> ## Documentation Index > Fetch the complete documentation index at: https://docs.granola.ai/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Policy **Effective from 24th July 2026** To view our previous version of the Privacy Policy, [click here](/help-center/policies/privacy-policy-previous). Granola, Inc. and its affiliated companies, including Granola Labs Ltd., (“Granola”) provide an AI-powered notetaking assistant, which includes Granola’s website [www.granola.ai](http://www.granola.ai), mobile apps, desktop applications, service features, integrations or workflows (“Services”) that help customers, authorized users, partners, vendors, employees, job applicants, visitors, and others, who are connected to or interested in being affiliated with Granola (“Users”), capture, organize, summarize, and selectively share meeting information. To help deliver Granola’s Services most effectively, Granola gathers personal information about you and your preferences, such as information that identifies you, or that could reasonably be used to identify you, either directly or indirectly (“Personal Data”). When you interact with Granola, you trust us with your Personal Data and Granola wants to keep that trust by being transparent about our privacy practices - including how and why we collect, use, process, store and share such Personal Data. Granola also wants you to understand the choices you have regarding your Personal Data. Before we get into the details, below are a few key points we’d like you to know: * We do not allow third parties such as OpenAI or Anthropic to use your Personal Data to train AI models. * We only use de-identified data to train AI models, which you can opt-out of [within your Granola account settings](/help-center/customising-granola/profile-and-preferences). Enterprise Workspace Products have admin-enforced settings and are opted-out by default. * We store your Personal Data in Amazon Web Services (“AWS”) servers located in the U.S. All Personal Data is encrypted at rest and in transit using AWS's encrypted database system. Additionally, we implement a variety of security measures including firewalls, virtual private cloud (VPC) setups, and anti-virus/malware protection to help protect your Personal Data. To help make this “Privacy Policy” easier to understand, we provide you below with a summary for each section. Granola also encourages you to review our [Platform Terms](/help-center/policies/terms-of-service/platform-terms-of-service) and they also control your interactions with us and to [Contact Us](#contact-us "#contact-us") if you have any questions or concerns. If this Privacy Policy uses a capitalized term without defining it, that term has the meaning provided in the Platform Terms, and is incorporated by reference solely for the purposes of this Privacy Policy. ## Scope of This Privacy Policy *By accessing or using the Services or submitting Personal Data to Granola, you agree to the terms of this Privacy Policy and consent to Granola’s processing of your Personal Data in accordance with such terms.* Please read this Privacy Policy and the Platform Terms carefully. These terms apply to you when you access or use any part of our Services, regardless of your location, and they explain how we collect, use, process, store, transfer, and protect your Personal Data. ## Your Rights and Preferences *Granola allows you to exercise your privacy rights and manage how we use your information, including choices regarding certain uses of information you provide to us.* Privacy and data protection laws vary across different geographic regions and give individuals certain rights in relation to their Personal Data. Granola is based in and operates its Services from the United States and the United Kingdom, and we use Amazon Web Services (“AWS”) servers located primarily in the US to collect, use, process, store, transfer, and protect (with encryption) your Personal Data. Where permitted by applicable law, we may transfer, process or store your Personal Data in any geographic region where we have facilities, business operations, affiliates, or in which we engage service providers and business providers (collectively “Service Providers”). If you are accessing or using our Services from outside of the U.S., you agree to the collection, transfer, use and storage of your Personal Data in accordance with applicable data protection laws. Granola allows you to exercise your privacy rights and manage how we use your Personal Data. If this Privacy Policy does not answer your data privacy concerns, we encourage you to [Contact Us](#contact-us "#contact-us") to learn more about your privacy rights and how we collect, use, process, store, transfer, and protect your Personal Data. ## Information We Collect *Granola collects information that relates to you and your interactions with Granola and our Services.* ### Categories of Personal Data Granola collects certain Personal Data about you and your access and use of our Services. The chart below lists the categories of Personal Data we may collect, including information we may have collected within the past 12 months. | Category of Personal Data | Examples of Personal Data We Collect | Categories of Third Parties with Whom We Share this Personal Data | | ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | **Profile or Contact Data** | • First and last name
• Email | • Service Providers
• Parties you Authorize, Access or Authenticate | | **Payment Data** | • Payment card type
• Last 4 digits of payment card
• Billing address, phone number, and email | • Service Providers (specifically our payment processing partner, currently Stripe, Inc.) | | **Device/IP Data** | • IP address
• IP-address-based location information
