RainbookRainbook data processing agreement
Effective 20 October 2026. This agreement is part of the end user terms between your organisation (the "customer") and Human Renaissance Corporation ("we"). It applies when we process personal data for the customer through Rainbook, Rainbook Mail Sync, the Gmail add-on and the Outlook add-in (the "apps"). It needs no signature; a countersigned copy is available from privacy@rainbook.humanr.ai.
1. Roles
The customer is the controller of the personal data it puts in the apps or captures with them. We are its processor. Atlassian hosts the apps on Forge and is our subprocessor.
2. Details of the processing
| Subject matter | Providing the apps: a CRM inside the customer's Jira site, email and calendar capture, reports and AI features |
| Duration | The customer's subscription, then deletion as section 9 describes |
| Nature and purpose | Storing, indexing, displaying, summarising and reporting on the customer's CRM records and captured email and meetings, as the customer's users direct |
| Personal data | Names, email addresses, phone numbers, job titles and other contact details; email and meeting content and files; Jira account IDs; usage and activity history |
| Data subjects | The customer's users; the customer's customers, prospects, partners and other people who exchange email or meetings with them |
| Sensitive data | None: the end user terms don't allow sensitive personal data. The apps mask payment card numbers and US Social Security numbers wherever they write text (captured and logged email, calendar events, imports, the apps' forms and AI output); attached files, file names, images and text typed directly in Jira's own screens are not scanned |
3. Our obligations
We will:
- process personal data only on the customer's documented instructions, which are these terms, the customer's configuration of the apps and its users' actions in them, and tell the customer if we believe an instruction breaks data protection law;
- make sure everyone who can access the data is bound to keep it secret;
- keep the security measures in Annex 1 in place;
- help the customer answer people's requests to access, correct, export or erase their data, chiefly through the export and erasure tools in the apps;
- help the customer with security, breach notification, impact assessments and consultations with authorities, as far as our role allows;
- make available the information needed to show we meet this agreement, and cooperate with audits as section 8 describes.
4. Subprocessors
The customer authorises the subprocessors on the subprocessor list. We give the customer at least 30 days' notice before a new subprocessor receives personal data, by updating the list and emailing the licence's technical contact. The customer may object on reasonable data protection grounds within that period; if we can't resolve the objection, the customer may stop using the affected app. We bind each subprocessor to data protection terms no less protective than these and remain responsible for it.
| Subprocessor | What it does | What it receives | Where | When |
|---|---|---|---|---|
| Atlassian | Hosts Rainbook and Rainbook Mail Sync: Jira, Forge storage, Forge LLM and app logs | Everything the apps hold | Your Jira site's data residency region; Forge LLM in Atlassian's published regions | Always |
| Gmail and Google Calendar capture, and the Gmail add-on, which runs on Google Apps Script | Mail and calendar data of the mailboxes your organisation connects, and the email open in the add-on | Your organisation's Google Workspace | When your organisation connects Google Workspace | |
| Microsoft | Microsoft 365 mail and calendar capture, and the Outlook add-in | Mail and calendar data of the mailboxes your organisation connects, and the email open in the add-in | Your organisation's Microsoft 365 tenant | When your organisation connects Microsoft 365 |
| Cloudflare | Static website hosting, sign-in redirect pages, cookieless website analytics and the website's forms | Website visits, sign-in codes in transit and what you type in a website form; stores no customer data | Cloudflare's global network | Always |
| PostHog | Product usage analytics | Screens, features, timings and setup steps, keyed by pseudonymous site and user IDs; never names, email addresses, record content or prompts | United States (PostHog's US cloud) | On by default; admins can switch it off in Atlassian's admin controls |
| Sentry | Error reports | Error type and stack trace, keyed by a scrambled site ID only; never a person, name, email address, record content or prompts | United States (Sentry's US region; the apps refuse any other) | On by default; admins can switch it off in Atlassian's admin controls |
| Loops | Product and onboarding email | Name, email address and company of licence and evaluation contacts and of people who sign up for release updates or the launch list on the website, with the launch video and platform that sent them and the time they agreed to email | United States (Loops' servers) | Until the person unsubscribes, with one click |
| logo.dev | Company logos for new and enriched accounts | A company's web domain only | Mainly the United States (logo.dev's servers) | When Rainbook Mail Sync adds a company's logo |
| Salesforce | Import from Salesforce | The import your admin starts, on your organisation's own Salesforce account | Your organisation's Salesforce account | From January 2027, only when your admin turns it on |
| HubSpot | Import from HubSpot | The import your admin starts, on your organisation's own HubSpot account | Your organisation's HubSpot account | From January 2027, only when your admin turns it on |
| Pipedrive | Import from Pipedrive | The import your admin starts, on your organisation's own Pipedrive account | Your organisation's Pipedrive account | From January 2027, only when your admin turns it on |
| Apollo | Contact and company enrichment | A contact's email address or a company's web domain, on your organisation's own Apollo key | United States | From January 2027, only when your admin turns it on |
| People Data Labs | Contact and company enrichment | A contact's email address or a company's web domain, on your organisation's own People Data Labs key | United States | From January 2027, only when your admin turns it on |
| European Central Bank | Daily exchange rates for deal values in other currencies | A request for the day's rates; nothing about your organisation | European Union | From January 2027, only when your admin turns it on |
| SAM.gov | US federal contract opportunities for government contractors | The search filters your admin sets, on your organisation's own SAM.gov key | United States | From January 2027, only when your admin turns it on |
| Slack | Rainbook alerts in a Slack channel | The alert text your admin chooses to send, to your organisation's own Slack incoming webhook | Your organisation's Slack workspace | In a later release, only when your admin connects your organisation's own Slack webhook; nothing is sent until then |
