Loom AI
Graded against 811 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
No lens is bandable yet — banding requires fully verified documents with on-criteria findings. The gap is shown honestly, never estimated.
“We may use artificial intelligence in responding to your pricing, billing or licensing-related requests. We also communicate with you about new Services, product offers, promotions, and contests. You can control whether you receive these communications as described below at “ How to access and control your information ” under "Opt-out of communications." …”
Watch: indemnity liability
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
This segment caps Atlassian's aggregate liability for all Output Claims at the lesser of amounts paid in the preceding 12 months or US$1,000,000, and designates Section 4 as the exclusive remedy for Output-related claims, thereby limiting Atlassian's financial exposure and foreclosing other remedies.
This segment describes retention obligations for managed accounts (retained as required by the account administrator) and marketing information (retained for a reasonable period from last expression of interest), constituting specific retention duration obligations for different data categories.
This segment creates an obligation for Atlassian to maintain de-identified data in de-identified form and not attempt to re-identify it, restricting downstream re-identification of aggregated data.
Scores derived from 48 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Loom AI's terms explicitly protect your inputs from training use — the policy is affirmatively favorable on this point.
- Output ownership has conditions — review the commercial use and license carve-outs before building on these outputs.
- Data handling is conditional — 5 privacy or retention clauses warrant review before using Loom AI at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Loom AI's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Fully verified — complete core corpus captured and read in full.
- Terms of ServiceVerified - read in full - 9 citationsstaticLast captured 2026-07-31
- Privacy PolicyVerified - read in full - 71 citationsstaticLast captured 2026-07-27
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This segment discloses that Atlassian may use AI in responding to billing and licensing requests, and uses user information for customer support including development and training purposes, constituting a disclosure of AI use and training-related data processing.
"We may use artificial intelligence in responding to your pricing, billing or licensing-related requests. We also communicate with you about new Services, product offers, promotions, and contests. You can control whether you receive these co..."
This segment discloses that Atlassian collects and stores content users post, send, receive, and share through its products and websites, and that it acts as a processor or service provider on behalf of customers, defining the legal role and scope of content data collection.
" Content you provide through our products: The Services include the Atlassian products you use, where we collect and store content that you post, send, receive and share. We process this content in the role of a processor or service provide..."
This segment describes the collection of payment and billing information for paid services, including designation of billing representatives and payment card details processed via third-party payment processors, constituting a data collection disclosure.
" Payment Information: We collect payment and billing information when you register for certain paid Services. For example, we ask you to designate a billing representative, including name and contact information, upon registration. You mi..."
Defines the covered entities ('Atlassian', 'we', 'us', 'our') and the scope of the policy, explaining that it governs collection, use, sharing, and protection of information when using Atlassian's products, services, and websites; cross-references affiliates via SEC filing.
" Your privacy matters to us. This privacy policy explains how Atlassian Pty Ltd, Atlassian US, Inc. and our corporate affiliates (“Atlassian”, “we”, “us”, “our”) collect, use, share, and protect your information when you use our products, s..."
Describes Atlassian's practices of collecting information from users directly, automatically, and from third-party sources, and outlines the range of purposes for which information is used (providing services, personalization, improvement, communication), establishing the legal basis and scope of Atlassian's data processing obligations.
" Atlassian collects information directly from you when you provide it to us, automatically when you use our Services, and from other sources including other users of the Services, other services you link to your account, other Atlassian com..."
This segment discloses that learnings from user data may be applied across services to improve and develop similar features, that new features are tested with some users, and that contact information is used for transactional communications, constituting a disclosure of training-adjacent use and communications practices.
"In some cases, we apply these learnings across our Services to improve and develop similar features, to better integrate the Services you use, or to provide you with insights based on how others use our Services. We also test and analyze ce..."
This clause introduces the U.S. state privacy disclosures section and describes the information to be provided therein, including categories of personal information collected, purposes of collection and disclosure, categories of recipients, and characterization of disclosures as potential 'sales' or 'sharing' under U.S. state privacy laws.
" U.S. State privacy disclosures The disclosures in this section apply only to U.S. residents and are intended to supplement this privacy policy with information required by applicable U.S. state laws. The table below describes the catego..."