• Device ID
• Type of device/operating system/browser used to access the Services
• System statistic information
• Other applications that utilize the microphone function | • Service Providers
• Parties you Authorize, Access or Authenticate | | **Web Analytics** | • Web page interactions
• Referring webpage / app / source through which you accessed the Services
• Performance and usage metrics | • Service Providers
• Parties you Authorize, Access or Authenticate | | **Social Network Data** | • Social media profiles | • Service Providers
• Parties you Authorize, Access or Authenticate | | **Professional or Employment-Related Data** | • Job title and role
• Employer
• Professional website | • Service Providers
• Parties you Authorize, Access or Authenticate | | **Recordings and Transcriptions** | • Recordings and transcriptions of communications captured through our Services | • Service Providers
• Parties you Authorize, Access or Authenticate | | **Other Identifying Information that you Voluntarily Choose to Provide** | • Identifying information in emails, letters, texts, or other communication you send us
• Images or screenshots you upload to the Services
• Calendar data, including but not limited to meeting invitations, body text, and sender and recipients
• Meeting data, including but not limited to attendees, audio, and transcriptions
• Any other identifying information you authorize Granola to access or elect to share with Granola | • Service Providers
• Parties you Authorize, Access or Authenticate | ### Information That You Provide to Granola Granola may collect Personal Data that you provide us when you access, register for and use our Services, including your name, gender, age, phone, email or other contact information, business information and financial information. We also may collect any correspondence, feedback, or notes that you provide to us privately or in public forums. Providing us with some Personal Data may be required in order for you to interact with us or to use our Services. You also may be invited to provide additional Personal Data to personalize your interactions with us and your use of our Services. For instance, you may provide preferences and Services attributes to help us generate and provide a more customized experience to you when you access or use our Services. If you work at Granola or are applying to work with us as an employee or contractor, Personal Data will be required in order for you to apply for, be considered for, and maintain employment or other work-related relationships with Granola. ### Automatic Information Collection When you access or use our Services, Granola may automatically collect some information. For instance, We use cookies and other tracking technologies to automatically collect technical information, such as URL, cookie data, IP address, device type, unique device IDs, device attributes, network connection type (e.g., Wi-Fi, cellular, Bluetooth) and provider, network and device performance, browser type, language, operating system, and other functional information. ### Analytics and Functional Information Granola may use analytics tools to better understand how our Services are used and how we may improve or enhance them. We may automatically collect some usage information when you interact with us. For instance, we use cookies and other tracking technologies to automatically collect technical information, such as URL, cookie data, IP address, device type, unique device IDs, device attributes, network connection type (e.g., Wi-Fi, cellular, Bluetooth) and provider, network and device performance, browser type, language, operating system, and other functional information. This information also may include log entries, diagnostics, bandwidth usage, Wi-Fi usage, performance information, and other analytics associated with devices tied to you, and may be collected to facilitate the provision of our Services. We also may gather non-personally identifiable data about download and usage patterns. We use this information solely to maintain and improve the user experience with our Services. ### Derived Information Granola may use information we have about you to draw inferences about you and we may then use those inferences to gain a more complete understanding of your preferences. This derived information may also include variations of the technical and usage information referred to above associated with devices related to you. ### Collected or Received for AI Model Training We may use the following sources of aggregated, de-identified data, when you are opted in for us to do so, for our AI model training purposes: * Publicly available information via the Internet; * Datasets that we obtain through commercial agreements with third party businesses; * Materials flagged for safety, security, or policy review; * Data that we generate internally; * When opted in, data that our Users or workers provide, including inputs and outputs from our Services, that is de-identified and aggregated with other data; and * Feedback that Users explicitly provide about our Services. We do not allow third parties, such as OpenAI or Anthropic, to use your Personal Data for AI model training. We use de-identified, aggregated data, not Personal Data, for our AI model training. De-identified and aggregated data that has been lawfully incorporated into AI or analytics models or other databases will not be removed from those models and datasets, as removal may not be technically feasible without complete model retraining or database reconstruction. ### Personal Data from Third Parties If you interact with Granola through a third party, including by connecting a third-party account or other integration, we may