Loom Privacy Policy

This document is Atlassian's global privacy policy, which governs data collection and processing across Atlassian's product suite including Loom, following Atlassian's 2023 acquisition of Loom. The policy states it covers information collected through Atlassian websites, products, and services, asserting legal bases including contractual necessity, legitimate interests, and consent for processing personal data. Notable provisions include the collection of video content and associated metadata through Loom, behavioral and usage analytics across the Atlassian platform, and data sharing with third-party service providers, resellers, and affiliated entities; the policy also reserves rights to process data for AI model improvement and product development purposes, which engages considerations beyond standard SaaS data processing disclosures. The policy engages GDPR for EU/EEA users, the UK GDPR post-Brexit, CCPA and CPRA for California residents, Australia's Privacy Act, and other regional frameworks; Atlassian designates itself as data controller for account and usage data while acting as data processor for customer-uploaded content in enterprise contexts, a dual-role structure that creates distinct compliance obligations depending on deployment type. Material compliance considerations include the adequacy of consent mechanisms for AI training on video content, the scope of cross-border data transfers under Standard Contractual Clauses, and the delineation of controller versus processor responsibilities in enterprise and reseller arrangements.