themselves in the highly uncomfortable position of having worked for long hours as third parties' software engineers for free, with their software assets exposed, etc.

My current expectation is that resolving this is a triviality for Atlassian staff (whose work e.g. on Bitbucket I greatly admire, as already indicated). But until this is resolved, I certainly won't upload any code into my projects (so far I use them only to manage issues/tickets). I expect a resolution to be as simple as a short communication from Atlassian that gives greater assurance concerning the question at hand. After all, I'm not a lawyer myself

aMarcus

Thanks for your question. I spoke with our legal department to get a direct answer to your question. This was their exact reply:

This language is intended to grant us all of the technical, legal rights that we need to run our hosted services, including Bitbucket. This is not intended to give us the right to disclose code in private repositories. We will clarify this point when we next revise our End User Agreement (expected in the next month), but given your concern, wanted to reassure you that we have no intention of using End User Data stored in a Bitbucket private repository in the manner you describe.

Christian H.

Thanks for your quick follow-up. I'll upload some code now and am also looking forward to the revisided ToS/End User Agreement. I think Bitbucket/Atlassiam might actually break some interesting ground there, because the terms of many providers contain similar language that could irritate customers such as this one as potentially too broad, so there may be a growth opportunity. Re-thx.

Mikko Oksalahti

I'm also concerned about that paragraph and noticed it has not been revised yet in the ToS. Any news on this issue?

Maxim Novikov

I had a correspondence with Atlassian regarding this matter in February/March 2013, so I have decided to post it here as you guys might be interested. I have received the info from the Legal department through the Sales department (Katie Thomas), and I am posting this having the permission to do that from the Sales team.

Maxim Novikov - 23 Feb 2013, 04:58 PM PST

Hello Atlassian folks,

My team has been using BitBucket for a while, and we have to admit that the service is very convenient for us and we are very satisfied with all the functionality it provides with. However, we have some concerns about using it with regard to some statements from the End User Agreement.

Paragraph 3.4. End User Data

End User hereby grants Atlassian a non-exclusive license to copy, distribute, perform, display, store, modify, and otherwise use End User Data in connection with operating the Hosted Services.

I presume that the company wanted just to get rights to move the user data between servers or for similar hosting-related activities. But the meaning of that "operating the Hosted Services" is not specified precisely anywhere, that means it can be interpreted differently. Generally speaking, the whole phrase sort of grants Atlassian with permissions to do whatever the company wants with the user data.

Paragraph 3.4. End User Data

End User agrees that Atlassian may, in its sole discretion, delete or remove any End User Data at any time and with or without notice.

This one raises some doubts regarding the reliability of the service. It says quite clearly that a user repository may be deleted one day. As a result the user can lose all the data their hosted and used with your service.

Could you please clarify those quite controversial statements for us? I firmly believe also that it would really help if they were explained in depth in the End User Agreement itself. As at this moment it can be read as "the user shares the ownership to all the data with Atlassian, and that data can disappear at any moment".

Thanks,

Maxim.

Katie Thomas - 6 Mar 2013, 02:33 AM

Hi Maxim,

Thanks for your patience.

I have heard back from our legal team. Here are the responses to your questions:

While we do not itemize all of the activities encompassed in running our hosted services, the license is nonetheless limited to operating the service. It is not intended to be a free for all.

This clause is designed to give Atlassian recourse in the event the End User Data violates any of the provisions of the agreement. For examples, take a look at the rest of Section 3.4. The most common removal of End User Data is in response to DMCA takedown requests (typically with respect to our Bitbucket service).

I hope this explains. Please let us know if you have further questions and we will be happy to assist.

Cheers,

Katie Thomas

Maxim Novikov - 6 Mar 2013, 01:54 PM PST

Hi Katie,

Unfortunately it does not explain anything. There are two issues in the End User Agreement:

Ownership

The Agreement quite clearly states that the user grants the ownership to Atlassian. It means that:

a) if the user decided to use his/her product in commercial, they would have to share the profit with Atlassian;

b) Atlassian can take the user's product, modify, distribute and use it for commercial purposes for the company benefits.

And this can happen regardless of whether the user uses BitBucket for free or pays something for its extended functionality. The Agreement does not specify such things.

Reliability

I trust your legal team that when they wrote that Agreement, they considered the legal issue of the content mainly. However, the "most common removal" case does not cover all possible cases. And currently the Agreement is being read as "you can lose your data at any time without any notices just because Atlassian decided to remove it".

My point is that if your legal department did not mean those things I have explained above, the End User Agreement needs to be revised and modified. If they did mean that, then I would like to get it confirmed from your guys, as in that case I would personally need to stop using BitBucket because these policies can seriously affect my projects in the future. And if they meant that, probably it would be very helpful to clarify these issues more clearly for your users, as I suppose not many people read such sort of agreements in depth.

Thanks,

Maxim.

Katie Thomas (Atlassian) - 7 Mar 2013, 02:07 AM

Hi Maxim,

Thanks for your response.

I have added your inquiry to the existing ticket we have open with Legal. They should be able to elaborate further on your specific inquiries.

In the meantime, I can confirm that Atlassian's End User Agreement governs all products for all clients. We do not make changes to our agreement on a one off basis with individual customers. The benefit of this approach is that our purchasing process is simplified by removing the negotiation process and keeping overhead costs (such as legal fees) at a minimum. This allows us to keep our pricing low, compared to other Enterprise software solutions.

When we receive requests such as yours, we collect and evaluate the feedback to see if the suggestions might pose a benefit to all clients. They are assembled over time and revisions to our End User Agreement are pushed out to all customers every few years. You can read more about our policy in the End User Agreement FAQ.

I will be in contact with you when I hear back from Legal. Thanks for your patience in this matter.

Cheers,

Katie Thomas

Katie Thomas (Atlassian) - 12 Mar 2013, 10:43 AM

Hi Maxim,

Thanks for your patience while our legal team looked over your inquiry further.

Here is our response to your inquiry:

We do not claim ownership in End User content. This is specifically addressed in Section 3.4:

"3.4 End User Data. Unless otherwise specified, End User retains ownership of any data or other content or information that End User provides through the Hosted Services, including any code uploaded to Bitbucket (as described below) ("End User Data")."

The "unless otherwise specified" qualifier is a reference to Section 7, which is about feedback that a user may submit to us about Atlassian products. Users are not required to submit any feedback to us.

There is nothing in the agreement that would require Bitbucket users to share their profits with us.

Again, we are not getting ownership. We are getting a license, and the license is limited to operating the service: "End User hereby grants Atlassian a non-exclusive license to copy, distribute, perform, display, store, modify, and otherwise use End User Data in connection with operating the Hosted Services." Taking a user's product hosted on Bitbucket and using it commercially does not fall within the scope of operating the hosted service. The license grant we have is no different than the license grant that any other provider of a hosted service would need.

In terms of our ability to delete or remove any End User Data at our discretion, obviously we would not do that without good reason. Otherwise, no one would use the service. That is the practical reality. From a legal perspective, we need the flexibility that the language provides to remove inappropriate or infringing content.

I hope this explains. Please let us know if we can assist with any further questions you might have.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket-cloud

licence

legal