receive Personal Data from that third party when you have provided that Personal Data to them and consented for them to share it with us, they are the controller of your information and have shared it with us, or the connection is otherwise authorized. We also may use third-party services to supplement, validate or increase the accuracy of Personal Data that is given to Granola. When you connect your account to a third party and Granola, we may collect authorization tokens, access credentials, third-party account information, and data necessary to create, publish, update, and manage your Granola account. When a third party has shared your Personal Data with Granola or you have authorized Granola to connect with a third party using your Personal Data, the third party is the controller of your Personal Data that they have shared with us. Similarly, where you have authorized the connection for us to obtain the Personal Data from them. Specifically, the Personal Data that you share with such third parties or allow us to receive from them, is not controlled by Granola or covered by our privacy practices. We encourage you to review third-party policies and privacy settings so that you understand how the Personal Data you share with them may be used or shared with others. ### Children’s Data Granola does not knowingly collect or solicit Personal Data from children under 16 years of age. If you are a child under the age of 16, please do not attempt to register for or otherwise use the Services or send us any Personal Data. If we learn we have collected Personal Data from a child under 16 years of age, we will delete that information as quickly as possible. If you believe that a child under 16 years of age may have provided Personal Data to us, please contact us at [privacy@granola.so](mailto:privacy@granola.so "mailto:privacy@granola.so"). ## How Granola Uses Your Personal Data *We use your Personal Data to develop and provide our Services and to personalize, improve and promote our interactions with you.* Unless we specifically disclose otherwise, and as permitted by applicable law, Granola may use any of your Personal Data for any of the purposes described in these terms, including the AI-enabled features and integration workflows described below: ### For Account Registration, Access, and Servicing We may use your Personal Data: * to create, provide access to, maintain, supplement, service, change or delete your user account; * to take actions upon your account if you are an authorized User on an account owned by another User (e.g., you are an authorized User on a workspace owned by your employer or another User); * for security purposes in order to verify or authenticate your authorized access to your account; and * to resolve customer service questions, you may have about our Services and to follow up with you about your experience. ### To Communicate with You We may use your Personal Data: * to communicate with you about our Services and your access or use of those Services; * to communicate with you directly or through our authorized affiliates or Service Providers, including through targeted advertising where permitted by law and subject to your choices; and * to identify and share offers for third-party products and services that we think you may find useful (absent your consent, we do not disclose your Personal Data to third parties for their independent marketing or promotional purposes). ### To Improve and Develop New Services We may use your Personal Data: * to personalize your interactions and experiences with us and our Services, including to offer you potential choices, make recommendations, or to alert you to our Services that may be of interest to you, including information about how you interact with our emails, advertisements, and features (where permitted by law); * to improve the quality of and to develop new products and services; and * in combination with that from other individuals in order to better understand our Services and your use of them. ### To Provide our Services and Operate our Business We may use your Personal Data to: * operate our business, including fulfilling your requests, providing you with technical or customer support, and to help us protect our Services, including to combat fraud and protect your information; * conduct research using your Personal Data, alone or in combination with that of other individuals. When we share that research outside of Granola for research, academic, marketing and/or promotional purposes, we do so in an aggregated or de-identified way such that no individual is identifiable, and we maintain safeguards designed to prevent re-identification; and * maintain legal or regulatory compliance. ### To Facilitate Third-Party Integrations We may use your Personal Data to: * establish and maintain connections to third-party services; * authenticate your using of access control features, such as license keys and authorization tokens, within the scope of permissions you grant; * facilitate video conferencing platform capabilities (e.g., Zoom), including the sharing of meeting-related data, including real-time meeting audio and transcription, in accordance with the settings that you, your organization and the specific platform enable; and * improve and troubleshoot integration issues, features and workflows and provide customer support. ### No Sale/Share of your Personal Data Granola does not sell or share (as those terms are defined under applicable privacy laws, such as the California Consumer Privacy Act of 2018 (“CCPA”), and as of January 1, 2023 the California Privacy Rights Act of 2020 (“CPRA”)) Personal Data for direct or cross-context behavioral advertising, unless disclosed. We also do not permit our authorized Service Providers to sell or share Personal Data we disclose to them for their own independent marketing purposes. ## How Granola Shares Your Personal Data *We will only share your Personal Data as we have described in this Privacy Policy.