Confluence AI

The Privacy Policy states that Atlassian uses information 'to develop and improve our Services' and mentions using 'generative artificial intelligence' for support and 'machine learning and artificial intelligence model training' as a legitimate interest. However, the policy does not explicitly state whether user content from Confluence AI is used to train models, nor does it provide a clear opt-out mechanism specific to AI training. The language is vague regarding what data feeds the training pipeline.

“[Privacy] 'To develop and improve our Services, including machine learning and artificial intelligence model training' and 'We may also use generative artificial intelligence in responding to your support related requests.'”

The Privacy Policy does not explicitly address the scope of content licenses granted by users. It states that Atlassian processes content 'in the role of a processor or service provider on behalf of our customers' and that 'this privacy policy does not apply to that processing,' deferring to the Data Processing Agreement. Without explicit language limiting the license scope or confirming it terminates on account deletion, the absence of clear protections warrants a moderate concern score.

“[Privacy] 'We process this content in the role of a processor or service provider on behalf of our customers; this privacy policy does not apply to that processing' — but no explicit license scope terms provided in this document.”

The Privacy Policy discloses sharing with 'Service Providers,' 'Atlassian Partners,' and 'Third-Party Services' under various circumstances. While it mentions that service providers operate 'under close instruction' with 'appropriate security and confidentiality procedures,' the policy also states that 'Atlassian Partners' may receive information and that third-party services may be installed by users. The policy lacks a comprehensive sub-processor list and does not explicitly restrict sharing for advertising or analytics purposes of user content.

“[Privacy] 'We disclose information to third parties that help us operate, provide, improve, integrate, customize, support, and market our Services' and 'We work with a global network of partners who provide consulting, implementation, training and other services.'”

The Privacy Policy provides vague retention guidance: 'How long we keep information...depends on the type of information, the purposes for which it was collected, applicable legal or regulatory requirements, and user expectations and preferences.' For account information, it states retention 'for as long as your account is active and a reasonable period thereafter.' For shared content, it states 'some of your information and the content you have provided will remain' after account deactivation. No specific timeframes are provided, and backup retention is unclear.

“[Privacy] 'We retain your account information for as long as your account is active and a reasonable period thereafter' and 'some of your information and the content you have provided will remain in order to allow your team members or other users to make full use of the Services.'”

The Privacy Policy does not explicitly address IP ownership of outputs generated by Confluence AI. It states that Atlassian processes content 'in the role of a processor or service provider on behalf of our customers' but defers to the Data Processing Agreement for details. The absence of explicit language confirming user/company ownership of AI-generated outputs, combined with the broad use of information 'to develop and improve our Services,' creates moderate concern.

“[Privacy] 'We process this content in the role of a processor or service provider on behalf of our customers; this privacy policy does not apply to that processing' — specific IP ownership terms not addressed in this document.”

The Privacy Policy explicitly references multiple compliance certifications and frameworks. It states that Atlassian 'adheres to the Data Privacy Framework' (EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF) and has certified compliance with these frameworks. It also references the Atlassian Trust Center for security information and mentions compliance with GDPR, SOC 2, and other standards through its international transfer mechanisms and data protection commitments.

“[Privacy] 'Atlassian complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF)' and 'For more information on where and how we store your information, please see the Atlassian Trust Center.'”