Data Handling

Gambit keeps your CRM in your own Jira site. Your records are Jira work items, and Gambit's indexes, history and settings live in Forge storage that Atlassian hosts for your site. Gambit and Gambit Mail Sync run no server of their own, so your CRM data, your email and your files stay in your Atlassian cloud.

Where your data lives

What	Where	Who sees it
Deals, leads, accounts, contacts, conversations, meetings and their fields, comments and files	Jira work items in your site	Whoever Jira lets open the work item
Captured email: bodies, senders, recipients, files and inline images	Comments and attachments on Conversation work items	Whoever can open the account or deal the thread belongs to; a thread not yet linked to a record, everyone in the CRM; a thread marked Private only its owner and the people Jira's Private security level allows (by default, the owner and members of rainbook-admins)
Gambit's indexes, reporting tables, activity history, AI working state and settings	Forge storage for your site, in your site's data residency region	Shown only through the records each person can open
Mailbox connections, mailbox addresses, never-log lists, capture progress and a short-lived message buffer	Gambit Mail Sync's Forge storage; tokens as encrypted Forge secrets	Admins see connections and mailboxes; tokens are never shown or sent to Gambit

Anyone who can open a record sees all of its fields.

Every field and property that holds personal data is listed in the data inventory on the trust centre, with where it lives and whether it stays after you uninstall.

What app logs hold

App logs hold Atlassian account IDs, your site's cloud ID and host name, and record keys such as RBCRM-42. They are kept for 30 days in Atlassian's Forge logs.

App logs never hold names, email addresses, subjects, message bodies, file names, field values, prompts or AI output. Human Renaissance engineers can read your site's app logs while it shares them with app developers, which Atlassian turns on at install; your admins can turn log sharing off in Atlassian Administration.

Details that stay in your site

Some details help an admin fix a problem, so Gambit keeps them in your site, where your admins see them, instead of in any log:

Failed-capture summaries: the record, subject, sender, time, file name and error of a message that could not be captured, until someone retries or discards it, and at most 30 days.
AI sources: the prompt, sources and output of each AI result, for 30 days, so people can see why Gambit suggested something.
Activity history: who changed what and when, searchable for 13 months.

When you need help, an admin opens Settings › Overview in Gambit, finds Support, chooses Show diagnostics and then Copy diagnostics. The bundle holds versions, settings switches, queue and limit state, recent failed captures and job errors, and one record's AI sources if you ask for them. You can read every line before you send it.

Share diagnostics with Gambit support downloads the same bundle and opens our support portal with a request started, ready to attach it. The bundle leaves only through your browser. Message bodies are included only when you tick Include the record I'm asking about. Each copy and each share is recorded in your activity history.

For mail problems, an admin opens the Gambit Mail Sync admin page (Jira Settings › Apps › Gambit Mail Sync, or Gambit Mail Sync Beta), finds Support, chooses Show diagnostics and then Copy diagnostics or Save as a file. That bundle holds the mail provider connections, your mailbox addresses with their capture times and states, and error codes. It never holds an email's subject, text or files, or the address of anyone you write to. Mail Sync's copy and save happen in your browser and aren't added to Gambit's activity history.

For hands-on help, an admin can invite support@gambit.humanr.ai as a Jira user for a limited time, and remove that user when we are done.

Usage analytics and error reports

Gambit and Gambit Mail Sync send usage analytics to PostHog and error reports to Sentry: which screens and features are used, how long they take, and errors with their stack traces. Analytics events are keyed by a pseudonymous site ID and a one-way hash of the Atlassian account ID. Error reports carry the error type, an error message stripped of names, addresses and content, its stack frames, a scrambled site ID, the import run ID and scrambled row references, never record content, and nothing that identifies a person.

Events never carry names, email addresses, readable record keys or content, file names, prompts or AI output. Analytics are on when the apps are installed; your admins can switch them off in Atlassian's admin controls for apps, and every feature keeps working.

The website

This website counts page views on the product page and the docs with Cloudflare Web Analytics, which sets no cookies. The website's forms send what you type to Human Renaissance's support desk or update list. The trust, policy, status and sign-in pages carry no forms and no analytics.

Questions

Write to privacy@gambit.humanr.ai. To see how long each kind of data is kept, read Data Retention; for the companies that process data for Gambit, read Subprocessors.