* We will not sell your Personal Data to third parties without your consent. We may disclose or share your Personal Data with authorized Service Providers as described elsewhere in this Privacy Policy, including: * To the extent permitted by law, regulation, or contractual obligation, we will share your information across Granola’s entities and use adequate technological and data minimization and protection measures to safeguard Personal Data during collection, processing, and transfer; * With vendors, consultants or Service Providers who need access to such information to carry out work on our behalf, including cloud storage firms, application service providers, and website performance analytics providers; * To enforce the terms of this Privacy Policy, or to protect the rights, property or safety of Granola or its Users; * In connection with a merger, sale of assets, bankruptcy proceedings, financing or acquisition of a part or all of our business to another entity, or in anticipation thereof. * With the company with which you are affiliated, where such requests are authenticated and verified to our satisfaction (such as by the use of company-owned domain for your account login) as being made by organizations or individuals authorized to have such information. * To law enforcement, governmental entities or regulatory organizations to aid an ongoing investigation or in response to a valid legal request or judicial or regulatory process. * We may use and disclose de-identified, anonymized or aggregated data that does not identify and cannot reasonably be re-identified to any individual, for lawful business purposes, including analytics, benchmarking, and industry insights. We will not attempt to re-identify such data. Other than as set out above, we may also share your Personal Data and your other information for additional purposes with your consent or at your direction. ## Data Transfers *Granola uses appropriate data transfer mechanisms and protection measures.* Granola has adopted a broad view on privacy with the intent of providing our Users with strong privacy rights regardless of where they reside geographically. We have attempted to recognize and implement high standards for privacy rights compliance and our use of terminology in this Privacy Policy should be interpreted to reflect that intent. Some countries may have data protection laws that are different from the laws of your country. However, Granola has taken appropriate safeguards to require that your Personal Data remains protected when it is being collected, used, processed, stored, and transferred. Where permitted by applicable law, we may collect, use, process, store, or transfer your Personal Data in any country or region where we have facilities, business operations, or in which we engage Service Providers. For individuals located in the European Union (“EU”), European Economic Area (“EEA”), United Kingdom (“UK”), or Switzerland, transfers of Personal Data to countries outside of your country of residence are conducted pursuant to appropriate legal mechanisms as described in this Privacy Policy (such as European Commission-approved Standard Contractual Clauses (“SCCs”) and their respective enabling laws), and not solely on the basis of your access and use of our Services. For individuals located in other jurisdictions, by accessing and using our Services, you acknowledge that your Personal Data may be used, processed, stored, and transferred in countries outside of your country of residence, subject to the safeguards described in this Privacy Policy. For transfers of Personal Data from the EU, the EEA, the UK, or Switzerland to jurisdictions that are not recognized as having laws that provide an adequate level of protection, Granola relies on the legal mechanisms such as the SCCs or, as permitted, your consent. Please see our [Data Protection Agreement (“DPA”)](/help-center/policies/data-processing-addendum) for more detailed information or [Contact Us](#contact-us "#contact-us"). ## Managing Your Data and Privacy *You may review and change your information, deactivate your account with us, manage the use of information that identifies you, decide what marketing communications you receive, and understand our use of Cookies.* *We may retain certain information and you may still receive other non-promotional messages from us.* ### Managing Marketing Communications From Us Granola will honor your choices when it comes to receiving marketing communications from us. If you have received marketing communications from us that you no longer wish to receive, you may: * [Contact Us](#contact-us "#contact-us") or adjust your account settings to manage your preferences regarding your Personal Data and your interactions with Granola. If you are an authorized User on an account, the account admin may make selections which apply to and override some of your preferences. * If you have received electronic communications from us and no longer wish to receive them, in emails you may click the "unsubscribe" or “opt-out” link in the promotional communication you received and for SMS messages you may reply "STOP" or follow the instructions in the message or settings to discontinue the communications. * If you are receiving push notifications from us to your mobile device and no longer wish to receive these types of communications, you may turn them off at the device level. Remember that even if you choose not to receive marketing communications from