Are emails sent to a board's URL kept under privacy policy rules as other Atlassian account data?

[Tyvaughn Holness]

When using trello's "email-to-board" feature, emails sent from Outlook to a board's unique email address which are then converted to cards. How is this data treated on Trello's servers? Is it kept under the same account and governed by the same privacy policies?

[Gabriela - LeanZero]

On the account question, yes. The address is unique per member and per board: "Each Trello board has a unique email address for each member. Sending an email to that address will create a card as you." So the card lands under your account and is attributed to you, the same as if you had typed it.

Retention is documented, with one gap: "When you send an email to Trello, a copy is kept on our servers for 90 days. The original email is also attached to the card so you can always refer back to it." That gives you 90 days for Trello's copy of the message. What it does not say is whether the copy attached to the card is inside or outside that window, and since the attachment travels with the card to anyone you later add to the board, that is the bit I would put to Trello directly rather than infer.

On the second question the answer is no, and that one matters if you are building an answer for a compliance reviewer. Card content sits outside the Atlassian Privacy Policy, which carves itself out: "this privacy policy does not apply to the extent that we process personal information in the role of a processor or service provider on behalf of our customers, as further specified in the Data Processing Addendum entered into with those customers." And it puts product content on that side of the line: "We process this content in the role of a processor or service provider on behalf of our customers." So it covers Atlassian as controller of your account data, and the DPA is the instrument that governs what is in the card.

One practical thing before this goes to a team, since Outlook makes it easy to forward. The address is a secret: "Your unique board and card email addresses are only visible to you. If you share them, other people can create cards or comments as you." If one leaks, the board menu has Email-to-board then Reset email address, and the old one stops working.

And if AI summary is enabled on that board, the email body is read by an LLM to build the title, description and checklist. It takes two switches, Workspace AI and then the board toggle, so it is off unless someone turned it on, but a privacy review will ask.