Loom AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ E-Mail: privacy@atlassian.com Individuals in the European Economic Area or United Kingdom may also contact the appropriate representatives identified in the “ European Economic Area and United Kingdom privacy disclosures ” section. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Atlassian Pty Ltd commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK and Swiss individuals with inquiries or complaints regarding our handling of personal information received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact us at privacy@atlassian.com .” | Captured 2026-06-09Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Data Privacy Framework (EU-U.S. DPF) entered into force. Atlassian, Inc. and its U.S. subsidiaries (Atlassian Network Service, Inc., Dogwood Labs, Inc., AgileCraft LLC, Loom, Inc., Opsgenie, Inc., and Trello, Inc.) adhere to the Data Privacy Framework Principles regarding the collection, use, and retention of personal data that is transferred from the European Union and Switzerland to the U.S. Atlassian complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Atlassian has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Atlassian has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/ . ” | Captured 2026-06-09Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ E-Mail: ukrepresentative@atlassian.com International transfers: We collect information globally and may transfer, process, and store your information outside of your country of residence, to wherever we or our third-party service providers operate for the purpose of providing you the Services. Whenever we transfer your information, we take steps to protect it. International transfers within the Atlassian Companies: To facilitate our global operations, we transfer information globally and allow access to that information from countries in which the Atlassian owned or operated companies have operations for the purposes described in this privacy policy. These countries may not have equivalent privacy and data protection laws to the laws of your country. When we disclose information about you within and among Atlassian corporate affiliates, we make use of the Data Privacy Framework to receive personal data transfers from the European Union/European Economic Area to the U.S. (see the “Data Privacy Framework notice” section below), and the standard contractual data protection clauses (see here ), which have been approved by the European Commission, to safeguard the transfer of information we collect from the European Economic Area, the United Kingdom (the "UK"), and Switzerland. Refer to this page for a list of countries to which we regularly transfer personal data. Data Privacy Framework notice: On July 10, 2023, the European Commission’s adequacy decision for the EU-U.S. ” | Captured 2026-06-09Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. Atlassian remains liable under the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles if the Atlassian’s agent processes personal information in a manner inconsistent with the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles, unless the Atlassian proves that it is not responsible for the event giving rise to damage.” | Captured 2026-06-09Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ E-Mail: eudatarep@atlassian.com UK Representative:” | Captured 2026-06-09Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Atlassian commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit Submit a Report - Watchdog for more information or to file a complaint. These dispute resolution services are provided at no cost to you. The Federal Trade Commission has jurisdiction over Atlassian’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. For complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website: Data Privacy Framework . In certain situations, Atlassian may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. In the context of onward transfers, Atlassian is accountable for the processing of personal data it receives, under the EU-U.S. ” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ How long we keep information we collect about you depends on the type of information, the purposes for which it was collected, applicable legal or regulatory requirements, and user expectations and preferences. After such time, we will either delete or de-identify your information or, if this is not possible (for example, because the information has been stored in backup archives), then we will securely store your information and isolate it from any further use until deletion is possible. Account information: We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate the Services. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our Services. Where we retain information to develop and improve our Services, we take steps to de-identify the information. Content you provide through our products: We retain de-identified and aggregated content in accordance with documentation for applicable data contribution Product functionalities. Information you share on the Services: If your account is deactivated or disabled, some of your information and the content you have provided will remain in order to allow your team members or other users to make full use of the Services. For example, we continue to display messages you sent to the users that received them and continue to display content you provided. ” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ To the extent we use such data, we maintain and use such data in de-identified form and will not attempt to re-identify the data.” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Managed accounts: If the Services are made available to you through an organization (e.g., your employer), we retain your information as long as required by the administrator of your account. For more information, see "Managed accounts and administrators" at the “ How we disclose information ” section. Marketing information: If you have elected to receive marketing emails from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our Services, such as when you last opened an email from us or ceased using your Atlassian account. We retain information derived from cookies and other tracking technologies for a reasonable period of time from the date such information was created.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We disclose information we collect to affiliated companies and, in some cases, to prospective affiliates. Affiliated companies are companies owned or operated by us. The protections of this privacy policy apply to the information we disclose in these circumstances. Atlassian companies: We disclose information to other Atlassian corporate affiliates in order to operate, maintain, and improve the Services, and to offer you other Atlassian affiliated services. This includes companies that own or operate the Services. Business Transfers: We may disclose or transfer information we collect under this privacy policy in connection with any merger, sale of company assets, financing, reorganization, dissolution, or acquisition of all or a portion of our business to another company. You will be notified via email and/or a prominent notice on the Services if a transaction takes place, as well as any choices you may have regarding your information.