us, we will continue to send you mandatory service or transactional communications, or communications related to the safe use of our Services. If you do not have an account, you may [Contact Us](#contact-us "#contact-us") if you wish to adjust your Personal Data preferences and your interactions with us. ### Cookies and Similar Tracking Technologies Granola may use, and may allow certain authorized third parties, cookies, web beacons, pixels, local shared objects, device identifiers, tags, scripts, advertising identifiers, and similar technologies (“Cookies”) to collect information about you when you interact with us or use our Services. Cookies are small data files that are stored on your browser or device when you access or use our Services. By using our Services, you consent to the use of Cookies and other tracking technologies as described in this Privacy Policy. Granola uses both session cookies and persistent cookies. Session cookies expire when you close your web browser, while persistent cookies remain on your device until you delete them. These technologies help improve your experience with Granola, ensure our Services function properly, and support analytics and, where permitted, targeted advertising. We do not use persistent cookies to track users across different websites or for advertising or profile-building purposes. Cookies may also be used to measure the effectiveness of certain communications and marketing campaigns. Granola uses the following types of Cookies: * Essential Cookies. Essential Cookies are required for providing you with the Services that you have requested, such as enabling you to log into secure areas of our Services. Disabling these Cookies may make certain features or our Services unavailable. * Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time, recognize you when you return to our Services and personalize our content for you (e.g., greet you by name, remember your language or region, adjust user settings). * Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how users access and use our Services, such as by collecting information regarding the number of website visitors, what pages are viewed, and how long visitors are viewing pages. Performance/Analytical Cookies can also help us measure the performance of our advertising/marketing campaigns in order to help us improve our campaigns and the Services’ content for those who engage with our advertising. Granola uses Cookies for the following purposes: | Purpose | Reasoning | | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Processes | To make our Services function appropriately. | | Authentication, Security, and Compliance | To recognize you and authenticate your access; to prevent fraud, protect your data from unauthorized parties, and comply with legal requirements. | | Preferences | Intended to remember information about how you prefer to interact with our Services; to customize your website, application or other Services experiences. | | Notifications | Intended to allow us to notify you of options relating to your use of our Services. | | Advertising/Marketing | Intended to make our marketing messages and other communications more relevant to you and certain third parties. | | Analytics | Intended to help us understand how users interact with our websites, applications, systems or how our Services are performing. | You may be able to control or customize how Cookies are used through your browser or device settings. If you disable Cookies, some personalized features of our Services may not function properly, and you may not be able to fully use all available features. Methods for disabling Cookies vary by browser and device. You should review your device or browser preferences, security settings, or any settings recommended by the account owner if you are an authorized user of an account. You may also have control over certain data collected through Cookies and how that data is used. In addition, authorized third parties may use Cookies and similar technologies to enhance your experience with our Services and to deliver or target advertising and marketing. These third parties may provide Granola with reports on the use of Cookies, both on an individual and aggregated basis. You may learn more about Cookies generally, including information about how to manage and delete Cookies, please visit [allaboutcookies.org](https://allaboutcookies.org "https://allaboutcookies.org") or [ico.org.uk/for-the-public/online/cookies](https://ico.org.uk/for-the-public/online/cookies/ "https://ico.org.uk/for-the-public/online/cookies/"). ### Do Not Track Like most other companies, Granola is not currently configured to respond to browser "Do Not Track" signals because, at this time, no formal "Do Not Track" standard has been adopted. ### Social Media or Third-Party Features Granola or our authorized Service Providers may use social media or other third parties to deliver certain features to you. These features may collect your IP address, log which pages you are visiting, and may set a Cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policies and practices of the providing company and not by Granola. ## Data Retention and Your Access Rights *You may have the right to exercise certain data protection rights regarding your Personal Data. Granola will not discriminate against you for exercising your privacy rights.