This segment describes Atlassian's data retention obligations — retaining information based on type, purpose, legal requirements, and user preferences — and the obligation to delete or de-identify data after the applicable retention period, including procedures for data stored in backup archives.
" How long we keep information we collect about you depends on the type of information, the purposes for which it was collected, applicable legal or regulatory requirements, and user expectations and preferences. After such time, we will eit..."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" (c) Disclaimers . Output is generated by artificial intelligence, including by using technology provided by third-party subcontractors. Atlassian makes no warranty as to the accuracy, completeness or reliability of Output or that it does not violate third-party rights or Law . Due to the nature of the AI Offerings, (i) Output may not be unique or exclusive to Customer and its Users, (ii) the same or similar Input may yield differing Output, and (iii) Output does not represent Atlassian’s or its subcontractors’ views. "
This segment disclaims Atlassian's warranty as to the accuracy, completeness, reliability, or lawfulness of Output; discloses that Output is generated using third-party subcontractor technology; and warns that Output may not be unique, that similar inputs may yield different outputs, and that Output does not represent Atlassian's or its subcontractors' views — limiting Atlassian's legal exposure for Output quality and content.
AI-generated interpretation, not legal advice.
"We may use artificial intelligence in responding to your pricing, billing or licensing-related requests. We also communicate with you about new Services, product offers, promotions, and contests. You can control whether you receive these communications as described below at “ How to access and control your information ” under "Opt-out of communications." To provide customer support: We use your information to resolve technical issues you encounter, to respond to your requests for assistance, to analyze crash information, and to repair and improve the Services, including for development, training, or fine-tuning of machine learning and artificial intelligence models. We may also use generative artificial intelligence in responding to your support related requests. Where you give us express permission to do so, we may disclose information to a third-party expert for the purpose of responding to support-related requests. To maintain Service safety and security: We use information about you and your use of the Services to verify accounts and activity, to detect, prevent, and respond to potential or actual security incidents, and to monitor and protect against other malicious, deceptive, fraudulent, illegal or inappropriate activity, including violations of Service policies. Detection and response may leverage generative artificial intelligence or machine learning tools. To protect our legitimate business interests and legal rights: Where required by law or where we believe it is necessary to protect our legal rights and interests, or the legal rights or interests of others, we use information about you in connection with legal claims, compliance, regulatory, and audit functions, and disclosures in connection with the acquisition, merger or sale of a business. "
This segment discloses that Atlassian may use AI in responding to billing and licensing requests, and uses user information for customer support including development and training purposes, constituting a disclosure of AI use and training-related data processing.
AI-generated interpretation, not legal advice.
" How we use the information we collect depends on which Services you use, how you use them, and any preferences you have communicated to us. We use information for the following purposes: To provide the Services and personalize your experience: We use information about you to provide the Services to you, including to process transactions, authenticate you when you log in, provide customer support, and operate, maintain, and improve the Services. We may use your email domain to infer your affiliation with a particular organization or industry to personalize the content and experience you receive on our websites. Based on your interactions with different Atlassian products, third-party services you link or install, and advertisements, we will personalize your experience and tailor our communications, recommendations and offers to you. To develop and improve our Services: We are always looking for ways to make our Services smarter, faster, secure, integrated, and useful. We use information and collective learnings (including feedback) about how people use our Services, as well as content that has been de-identified and aggregated in accordance with applicable data contribution product functionalities, to troubleshoot, to identify trends, usage, activity patterns and areas for integration, to improve our Services and to develop new products, features and technologies that benefit our users and the public. For example, to improve the @mention feature, we automatically analyze recent interactions among users and how often they @mention one another to surface the most relevant connections for users, or we might analyze Marketplace search terms to improve the accuracy and relevance of suggested apps returned when you use the search feature. "
This segment describes how Atlassian uses collected information to provide, personalize, maintain, and improve the services including processing transactions, authentication, and customer support, constituting a statement of processing purposes and obligations.
AI-generated interpretation, not legal advice.
