How ChatHerald processes personal data for a customer.

Parties

Notified Limited, New Zealand, is the processor. Contact [email protected]. The controller is the customer: the Atlassian site that installs ChatHerald. ChatHerald is an Atlassian Forge app.

What we process

We process personal data only to deliver the notifications the customer configures. A message can include an issue key, summary, status, priority, issue type, project, a comment excerpt of up to 280 characters, a Confluence page title, a space key, and links. No email addresses, account IDs, or IP addresses are sent. The data subjects are the customer’s users whose content appears in those fields.

Where it is kept

Rule configuration, webhook URLs (stored as Forge secrets), queues, dedupe markers, and a 7-day delivery log live in Atlassian Forge hosted storage. The log holds a timestamp, rule id, issue key, and HTTP status. Notified Limited runs no servers of its own and keeps no copies.

Sub-processors

Atlassian provides the Forge hosting platform. Google LLC provides Google Chat, and only to deliver a message to the customer’s own Chat space at chat.googleapis.com. The customer chooses and controls that destination. Notice of a sub-processor change is given by updating this page.

Our obligations

• We act only on the customer’s documented instructions, which are the app configuration.
• Personal data is kept confidential by anyone authorised to handle it.
• Security is Forge platform security, encryption at rest by Atlassian, least-privilege read-only scopes, and admin-only configuration.
• To help with a data subject request, an admin can delete a rule. Deleting a rule does not delete the webhook secret. Uninstalling removes all app data. ChatHerald does not run its own clean-up step. Atlassian deletes the app’s Forge storage for the site under Atlassian’s data retention policy, as described in the privacy policy.
• We notify the customer of a personal-data breach without undue delay.
• When the service ends, app data is deleted as described above. We do not keep a copy.
• On request, we provide information about this processing so the customer can review it.

International transfers

Stored data stays in Forge storage under the customer’s Atlassian data region. Delivery to Google Chat is the exception. It happens at the customer’s direction, under Google’s own terms. Where the GDPR or UK GDPR applies and a transfer needs a mechanism, the EU Standard Contractual Clauses are incorporated by reference. The customer is the data exporter and Notified Limited is the data importer. Module 2 applies where the customer is a controller, and module 3 applies where the customer is a processor.

Law

Governing law follows the end-user terms: the laws of New Zealand. Questions go to [email protected].