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We make collaboration tools, and we want them to work well for you. This means disclosing information through the Services and to certain third parties. We disclose information we collect in the ways discussed below.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “For more information on how we respond to government requests, see our Guidelines for Law Enforcement and our Transparency Report .” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “These widgets and features may collect your IP address, which page you are visiting on the Services, and may set a cookie to enable the feature to function properly. Widgets and social media features are either hosted by a third-party or hosted directly on our Services. You should always check the privacy settings and notices in these third-party services to understand how those third-parties may use your information. With your consent: We may also disclose information about you to third parties when you give us consent to do so. For example, we often display personal testimonials of satisfied customers on our public websites. With your consent, we may post your name alongside the testimonial. Compliance with Enforcement Requests and Applicable Laws; Enforcement of Our Terms and Policies; Enforcement of Our Rights: We may disclose information about you to government authorities, law enforcement, or industry peers if we believe that sharing is reasonably necessary to (a) comply with any applicable law, regulation, legal process or enforceable governmental request, or legal obligation, (b) enforce the terms of our agreements and our policies, (c) protect the security or integrity of our products and services, (d) protect Atlassian, our customers or the public from harm or illegal activities, or (e) respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the death or serious bodily injury of any person. ” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third-Party Providers: We may receive information about you from third-party providers of business and security information and from publicly available sources (e.g., social media platforms), including physical mail addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), IP addresses and social media profiles.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We disclose information to third parties that help us operate, provide, improve, integrate, customize, support, and market our Services. All the above categories exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties, excluding aggregators and providers of the text messaging services. Service Providers: We work with third-party service providers to provide website and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, analysis, marketing, and other services for us, which may require them to access or use information about you. If a service provider needs to access information about you to perform services on our behalf, they do so under close instruction from us, including appropriate security and confidentiality procedures designed to protect your information. Atlassian Partners: We work with a global network of partners who provide consulting, implementation, training and other services around our products. We may disclose your information to these third parties in connection with their services, such as to assist with billing and collections, to provide localized support, and to provide customizations. We may also disclose information to these third parties where you have agreed to that disclosure. Third-Party Services: You, your administrator or other Service users may choose to add new functionality or change the behavior of the Services by installing or connecting third-party services. ” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Subscribe to receive notifications from us about updates to our legal terms (including our legal policies) and our list of sub-processors.” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Atlassian Companies Atlassian Partners Service Providers Third-Party Apps ” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We also receive information about you from other Service users, our related companies, our business and channel partners, and third-party providers, including from social media platforms and public databases. We may combine this information with information we collect through other means described above. This helps us, for example, to update and improve our records, provide and improve our Services, identify new customers, create more personalized advertising, and suggest services that may be of interest to you. This includes information collected from the following sources: Other users of the Services: We receive your email address from other Service users when they provide it in order to invite you to the Services. Similarly, an administrator may provide your contact information when they designate you as the billing or technical contact on your company's account or when they designate you as an administrator. Atlassian Companies: We receive information about you from other Atlassian corporate affiliates, in accordance with their terms and policies. Atlassian Partners: We work with a global network of partners who provide consulting, implementation, training and other services around our products. Some of these partners also help us to market and promote our Services, generate leads for us, and resell our Services. We receive information about you and your activities on and off the Services from these partners, such as billing information, billing and technical contact information, company name, what Atlassian Services you have purchased or may be interested in, evaluation information you have provided, what events you have attended, what country you are in, and information about your interest in and engagement with our Services and online advertisements. ” | Captured 2026-06-09Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Doing so may give third-party services access to your account and information about you, like your name and email address. When you intentionally interact with such third-party services, we may disclose certain information to those third parties or receive information from those third parties, consistent with your privacy settings on the third-party service. If you purchase or install a third-party service using Atlassian Marketplace, we will also disclose Order information to the third party in accordance with the Atlassian Marketplace Terms of Use . Third-party service policies and procedures are not controlled by us, and this privacy policy does not cover how third-party services use your information. We encourage you to review the privacy policies of third parties before connecting to or using their applications or services to learn more about their privacy and information handling practices. If you object to information about you being disclosed to these third parties, please do not install or connect the third-party service. Links to Third-Party Sites: The Services may include links that direct you to other websites or services whose privacy practices may differ from ours. If you submit information to any of those third-party sites, your information is governed by their privacy policies. We encourage you to carefully read the privacy policy of any website you visit. Third-Party Widgets: Some of our services contain widgets and social media features, such as the Twitter "tweet" button or Facebook "like" button. ” | Captured 2026-06-09Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.