" We automatically collect information about you when you use our Services, including browsing our websites and taking certain actions within the Services. Information may also be collected about how you interact with and use features in our software products. This includes the following categories of information: Your use of the Services: We collect information about your use, operation, and interaction with any of our Services, including when you connect third party services to or use those services with ours. This information includes, for example, the features you use, the actions you perform, and the type of content you interact with, such as the type, size and filenames of attachments uploaded to the Services; how search terms are structured and relevance scores of search results to search terms; the number of words in a Jira ticket or @ mentions in a comment; the type of Loom videos created and the number of views; languages you work in; and the links you interact with. We also collect information about how you interact with others on the Services, including the teams and people you work with and how you work with them, like who you collaborate with and communicate with most frequently. Administrators may enable our collection of this information from software products. Device and Connection Information: We collect information about your computer, phone, tablet, or other devices you use to access the Services. "
This segment describes automatic collection of information about how users use, operate, and interact with the services including when connecting third-party services, detailing the scope and categories of usage data collected.
AI-generated interpretation, not legal advice.
"In some cases, we apply these learnings across our Services to improve and develop similar features, to better integrate the Services you use, or to provide you with insights based on how others use our Services. We also test and analyze certain new features with some users before rolling the feature out to all users. To communicate with you about the Services: We use your contact information to send transactional communications via email and within the Services, including confirming your purchases, reminding you of subscription expirations, responding to your comments, questions and requests, and providing customer support. We also provide tailored communications based on your activity and interactions with us, and we may contact you regarding product feedback. If an opt out is available, you will find that option within the communication itself or in your account settings. To conduct marketing and promotional activities: We use information about you and how you use the Services for analysis, research and communications relating to marketing (including targeted advertising of products that may interest you), promotional activities, and business development. We may use your contact information and information about how you use the Services to send promotional communications that may be of specific interest to you, including by email and by displaying Atlassian ads on other companies' websites and applications. These communications may be informed by, for example, your interactions (like counting ad impressions), and are aimed at driving engagement and maximizing what you get out of the Services, including information about new features, survey requests, newsletters, and events we think may be of interest to you. "
This segment discloses that learnings from user data may be applied across services to improve and develop similar features, that new features are tested with some users, and that contact information is used for transactional communications, constituting a disclosure of training-adjacent use and communications practices.
AI-generated interpretation, not legal advice.
" How long we keep information we collect about you depends on the type of information, the purposes for which it was collected, applicable legal or regulatory requirements, and user expectations and preferences. After such time, we will either delete or de-identify your information or, if this is not possible (for example, because the information has been stored in backup archives), then we will securely store your information and isolate it from any further use until deletion is possible. Account information: We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate the Services. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our Services. Where we retain information to develop and improve our Services, we take steps to de-identify the information. Content you provide through our products: We retain de-identified and aggregated content in accordance with documentation for applicable data contribution Product functionalities. Information you share on the Services: If your account is deactivated or disabled, some of your information and the content you have provided will remain in order to allow your team members or other users to make full use of the Services. For example, we continue to display messages you sent to the users that received them and continue to display content you provided. "
This segment describes Atlassian's data retention obligations — retaining information based on type, purpose, legal requirements, and user preferences — and the obligation to delete or de-identify data after the applicable retention period, including procedures for data stored in backup archives.
AI-generated interpretation, not legal advice.
" 4.3. Limitation of Liability and Exclusive Remedy . To the maximum extent permitted by Law, Atlassian’s entire liability arising out of or related to all Output Claims will not exceed in aggregate the lesser of (i) the amounts paid to Atlassian for the Cloud Products from which the Output was generated during the twelve (12) months preceding the first event out of which an Output Claim arose, and (ii) US$1,000,000. This Section 4 sets out Customer’s exclusive remedy and Atlassian’s entire liability regarding Output. "
This segment caps Atlassian's aggregate liability for all Output Claims at the lesser of amounts paid in the preceding 12 months or US$1,000,000, and designates Section 4 as the exclusive remedy for Output-related claims, thereby limiting Atlassian's financial exposure and foreclosing other remedies.
AI-generated interpretation, not legal advice.
" Content de-identified and aggregated in accordance with applicable data contribution product settings "
This segment specifies that de-identified and aggregated content may be used in accordance with applicable data contribution product settings for service development and improvement, constituting a conditional permission for using processed user data to improve the platform.
AI-generated interpretation, not legal advice.
