Rainbook privacy policy

Who is responsible for what

Your organisation decides what goes into Rainbook and is the controller of that data. Human Renaissance Corporation provides the apps and acts on your organisation's instructions. Atlassian hosts the apps on Forge and processes data under Atlassian's data processing addendum.

People who email your team have their messages captured because your organisation chose to capture them. Ask your organisation to remove a person's data; Rainbook erases a person by email address, including people who never used Rainbook.

What the apps store, and where

• Jira work items in your site: deals, leads, follow-ups, renewals, accounts, contacts, conversations, meetings, approvals, and their fields, comments, attachments and properties. Jira's backup, export and permissions apply to them.
• Forge storage for your site (Forge SQL, key-value storage and Object Store, hosted by Atlassian in your site's data residency region): the index of every email address seen, the email index, the reporting mirror, AI working state, the audit log, settings and, in regulated mode, email bodies and files.
• Confidential records in a restricted Jira space hold protected business fields. They are never sent to Rainbook's AI.
• Rainbook is designed to hold no health data, payment card numbers, government identifiers or other special-category data. Detectors block them at entry, capture and import, and keep only a notice of the kind of data found.

Email and calendar capture (Rainbook Mail Sync)

• When an administrator connects Microsoft 365 or Google Workspace, Rainbook Mail Sync reads mail and calendar events of the chosen mailboxes and writes messages with known customers, their attachments within the size limit, and meetings onto Jira work items. Inline images and signature images are not stored.
• Conversations start Private: only their owner (the mailbox owner) and Rainbook administrators see them. Once a conversation is linked to an account or deal, anyone who can open that record in Jira can read it, unless it is kept private.
• On Jira Free every user can see every work item, including captured email, because Jira Free has no issue security.
• Rovo can read captured comments and attachment contents for the people Jira lets see them.
• Tokens for Google and Microsoft are kept as encrypted secrets in Rainbook Mail Sync's Forge storage, never in Rainbook itself, and are deleted when a connection is removed.
• Rainbook Mail Sync calls Google and Microsoft from Forge. Rainbook itself makes no call outside Atlassian.

The Gmail add-on and the Outlook add-in

• The Gmail add-on is listed as Rainbook CRM for Gmail and the Outlook add-in as Rainbook CRM for Outlook.
• The add-ins read the email you have open (sender, recipients, subject, the message and, when you choose, its files) only when you open them, and send it to your own site's Rainbook Mail Sync to show records and to log the email when you ask.
• The Gmail add-on stores only a pairing token, in its Google Apps Script user settings; the Outlook add-in stores only a pairing token, in your mailbox's add-in settings. Neither sends email or changes anything in your mailbox, and a drafted reply is inserted only when you press Insert.
• This website serves the Outlook add-in's files and the sign-in pages. It stores no data and runs no analytics.

Cookies on this website

This website sets no cookies of its own. Cloudflare, which hosts the website and protects it from automated traffic, may set these cookies to tell people from bots:

• __cf_bm helps Cloudflare tell whether a visit comes from a person or a bot. Its contents are encrypted, it is not linked to any account or identifier on this website, and Cloudflare does not use it to follow you from site to site or from one visit to the next. It expires after 30 minutes without activity.
• cf_clearance is set only if Cloudflare asks your browser to complete a check, and records that the check was passed so you are not asked again. It lasts 30 minutes.
• Cloudflare needs these cookies to protect the website. Rainbook does not use them for analytics or advertising, and nothing else on this website sets cookies.

Google user data

Rainbook's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Rainbook uses Gmail and Google Calendar data only to show and capture your organisation's customer email and meetings in your Jira site and, on the Standard and Advanced editions, with Forge LLM (models hosted by Atlassian): to classify and summarise captured email threads, to summarise records and suggest next steps from them, and, when you press Draft reply in Rainbook CRM for Gmail, to draft a reply to the open email, which is inserted only when you press Insert. It does not use this data for advertising, does not sell it, and does not let people read it except with your organisation's permission, for security purposes, to comply with law, or when the data is aggregated and anonymised for internal operations.

Rainbook does not use data from Google Workspace APIs to develop, improve or train generalised AI or machine-learning models.

Microsoft data

Rainbook Mail Sync reads Microsoft 365 mail and calendars through Microsoft Graph with the read-only permissions your administrator grants (Mail.Read and Calendars.Read), and can be limited to chosen mailboxes. It never sends, changes or deletes mail or events. Microsoft's own handling of your data is described in the Microsoft privacy statement.

On the Standard and Advanced editions, Rainbook uses Microsoft 365 mail and calendar data with Forge LLM (models hosted by Atlassian) to classify and summarise captured email threads, to summarise records and suggest next steps from them, and, when you press Draft reply in Rainbook CRM for Outlook, to draft a reply to the open email, which is inserted only when you press Insert. Rainbook does not use this data to develop, improve or train generalised AI or machine-learning models.

AI

• Rainbook's AI features run on Forge LLMs, models hosted by Atlassian, inside the monthly budget your subscription includes. They are off on the Free edition.
• Rainbook sends a model only what the request needs, and only what the person asking can see in Jira: for a thread's classification and summary, its new messages and its previous summary; for a draft reply, the open email and the record details the sidebar shows. Email text is passed as quoted data, never as instructions.
• Rainbook does not train models on your data. Rainbook's own agents propose changes, and a person approves each one.
• The Rainbook agent in Rovo uses your organisation's Rovo plan, under Atlassian's terms.

Retention, uninstall and your rights

• Records stay in Jira until your organisation deletes them. Retention schedules on the Advanced edition delete or archive them on a timetable your administrator sets.
• When the apps are uninstalled, the Jira work items, their fields, comments, attachments, the Rainbook Archive item and the Confidential space stay in your site. Forge storage is deleted by Atlassian after its deletion window; regulated-mode content held there can be downloaded first.
• Your organisation can export or erase a person's data from Rainbook's administration pages. Rainbook does not sell personal information or share it for advertising.

Contact

Privacy questions: privacy@rainbook.humanr.ai. Security reports: security@rainbook.humanr.ai.