* ### Data Retention Granola retains and uses your Personal Data and information in accordance with and as permitted by applicable law and regulations, based on criteria such as the nature and sensitivity of the information, the purposes for which we process it, the length of time we have an ongoing relationship with you, and our legal and contractual obligations. * We will retain your information as long as necessary to serve you, to maintain your account for as long as your account is active, or as otherwise needed to operate our business. * When you close your account, we may continue to communicate with you about your account, transactions, security, and other non-promotional matters, and we will only send promotional communications as permitted by applicable law and consistent with your marketing preferences. * If you decide not to receive promotional communications from Granola, your opt-out will not apply to information provided by us as a result of a purchase, warranty registration, service experience or other transactions. * We may also continue to use some of your information for our legitimate business purposes and to improve our Services (including AI-enabled features) or to develop new ones, subject to applicable law and your choices. * De-identified and aggregated data, including when used in AI models, may be retained indefinitely, as it cannot reasonably be attributed to you individually. Data that has been de-identified, aggregated, and incorporated into AI or analytics models or databases may remain in those models and datasets indefinitely, as removal may not be technically feasible without complete model retraining or dataset reconstruction. For example, Granola may use models in which individual data points are incorporated into aggregate model weights and parameters during the training process. De-identification and aggregation safeguards are applied prior to model training. Once training is complete, it is not technically possible to isolate or extract any specific data from the resulting model. * We will retain and use your information as required by applicable regulations and Granola’s records and information management practices, comply with our legal and reporting obligations, resolve disputes, enforce our agreements, complete any outstanding transactions, and for the detection and prevention of fraud. * Any recordings of communications using our Services are captured only for the purposes of providing you a transcription. We do not retain or store such recordings once the transcription is created. * Access control features, such as license keys and authorization tokens, for third-party integrations or connections are retained only while the connection is active and are deleted promptly upon revocation of access. ### Responses from Granola We respond to all requests from individuals regarding the exercise of their data protection rights in accordance with applicable data protection laws. While your data protection rights may vary depending on your location, they generally include: * Accessing, correcting, updating, or requesting deletion of your Personal Data. * Objecting to or asking us to restrict the processing of your Personal Data. * Requesting the portability of your information and providing the same in a timely manner and at no charge. * Electing whether or not to receive marketing communications from us. * Withdrawing your consent at any time for us to collect, use, process, store, or share your Personal Data (noting that such withdrawal will not affect the lawfulness of any processing that we conducted prior to your withdrawal, nor will it affect otherwise lawful processing or storage), opting out of certain processing such as targeted advertising where applicable, and appealing certain decisions we make regarding your requests where required by applicable law. We will respond to properly submitted and verified requests for access, disclosure, deletion, correction, portability or objection regarding your information, including Personal Data, within the time period required by applicable law. Please [Contact Us](#contact-us "#contact-us") for more information or to exercise a request regarding your data privacy rights. If you are concerned about our compliance with applicable data privacy laws and your Personal Data, you may also contact the office of the regulatory authority for the jurisdiction in which you reside. ### Limited Data Controller Under certain applicable data privacy laws, Granola is a limited controller of Personal Data that is required for the creation and administration of your account with us. Granola is otherwise a processor of the information that you share with us. If we are the processor of your Personal Data (i.e., not the controller), please contact the controller to address your data protection rights. While Granola is considered to be a limited data controller of Personal Data associated with your account information, you should remember that other entities may also act as controllers of your information and you should contact them if you have any questions about how they use your information. ## Information Security *We provide reasonable and appropriate security measures in connection with securing your Personal Data.* Granola uses reasonable physical, administrative, and technical measures to protect your Personal Data from unauthorized use or access. We use industry-standard encryption to protect data in transit, either directly or through our authorized Service Providers, and apply security controls to safeguard authentication credentials stored in your browser. We use reasonable security measures and features in an effort to prevent unauthorized access to your information, including Personal Data, and seek out vendors and other authorized affiliates who do the same. For more information on our security measures, please see our [Trust Center](https://trust.granola.ai "https://trust.granola.ai"). The safety and security of your Personal Data also depends on you. Where we have given you (or where you have chosen) a password for access to our Services, you are responsible for keeping this password confidential. You should not share your password with anyone, including coworkers, unless required to do so by your employer or other third-party policies that apply to you and your authorized use of Granola. We urge you to be careful about giving out information in public areas, like message boards or social media. Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Data, we cannot guarantee its security during transmission to us. Any transmission of your information to us is at your own risk. Granola is not responsible for circumvention of any privacy settings or security measures. ## Artificial Intelligence and Automated Processing Granola uses artificial intelligence to power core features of our services. This section explains how AI is used in connection with your data, what choices you have, and how we comply with AI and privacy laws, such as the EU Artificial Intelligence Act, UK AI regulatory guidance, and California CPRA requirements as they apply to our AI features. As AI regulation continues to evolve globally, we will comply with new AI laws as they are enacted in other jurisdictions where we operate. For questions about AI compliance in your jurisdiction, contact us at [privacy@granola.so](mailto:privacy@granola.so "mailto:privacy@granola.so"). ### How We Use Artificial Intelligence When you use Granola’s AI features, our AI system processes audio recordings, transcripts, and related meeting content you provide to generate outputs such as summaries, action items, and notes. This includes transcription and summarisation of audio and meeting content; content structuring into formats such as action items and key decisions; and personalisation to improve the relevance of outputs for your account. We do not use AI to make automated decisions about you that produce legal or similarly significant effects without human review. ### AI-Generated Content Outputs produced by Granola’s AI features, such as summaries, transcripts, and notes, are AI-generated. You should review AI outputs for accuracy before relying on them. Where required by applicable law, Granola will provide notice that AI is being utilized in our products or services, including notices such as labels, marking, pop-ups, disclosures and the like. ### AI Model Training We do not allow third parties (like OpenAI or Anthropic) to use your data to train their AI models. Granola may use aggregated and de-identified data to evaluate and improve our AI systems. [You can opt-out within your Granola account settings](/help-center/customising-granola/profile-and-preferences). Enterprise users have model training turned off by default. ### Automated Decision-Making and Your Rights Granola’s AI features are designed as assistive tools and do not make binding automated decisions about you. To the extent any use of our AI system constitutes automated decision-making under applicable law, the following rights may apply: * EU and EEA residents. Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you. Where any such processing occurs, you have the right to request human review, express your point of view, and contest the decision. Our AI system is operated in compliance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), including applicable transparency and disclosure obligations under Article 50. * UK residents. Under UK GDPR Article 22, the same rights apply as for EU/EEA residents above. We comply with ICO guidance on AI and data protection, including obligations relating to automated decision-making and transparency. * California residents. Under the California Privacy Rights Act (CPRA) and applicable regulations on automated decision-making technology (ADMT), you may have the right to opt out of certain automated processing and to request disclosure about how automated decisions are made. * Residents of other jurisdictions. AI-specific laws granting rights in connection with automated processing are being enacted in many jurisdictions. If you are located outside the EU, UK, or California and believe you have rights under an applicable AI or data protection law in your jurisdiction, please contact us at [privacy@granola.so](mailto:privacy@granola.so "mailto:privacy@granola.so") and we will assess your request in accordance with applicable law. ## Controlling Country and Regional Data Privacy Considerations Granola is based in the United States and has operations in the United Kingdom. ### United States Data Subject Rights Granola wants individuals located in the United States to understand the following additional privacy and data protection measures which may be applicable. We have modeled under the provisions of the CCPA, although other state laws may be applicable. Any terms defined in the CCPA have the same meaning when used in this section. For purposes of this Privacy Policy and this section, the terms Personal Data and personal information are used as interchangeable. #### Managing your Data Granola has adopted internal policies and implemented measures to ensure that the applicable legal requirements are met and that your personal information is processed with respect and care using the appropriate technology. Granola may collect, process, store and disclose your personal information for the business and commercial purposes described in this Privacy Policy and as permitted by applicable law. Where required by law, we will obtain your consent. California residents may have the right to opt-out of the “sale” or “sharing” of personal information (as those terms are defined by the CPRA), including for cross-context behavioral advertising (also commonly referred to as targeted advertising). California residents may also have the