" To provide the Services and personalize your experience; To develop and improve the Services; Communicate with you about changes to our terms, conditions, or policies; or to respond to your inquiries, comments, feedback, or questions; Verify your account credentials as needed to log you into the Services and help safeguard your account’s security; Process payments; Detect and prevent fraud, illegal activity, or violations of Service policies, and to maintain the security of our IT systems, architecture, assets, customers, and networks; and Protect our rights, privacy, safety, or property, and/or that of our affiliated companies, you, or other parties, including to enforce this privacy policy and any other agreements or policies."
This clause specifies the processing purposes justified under contractual necessity as a lawful basis, including service provision, payments, fraud detection, and security, obligating the company to process data only for these defined purposes under Article 6(1)(b) GDPR.
AI-generated interpretation, not legal advice.
"Where you have asked us to disclose data to third parties, for example, by installing third-party apps, you will need to contact those third-party service providers directly to have your information deleted or otherwise restricted. If you have unresolved concerns, you may have the right to complain to a data protection authority in the country where you live, where you work, or where you feel your rights were infringed."
This segment describes the procedure for users to exercise deletion rights regarding data disclosed to third-party apps — requiring direct contact with those providers — and establishes the right to complain to a data protection authority, constituting a procedural description of rights enforcement and remedies.
AI-generated interpretation, not legal advice.
" Operate, maintain, and improve the Services; Conduct marketing and promotional activities "
This segment establishes service operation and marketing as the purposes for processing inferred data, defining the permissible use scope for derived behavioral and preference profiles.
AI-generated interpretation, not legal advice.
"This device information includes your connection type and settings when you install, access, update, or use our Services. We also collect information through your device about your operating system, browser type, IP address, URLs of referring/exit pages, device identifiers, and diagnostic and crash data. We use your IP address and/or country preference to approximate your location to provide you with a better Service experience. How much of this information we collect depends on the type and settings of the device you use to access the Services. Cookies and Other Tracking Technologies: Atlassian and our third-party partners, such as our advertising and analytics partners, use cookies and other tracking technologies (e.g., web beacons, device identifiers and pixels) to provide functionality, to recognize you across different Services and devices, or to demonstrate that certain content was viewed or clicked. For more information, please see our Cookies & Tracking Notice , which includes information on how to control or opt out of these cookies and tracking technologies. Identity Management and Authentication Information: In addition, we may collect certain information to help verify or authenticate your identity when you log into the Services. This information may be provided directly by you or collected through trusted third‑party services. For example, we may collect device and browser information, behavioral and interaction data (such as mouse movements or interaction timing to confirm you’re human), and similar data used to support secure access to the Services."
This segment describes automatic collection of device information, operating system, browser type, IP address, and cookie/tracking data, and explains how IP address is used to approximate location, constituting a disclosure of data collection scope and use.
AI-generated interpretation, not legal advice.
" With your consent: We use information about you where you have given us consent to do so for a specific purpose not listed above. For example, we may publish testimonials or featured customer stories to promote the Services, with your permission. To aggregate and/or de-identify data : We may aggregate and/or de-identify information collected through the Services so it can no longer be re-identified by us or another party. We may use content that is de-identified and aggregated in accordance with applicable data contribution product functionalities to develop and improve our Services. We may aggregate or de-identify other information described in “Information we collect,” such as data about use of our Services, information provided to support channels, and feedbacks for a number of purposes, including to develop and improve our Services and to conduct marketing and promotional activities."
This segment grants Atlassian permission to use information where consent has been given, and discloses that aggregated or de-identified data may be used to develop and improve services, constituting a permissive clause for consent-based and de-identified data use including training purposes.
AI-generated interpretation, not legal advice.
" Geolocation data , such as your approximate location, IP address, time zone "
This segment defines the 'Geolocation data' category of personal data collected, enumerating approximate location, IP address, and time zone as specific data elements subject to the platform's collection and disclosure practices.
AI-generated interpretation, not legal advice.
" Payment Information: We collect payment and billing information when you register for certain paid Services. For example, we ask you to designate a billing representative, including name and contact information, upon registration. You might also provide payment information, such as payment card details, which we collect via secure payment processing services."
