Data Processing Addendum: Chatpane: Google Chat Notifications for Jira
Effective date: October 1, 2026
This Data Processing Addendum ("DPA") forms part of the agreement under which you use the App, the Bonterms Standard End User Agreement with our Provider-Specific Terms (see Terms), between Brainstatic Threads ("Processor", "we") and the customer using Chatpane: Google Chat Notifications for Jira (the "App") ("Controller", "you"). It applies when we process Personal Data on your behalf through the App, as defined in the EU General Data Protection Regulation 2016/679 ("GDPR") or the UK GDPR.
1. Scope of processing
| Subject matter | Delivering Jira updates to Google Chat spaces you choose and, if you turn on personal messages, to the people who connect their own Google Chat account |
| Duration | While the App is installed, plus the deletion periods in section 7 |
| Nature and purpose | Reading Jira work items, comments, watchers, people's display names and permissions when Jira reports a change; composing messages as your administrators and, for personal messages, each person configure; holding them briefly until delivered; sending them to your Google Chat spaces and people's direct messages with the Chatpane app; and keeping the link between each connected person's Jira and Google Chat accounts |
| Types of Personal Data | Display names of people who change, are assigned to, report or watch work items; Atlassian account IDs; for people who connect personal messages, their Google Chat user ID, Google display name and email address, direct-message chat ID and preferences; any Personal Data in work item summaries, labels and comments |
| Data subjects | Your personnel and other Jira users, and any individuals mentioned in work items or comments |
The App doesn't process special categories of Personal Data unless people write them into work items or comments. They shouldn't.
2. Instructions
We process Personal Data only on your documented instructions. These Terms and your configuration of the App (the Google Chat spaces you connect, and the Jira spaces, events, fields and comment setting you choose for each; whether personal messages are on; and each person's own choices when they connect) are those instructions. Delivery to your Google Chat spaces and to connected people's direct messages is one of those instructions. We'll tell you if we believe an instruction breaks data protection law.
3. Confidentiality
Anyone we authorize to process Personal Data is bound by confidentiality.
4. Security
We maintain appropriate technical and organizational measures, including:
- hosting the App on Atlassian Forge, with one small service of our own (the Chatpane router, on Cloudflare) that handles only Google Chat app events and account linking, and never Jira content
- sending data from Forge only to
chat.googleapis.com,oauth2.googleapis.comand the Chatpane router, which Forge enforces - accepting Google Chat events only with Google's signed token, and signing every call between the router and Jira sites
- sending personal messages only to people who connected their own Google Chat account, only about work items they can open in Jira, checked before every message
- storing webhook URLs as Forge secrets that are never shown again
- limiting connection management to Jira administrators, and to Jira space administrators for their own spaces when allowed, checked on the server
- deleting messages once delivered, and when a connection is paused, deleted or stops working
- logging errors only, never message content, and keeping no names, email addresses or message text in the router
5. Sub-processors
You authorize the following sub-processor:
| Sub-processor | Purpose | Location |
|---|---|---|
| Atlassian (Forge platform) | Hosting, storage and logging for the App | Per your Atlassian data residency settings |
| Cloudflare, Inc. | Hosting the Chatpane router and its database (Google Chat user IDs, link codes, and which Jira site's App each person is linked to), for personal messages only | United States |
Google isn't our sub-processor. Google provides Google Chat to you under your own Google Workspace agreement, and the App delivers messages to it on your instruction. Our Google Cloud project holds only the Chatpane app's configuration and the service account it sends with, and stores no Personal Data.
We'll give at least 30 days' notice at https://brainstaticthreads.com/chatpane/privacy/ before adding or replacing a sub-processor. You may object on reasonable data protection grounds, and if we can't resolve the objection, you may stop using the App.
6. Assistance
Taking into account the nature of the processing, we'll reasonably help you:
- respond to data subject requests (the App keeps message content only until delivered; each person can delete their own personal connection; messages in Google Chat are handled through your Google Workspace)
- carry out data protection impact assessments
- meet your security obligations
7. Deletion
- Messages waiting to be sent: deleted when delivered (normally within seconds), or when the connection is paused, deleted or stops working.
- Connections, webhook URLs and delivery logs: deleted when an administrator deletes the connection, or by Atlassian under Forge's data retention practices when you uninstall the App.
- Personal connections: deleted when the person disconnects in Jira, types
unlinkin Google Chat, removes the Chatpane app, or connects another Google account. Link codes expire after 10 minutes. - The router's links: deleted at the same times, and by a daily check once a Jira site no longer has the link (for example after you uninstall the App).
- Messages in Google Chat: controlled by you through Google Workspace.
Apart from the router's links and link codes, we keep no copies outside Atlassian.
8. Personal data breaches
We'll notify you without undue delay, and where feasible within 72 hours, after becoming aware of a Personal Data breach affecting your data. We'll include the information reasonably available to us.
9. Audits
We'll make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires. Audits of the hosting environment rely on Atlassian's and Cloudflare's published certifications and reports.
10. International transfers
Where processing involves a transfer of Personal Data out of the EEA, UK or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum are incorporated by reference.
11. Liability and precedence
Liability under this DPA is subject to the limitations of liability in the Standard End User Agreement. If this DPA conflicts with that agreement, this DPA prevails for Personal Data processing.
Contact
Brainstatic Threads support@brainstaticthreads.com