Data Processing Addendum
We contract on the Bonterms Data Protection Addendum — a free, neutral standard drafted by a committee of over a hundred lawyers and published under CC BY 4.0. This page is our cover page to it: the app-specific details that the standard leaves to the parties to fill in.
We took the same decision here as with our end user terms, and for the same reason. A one-person shop drafting its own data protection language produces something that has never been reviewed by anyone, and your counsel then has to read it line by line. A published standard your legal team may already recognise is faster for you and more honest from us.
The standard text is at bonterms.com/download-center/data-protection-addendum. Everything below fills in its blanks.
Roles
You are the controller. Winnow Tools is the processor, acting on your instructions. Your instructions are expressed through the rules a Jira administrator configures on the app's settings page: which projects, which events, which people, and which Google Chat space receives the message.
Winnow Tools is a sole proprietorship established in Vietnam. We state this plainly because it is the first thing a data protection officer will ask, and because the answer that follows matters more than the country.
What we can actually see
In normal operation we have no access to your data at all. The app runs inside Atlassian's Forge platform. Its storage is scoped to your installation, and we cannot read it. We operate no servers, no database and no backups of our own, so there is no copy of your data anywhere we control.
Our only technical visibility is the Forge platform log, which records
counters and outcomes — how many rules were evaluated, how many matched,
whether a delivery succeeded — together with issue keys such as
MOBL-66. It contains no issue content, no comment text, no
names and no credentials.
This is why the question of an international transfer has a narrow answer in our case: personal data is processed inside Atlassian's infrastructure and delivered to a Google Chat space that you choose and control. It does not pass through Vietnam, and the operator does not have access to it.
Details of the processing
| Subject matter | Delivering notifications about Jira activity to a Google Chat space nominated by you. |
| Nature and purpose | Reading an event from Jira, evaluating it against your rules, and — if it matches — composing and sending one message. Nothing else. |
| Duration | For as long as the app is installed on your site. |
| Categories of data subjects | Your Jira users: the people who create, are assigned, report, comment on or watch issues. |
| Categories of personal data — stored | Atlassian account identifiers only, saved inside a rule when an administrator picks specific people to filter on. No names, no email addresses, no usernames or user keys. |
| Categories of personal data — in transit | Display names of the assignee, the comment author and anyone mentioned, read from Jira at the moment of the event and included in the message. These pass through and are not retained. |
| Other data in transit | Issue key, summary, type, status, priority, what changed with previous and new values, and comment text for comment events. Not retained. |
| Special categories | None are requested or required. Free-text fields — a summary, a comment — can contain whatever your users type, including special-category data if they choose to write it. We do not inspect, classify or store that text; it is relayed to the space you nominated and discarded. |
| Frequency | Continuous, event-driven: whenever an issue in scope is created, updated or commented on. |
What is stored, and for how long
- Your rules — rule names, selected project keys, selected account identifiers, status identifiers and filter settings. Kept until you delete the rule or uninstall the app.
- Google Chat webhook addresses — held in Forge encrypted secret storage, never returned to the browser and never written to logs. Deleting a rule deletes its secret.
- A delivery log — the last 40 deliveries, each recording the time, the rule name, the issue key and the outcome. It rolls over on its own.
Issue content is never stored. Summaries, descriptions and comment text pass through the app and are retained nowhere.
A weekly job removes account identifiers of deleted users from saved rules. If that would empty a rule's people filter, the rule is disabled rather than silently widened to everyone.
Location and data residency
All data at rest lives in Atlassian's Forge hosted storage. Because the app uses Forge storage exclusively, it supports Atlassian data residency, and your data follows the residency location you have set for your Atlassian site.
Sub-processors
| Atlassian | Hosts and runs the app, and stores its data. The app cannot operate outside Atlassian's platform. |
| Receives the messages you configure the app to send, at the Google Chat space you nominate. Once a message arrives it is governed by Google's terms and by your own Workspace configuration. |
There are no others. We run no analytics, no tracking, no telemetry, no error-reporting service and no marketing tools — neither in the app nor on this website, which makes no external requests at all. We will give notice through this page before adding any sub-processor.
Security measures
Set out in full in Security practices and incident response, which also states what we do not do. In summary: three read-only Jira permissions and no write access; a single declared egress host enforced by the platform; no inbound endpoints of any kind; webhook addresses in encrypted secret storage; every privileged operation behind an administrator permission check; all third-party text escaped before it leaves the app; and static analysis plus an automated test suite gating every release.
Personal data breaches
We will notify you without undue delay after becoming aware of a breach affecting your data, with what we know at the time rather than waiting for a complete picture. Our incident procedure, including the severity timelines we work to, is in the security practices document. Report anything you find to security@winnowtools.com.
Assistance, audits and deletion
Because the app stores only account identifiers and no issue content, most data subject requests are satisfied by removing a rule or uninstalling the app, and we will help you confirm that. Uninstalling removes the app's storage along with the installation.
We cannot offer on-site audits, and we would rather say so than imply otherwise. What we can do is answer specific written questions about the processing and point at the code-level facts behind each answer.
Signing it
If your procurement process needs an executed DPA, write to support@winnowtools.com and we will return the Bonterms signable version with this cover page attached. If your counsel needs changes to the standard, send them — we will read them and say yes or no, rather than disappear.