This segment describes the collection of payment and billing information for paid services, including designation of billing representatives and payment card details processed via third-party payment processors, constituting a data collection disclosure.
AI-generated interpretation, not legal advice.
" Operate, maintain, and improve the Services; Conduct marketing and promotional activities; Detecting security incidents; Debugging; Customer support "
This segment enumerates the purposes for processing professional and employment information, establishing the platform's legal bases for using occupational data across service operation, marketing, security incident detection, debugging, and customer support.
AI-generated interpretation, not legal advice.
" To maintain Service safety and security; Detect and prevent fraud, illegal activity, or violations of the terms of our agreements and our Service policies; Authenticate account credentials, as necessary to log you into the Services and help protect the security of your account; and Comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliated companies, you, or other parties, including to enforce this privacy policy and any other agreements or policies."
This clause enumerates processing purposes justified under the legal obligation basis, including compliance with law, fraud detection, and security measures, obligating the company to process data to fulfill its legal duties under Article 6(1)(c) GDPR.
AI-generated interpretation, not legal advice.
" This privacy policy describes Atlassian’s data practices as a controller of personal information. Please note that this privacy policy does not apply to the extent that we process personal information in the role of a processor or service provider on behalf of our customers, as further specified in the Data Processing Addendum entered into with those customers. When Atlassian processes personal information on behalf of our customers (such as your employer, if applicable), the customer is the controller of the personal information processed and manages those accounts and any Service sites. In such cases, Atlassian acts as a processor or service provider on behalf of our customer and handles your information according to the instructions of that organization. We are not responsible for the privacy or security practices of our customers, which may differ from those described in this privacy policy. For more information about how an Atlassian customer uses your personal information, or to exercise the rights you may have with respect to that information, please contact that organization directly."
Clarifies that this policy applies only when Atlassian acts as a data controller, and explicitly disclaims its application to processing performed as a processor or service provider on behalf of customers; incorporates the Data Processing Addendum as the governing instrument for processor-role activities, and defines the customer as controller in those contexts.
AI-generated interpretation, not legal advice.
Common questions about Loom AI's policies
- Does Loom AI train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 3 verified findings from Loom AI's published policy. Informational only, not legal advice.
- Who owns the content you create with Loom AI?
- You own outputs — with license carve-outs — based on 1 verified finding from Loom AI's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Loom AI's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
19 verified clausesClauses in Loom AI's policies that work in your favour — commitments the platform made to you.
- Privacy & data usesale/sharing of personal data
“For more information on how to exercise these your rights, please see the “ How to access and control your information ” section. We encourage you to manage your information, and to make use of the privacy controls we have included in our Services. In order to…”
This segment describes the procedure for exercising data subject rights, including identity verification requirements and the opt-out mechanism for sales, sharing, and targeted advertising of personal information.
📍 Privacy Policy › “Atlassian Companies Service Providers”Jump to exact text → - Privacy & data useads & tracking use
“For example, if you believe a Services account was created for you without your permission, or you are no longer an active user, you can request that we delete your account as provided in this privacy policy. Where you gave us consent to use your information f…”
This segment describes users' rights to request account deletion, withdraw consent for limited-purpose processing, object to third-party disclosure by disabling services, and opt out of promotional communications, consti…
📍 Privacy Policy › “How to access and control your information”Jump to exact text → - Privacy & data use
“Content you provide through our products: The Services include the Atlassian products you use, where we collect and store content that you post, send, receive and share. We process this content in the role of a processor or service provider on behalf of our cu…”
This segment discloses that Atlassian collects and stores content users post, send, receive, and share through its products and websites, and that it acts as a processor or service provider on behalf of customers, defini…
📍 Privacy Policy › “Information you provide”Jump to exact text → - Privacy & data use
“Your Choices: You have certain choices available to you when it comes to your information. Below is a summary of those choices, how to exercise them and any limitations: Access and update your information: Our Services give you the ability to access and up…”
This segment describes user choices and rights to access and update personal information within the service or by request, constituting a statement of access and correction rights with procedural guidance.
