Data Processing Addendum: Sheetpane: Google Sheets Connector for Jira
Effective date: October 20, 2026
This Data Processing Addendum ("DPA") forms part of the agreement under which you use the App, the Bonterms Standard End User Agreement with our Provider-Specific Terms (see Terms), between Brainstatic Threads ("Processor", "we") and the customer using Sheetpane: Google Sheets Connector for Jira, including its Google Sheets add-on (together, the "App") ("Controller", "you"). It applies when we process Personal Data on your behalf through the App, as defined in the EU General Data Protection Regulation 2016/679 ("GDPR") or the UK GDPR.
1. Scope of processing
| Subject matter | Copying Jira work items into Google Sheets spreadsheets when your users ask for it |
| Duration | While the App is installed, plus the deletion periods in section 7 |
| Nature and purpose | Checking each request from the add-on against the user's Sheetpane key; running the user's JQL query in Jira as that user; returning the fields they chose for the matching work items to their spreadsheet; and keeping the key records, site setting and usage counts needed to run and control the App |
| Types of Personal Data | Atlassian account IDs and the names people give their keys (in key records); display names and time zones (read to answer requests, not stored); any Personal Data in the work item fields users choose, such as assignee and reporter names, summaries and descriptions |
| Data subjects | Your personnel and other Jira users, and any individuals mentioned in work items |
The App doesn't process special categories of Personal Data unless people write them into work items. They shouldn't.
2. Instructions
We process Personal Data only on your documented instructions. These Terms and the use of the App by your administrators and users are those instructions: your administrators' setting for the site, and each user's keys, queries, chosen fields and schedules. Delivering work item data to the spreadsheets your users choose is one of those instructions. We'll tell you if we believe an instruction breaks data protection law.
3. Confidentiality
Anyone we authorize to process Personal Data is bound by confidentiality.
4. Security
We maintain appropriate technical and organizational measures, including:
- hosting the Jira app on Atlassian Forge and the add-on on Google Apps Script, with no servers of our own
- authenticating every request from the add-on with a per-user Sheetpane key, stored by the App only as a SHA-256 hash and shown to the user once
- running every query as the key's owner, so Jira's permissions apply to every result, and allowing keys to search only
- letting each user revoke their own keys, and Jira administrators turn the App off and revoke every key; checking these settings and the license on every request
- limiting the admin page to Jira administrators, checked on the server
- storing no work item content in the Jira app
- limiting the add-on's Google permissions to the spreadsheet it's used in, and its network requests to Atlassian Forge web trigger addresses
- logging errors only, never query results or keys
5. Sub-processors
You authorize the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Atlassian (Forge platform) | Hosting, storage and logging for the Jira app | Per your Atlassian data residency settings |
| Google LLC (Google Cloud Logging) | Keeping the add-on's error messages, which can quote parts of a JQL query in Jira's error text, for 30 days | Google's data centers (Cloud Logging's default "global" location; can be set to a region such as the US) |
Google as your own provider. Apart from the error messages above, Google isn't our sub-processor. The add-on runs in each user's Google account, and Google runs it, carries its requests, and stores its settings and your spreadsheets as the provider of your Google service, under your own agreement with Google. The App delivers work item data to that service on your instruction, and from then on it's your data in your Google service, not processed by us.
We'll give at least 30 days' notice at https://brainstaticthreads.com/sheetpane/privacy/ before adding or replacing a sub-processor. You may object on reasonable data protection grounds, and if we can't resolve the objection, you may stop using the App.
6. Assistance
Taking into account the nature of the processing, we'll reasonably help you:
- respond to data subject requests (the Jira app stores no work item content; users can see and revoke their own keys; data in spreadsheets is handled through your Google service)
- carry out data protection impact assessments
- meet your security obligations
7. Deletion
- Key records: deleted when the user or a Jira administrator revokes the key, or by Atlassian under Forge's data retention practices when you uninstall the App.
- Site setting and usage counts: deleted by Atlassian under Forge's data retention practices when you uninstall the App.
- Work item data: not stored by the Jira app. It's held in memory only while a request runs.
- The add-on's settings and the data in spreadsheets: controlled by your users and administrators through your Google service. Users remove their connection with Disconnect and their queries with Delete.
- The add-on's error messages: deleted by Google Cloud Logging after 30 days.
We keep no other copies.
8. Personal data breaches
We'll notify you without undue delay, and where feasible within 72 hours, after becoming aware of a Personal Data breach affecting your data. We'll include the information reasonably available to us.
9. Audits
We'll make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires. Audits of the hosting environment rely on Atlassian's and Google's published certifications and reports.
10. International transfers
Where processing involves a transfer of Personal Data out of the EEA, UK or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum are incorporated by reference.
11. Liability and precedence
Liability under this DPA is subject to the limitations of liability in the Standard End User Agreement. If this DPA conflicts with that agreement, this DPA prevails for Personal Data processing.
Contact
Brainstatic Threads support@brainstaticthreads.com