| Microsoft Teams | Rainbook alerts in a Microsoft Teams channel | The alert text your admin chooses to send, to your organisation's own Teams workflow | Your organisation's Microsoft 365 tenant | In a later release, only when your admin connects your organisation's own Teams workflow; nothing is sent until then |
| Zapier | Rainbook events in your Zapier automations | The events and fields your admin chooses to send, to your organisation's own Zapier webhook | United States (Zapier's servers) | In a later release, only when your admin connects your organisation's own Zapier webhook; nothing is sent until then |
| Make | Rainbook events in your Make scenarios | The events and fields your admin chooses to send, to your organisation's own Make webhook | Your Make organisation's region (EU or US) | In a later release, only when your admin connects your organisation's own Make webhook; nothing is sent until then |
| Brave Search | Web search for account and contact research | The search terms, such as a company name or web domain, on your organisation's own Brave Search API key | United States | In a later release, only when your admin connects your organisation's own Brave Search API key; nothing is sent until then |
| Anthropic | AI features on your own Anthropic key, instead of Atlassian-hosted models | The prompt and the records it needs, on your organisation's own Anthropic key | United States | In a later release, only when your admin connects your organisation's own Anthropic key; nothing is sent until then |
| OpenAI | AI features on your own OpenAI key, instead of Atlassian-hosted models | The prompt and the records it needs, on your organisation's own OpenAI key | United States, or the region your OpenAI project uses | In a later release, only when your admin connects your organisation's own OpenAI key; nothing is sent until then |
| Microsoft Azure AI | AI features on your own Azure OpenAI or Azure AI Foundry resource (including Claude and other Foundry models), instead of Atlassian-hosted models | The prompt and the records it needs, on your organisation's own Azure resource and key | The Azure region your organisation chose for its resource | In a later release, only when your admin connects your organisation's own Azure key; nothing is sent until then |
5. International transfers
Where personal data moves out of the European Economic Area or the United Kingdom to a country without an adequacy decision, the EU Standard Contractual Clauses apply: module 2 (controller to processor) between the customer and us, and module 3 (processor to processor) between us and our subprocessors, with the UK International Data Transfer Addendum for UK data. Data the apps store stays in the customer's Jira site's data residency region: Rainbook's own data, and what Rainbook Mail Sync keeps in Forge storage (its mailbox connections and tokens, sync progress, the capture ledger and the messages and files waiting to be written) and the captured email and meetings it writes into Jira work items. Rainbook Mail Sync is not pinned to a location, because it reads mail and calendars through Google's or Microsoft's services, which handle that content under the customer's own tenant's settings. Transfers arise mainly from support, from usage analytics and error reports (on by default, with no record content) and from the subprocessors the customer turns on.
6. Security
We keep the technical and organisational measures in Annex 1, and Atlassian provides the Forge platform's controls. We may improve them but will not reduce the overall protection they give.
7. Personal data breaches
We notify the customer without undue delay, and within 72 hours of confirming a personal data breach affecting its data, with what we know about its nature, the data and people concerned, likely consequences and what we are doing, and we follow up as we learn more.
8. Audits
We answer the customer's reasonable written security questions and share our security documentation, including the penetration test summary once available. Where that isn't enough, or an authority requires it, the customer may audit our compliance with this agreement once a year, at its own cost, with 30 days' notice, during business hours and under a duty to keep what it learns secret.
9. Deletion and return
During the subscription the customer can export its records from Jira and export or erase any person's data with the apps' tools. When the subscription ends and the apps are uninstalled, the customer's work items stay in its Jira site. When you uninstall Rainbook Mail Sync, capture stops and Mail Sync revokes the Google sign-in tokens of people who connected their own Google mailbox, most recently used first. Atlassian deletes the app's Forge-hosted data 28 days after uninstall; a reinstall requested within 21 days can be relinked to that data. Atlassian keeps deleted app data for a limited recovery period before destroying it, and Jira backups follow your site's backup schedule. We keep no copy of the customer's data, apart from diagnostics an admin shared with support, which stay with that support request and are deleted on request.
Annex 1: security measures
- Hosting. The apps run only on Atlassian's Forge platform, with data in the customer's Jira site and Atlassian-hosted Forge storage for that site, separated from every other site.
- Encryption. Atlassian encrypts Forge storage at rest with AES-256 and all traffic in transit; mailbox tokens are kept as encrypted Forge secrets and deleted on disconnect, with Google sign-in tokens revoked with Google first.
- Access control. Every request checks the caller, the licence and Jira permissions; every read of the apps' own storage is filtered by Jira permissions and security levels; admin actions are checked live.
- Least privilege. Rainbook Mail Sync reads mail and calendars with read-only permissions and can be limited to chosen mailboxes.
- Logging. App logs carry account IDs, the cloud ID, site host and record keys only, never names, email addresses or content, and are kept 30 days. The activity history records who changed what and when.
- Minimisation. Card and Social Security numbers are masked wherever the apps write text, except in attached files, file names, images and text typed directly in Jira's own screens; analytics carry pseudonymous IDs, error reports carry a scrambled site ID only, and neither carries content; AI requests carry only what the request needs and the user can see.
- Staff access. No standing access to customer data; support works from diagnostics an admin chooses to share, or as a time-limited Jira user the admin invites.
- Vulnerability management. Reports to security@rainbook.humanr.ai; fixes within Atlassian's cloud deadlines; an independent penetration test in January and February 2027.
- Incidents. A written incident process with round-the-clock response to critical issues.