📍 Privacy Policy › “How to access and control your information”Jump to exact text → - Audit rights, DPA & residency
“Data Privacy Framework (EU-U.S. DPF) entered into force. Atlassian, Inc. and its U.S. subsidiaries (Atlassian Network Service, Inc., Dogwood Labs, Inc., AgileCraft LLC, Loom, Inc., Opsgenie, Inc., and Trello, Inc.) adhere to the Data Privacy Framework Princip…”
This clause establishes Atlassian's adherence to the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF for cross-border data transfers, imposing obligations on the company and its U.S. subsidiaries regardi…
📍 Privacy Policy › “United Kingdom”Jump to exact text → - Audit rights, DPA & residency
“In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Atlassian commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S.…”
This clause establishes a dispute resolution procedure under the DPF, committing Atlassian to refer unresolved DPF-related complaints to TRUSTe as an alternative dispute resolution provider, and directing data subjects o…
📍 Privacy Policy › “United Kingdom”Jump to exact text →
+ 13 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
1 verified clauseWhat Loom AI requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcementchildren's data
“(b) Restrictions . Customer must not (and must not permit anyone else to): (i) provide Input that either violates third-party rights or Law or is intended, or would reasonably be expected, to generate Output that does so; (ii) provide Input that includes Perso…”
This segment imposes explicit restrictions on the Customer prohibiting: providing Input that violates third-party rights or Law or is intended to generate unlawful Output; providing Input containing personal data of chil…
📍 § 2.2Jump to exact text →
What the policies actually cover
13 topics- Product telemetry & usage tracking15 clauses
- Advertising & tracking3 protective5 clauses
- Sale or sharing of personal data2 protective4 clauses
- Sensitive data (biometric, location, health)1 clause
- Children's data1 protective1 obligation2 clauses
- Government & law-enforcement disclosure2 clauses
- Does not train on your content1 protective2 clauses
- Trains by default, opt-out available1 clause
- Damages & liability cap2 clauses
- Indemnity direction1 protective1 clause
- Terms can change at any time1 protective1 clause
- Deletion rights & post-termination survival1 clause
- Breach-notification promises1 protective1 clause
42 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “How long we keep information” addresses how long content is retained, and the Privacy Policy, Privacy Policy › “How we use information” addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The Terms of Service, § 2.2 describes rights the platform takes in user content, and the Privacy Policy, Privacy Policy › “Disclosing to affiliated companies” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Atlassian commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of ...”Open source citation
The clause appears to reserve or claim ownership rights for the platform.
“Managed accounts: If the Services are made available to you through an organization (e.g., your employer), we retain your information as long as required by the administrator of your account. For more information, see "Managed accounts and administrators" at the “ How we disclose information ” section. Marketing information: If you have elected to receive marketing emails from us, we retain information about your ...”Open source citation
The clause requires defense, indemnity, or hold-harmless obligations.
“4.1. Indemnification . Atlassian will defend Customer from and against any third-party claim to the extent alleging that Output of the AI Offerings, when used by Customer as authorized by the Agreement, directly infringes any copyright of a third party (an “ Output Claim ”) and indemnify and hold harmless Customer against any damages, fines or costs finally awarded by a court of competent jurisdiction (including r...”Open source citation
The clause limits liability or disclaims warranties.
“4.3. Limitation of Liability and Exclusive Remedy . To the maximum extent permitted by Law, Atlassian’s entire liability arising out of or related to all Output Claims will not exceed in aggregate the lesser of (i) the amounts paid to Atlassian for the Cloud Products from which the Output was generated during the twelve (12) months preceding the first event out of which an Output Claim arose, and (ii) US$1,000,000...”Open source citation
The clause permits sale of personal data or information.
“For more information on how to exercise these your rights, please see the “ How to access and control your information ” section. We encourage you to manage your information, and to make use of the privacy controls we have included in our Services. In order to protect your information from unauthorized access or deletion, we may require you to provide additional information to verify your identity. If we cannot ve...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | audit rights dpa residency | conditional | MEDIUM | 2 |
| All applicable tiers | data retention | worsens | HIGH | 4 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 1 |
| All applicable tiers | indemnity liability | conditional | MEDIUM | 2 |
| All applicable tiers | privacy data use | worsens | HIGH | 6 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 2 |
| All applicable tiers | training use | worsens | HIGH | 1 |
| Government | privacy data use | conditional | MEDIUM | 1 |
| Government | subprocessors data sharing | conditional | MEDIUM | 1 |
| Pro / Paid | indemnity liability | conditional | MEDIUM | 1 |
| Pro / Paid | subprocessors data sharing | conditional | MEDIUM | 1 |
| Pro / Paid | training use | conditional | MEDIUM | 1 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“For more information on how to exercise these your rights, please see the “ How to access and control your information ” section. We encourage you to manage your information, and to make use of the privacy controls we have included in our Services. In order to protect your information from unauthorized access or deletion, we may require you to provide additional information to verify your identity. If we cannot verify your identity, we may not be able to fulfill your request. Opt out of “sales”, “sharing”, and “targeted advertising” : You may also opt out of “sales” of personal information to third parties, “sharing” of personal information for purposes of cross-context behavioral advertising, and “targeted advertising” by clicking here and following the instructions. Where required, we also honor requests to opt out submitted via privacy preference signals recognized under applicable law, such as the Global Privacy Control (“GPC”). For more information on the GPC and how to use a browser or browser extension incorporating the GPC signal, see Global Privacy Control — Take Control Of Your Privacy . We do not knowingly sell or share the personal information of consumers under 16 years of age. Authorized agent: You may also authorize an agent to exercise your rights on your behalf. To do this, you must provide the authorized agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from the agent when they make a request on your behalf. We may also ask you to verify your own identity or directly confirm with you that you have granted permission to the authorized agent.”Before citation
“DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. Atlassian remains liable under the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles if the Atlassian’s agent processes personal information in a manner inconsistent with the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles, unless the Atlassian proves that it is not responsible for the event giving rise to damage.”After citation
Latest stance: third party or vendor sharing on privacy data use
“DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. Atlassian remains liable under the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles if the Atlassian’s agent processes personal information in a manner inconsistent with the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles, unless the Atlassian proves that it is not responsible for the event giving rise to damage.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“We make collaboration tools, and we want them to work well for you. This means disclosing information through the Services and to certain third parties. We disclose information we collect in the ways discussed below.”Open timeline citation
Latest stance: third party or vendor sharing on training use
“We disclose information to third parties that help us operate, provide, improve, integrate, customize, support, and market our Services. All the above categories exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties, excluding aggregators and providers of the text messaging services. Service Providers: We work with third-party service providers to provide website and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, analysis, marketing, and other services for us, which may require them to access or use information about you. If a service provider needs to access information about you to perform services on our behalf, they do so under close instruction from us, including appropriate security and confidentiality procedures designed to protect your information. Atlassian Partners: We work with a global network of partners who provide consulting, implementation, training and other services around our products. We may disclose your information to these third parties in connection with their services, such as to assist with billing and collections, to provide localized support, and to provide customizations. We may also disclose information to these third parties where you have agreed to that disclosure. Third-Party Services: You, your administrator or other Service users may choose to add new functionality or change the behavior of the Services by installing or connecting third-party services.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“These widgets and features may collect your IP address, which page you are visiting on the Services, and may set a cookie to enable the feature to function properly. Widgets and social media features are either hosted by a third-party or hosted directly on our Services. You should always check the privacy settings and notices in these third-party services to understand how those third-parties may use your information. With your consent: We may also disclose information about you to third parties when you give us consent to do so. For example, we often display personal testimonials of satisfied customers on our public websites. With your consent, we may post your name alongside the testimonial. Compliance with Enforcement Requests and Applicable Laws; Enforcement of Our Terms and Policies; Enforcement of Our Rights: We may disclose information about you to government authorities, law enforcement, or industry peers if we believe that sharing is reasonably necessary to (a) comply with any applicable law, regulation, legal process or enforceable governmental request, or legal obligation, (b) enforce the terms of our agreements and our policies, (c) protect the security or integrity of our products and services, (d) protect Atlassian, our customers or the public from harm or illegal activities, or (e) respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the death or serious bodily injury of any person.”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-07-31· verified 2026-06-09verified once — no re-scan in 104 days
- Privacy Policy:Last captured 2026-07-27· verified 2026-06-09verified once — no re-scan in 104 days
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↓ 9 fewer findings this quarter vs last (180 vs 189). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Loom AI's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Loom AI's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.