right to limit our use and disclosure of “sensitive personal information” (as defined by the CPRA) where applicable. If consent is required for us to process your personal information, you may withdraw or modify such consent at any time by contacting us. When we disclose personal information for a business purpose, we endeavor to execute contracts that describe the purpose and require the recipient to both keep that personal information confidential and not use it for any other purpose except as permitted by the contract and applicable law. In the preceding twelve (12) months, Granola has disclosed the following categories of personal information for a business purpose: * Contact information that includes identifiers such as your first and last name, business entity name, e-mail address, and telephone number. * Financial information (account or credit card numbers). * Demographic information (address or age). * Other unique identifiers such as your tax ID number (where applicable), IP addresses, and geolocation data (where enabled). * Internet or other similar network activity, including but not limited to, browsing history, search history, activity history, informational materials from our websites, location data, logs, language, date and time of access, frequency, http response code, and other communication data or information regarding your interaction with us. * Commercial information, including our Services with which you interact, historical or trend information, and inferences or profiling information created therefrom. You have the right to: * Request access to your personal information as it is processed and stored by us. * Correct or delete your personal information that we hold unless Granola is legally required to retain it. * Restrict or object to our processing of your personal information. * Opt-out of the sale or sharing of your personal information, including for cross-context behavioral advertising (targeted advertising), where applicable. You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your request, we may disclose to you: * The categories of personal information we collected about you. * The categories of sources and third parties for the personal information we collected about you. * our business or commercial purpose for collecting or selling that personal information. * The categories of third parties with whom we share that personal information. * The specific pieces of personal information we collected about you (also called a data portability request). We will respond to properly submitted and verified requests for access, disclosure, deletion, correction, or objection within 45 days. Where required by applicable law, we will provide a process to appeal certain decisions regarding your requests. Under the CPRA, “sensitive personal information” includes categories such as Social Security numbers, driver's license numbers, financial account credentials, precise geolocation, contents of mail/email/text messages not directed to the business, genetic data, biometric data, and certain health or sexual orientation information. Granola does not knowingly collect or process sensitive personal information as defined by the CPRA. To the extent any sensitive personal information is inadvertently collected, we do not use or disclose it except as permitted by law and the CPRA (for example, to perform services reasonably expected by consumers or to prevent fraud and security incidents). #### US-based (California) Privacy Concerns Please [Contact Us](#contact-us "#contact-us") for more information or to exercise a request regarding your data privacy rights. If you are concerned about Granola’s compliance with California laws relating to the privacy of your Personal Data (personal information), you may also contact the California Privacy Protection Agency or the California Attorney General’s Office, or your local applicable governmental offices if you are in a jurisdiction other than California. ### EU, UK and Swiss Data Subject Rights If you are a resident of the EU, UK, EEA, or Switzerland, you may have additional rights under the EU or UK General Data Protection Regulation (“GDPR”) with respect to your Personal Data. Granola is a processor of the information that you share with us and is a limited controller of certain Personal Data that is required for the creation and administration of your account with us. Note that we process Personal Data of our Customers’ authorized Users in connection with our provision of certain Services to Customers. If we are the processor of your Personal Data (i.e., not the controller), please contact the controller to address your data protection rights. We will only process your Personal Data if we have a lawful basis for doing so, including consent, contractual necessity and our “legitimate interests” or the legitimate interest of others, as further described below. #### Basis for Processing Contractual Necessity: We process the following categories of Personal Data as a matter of “contractual necessity”, meaning that we need to process the data to perform under our Privacy Policy with you, which enables us to provide you with the Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or all portions of the Services that require such data. * Profile or Contact Data * Payment Data * Professional or Employment-Related Data * Recording and Transcripts * Other Identifying Information that you Voluntarily Choose to Provide Legitimate Interest: We process the following categories of Personal Data when we believe it furthers the legitimate interest of us or third parties: * Profile or Contact Data * Payment Data * Device/IP Data * Web Analytics * Professional or Employment-Related Data * Recordings and Transcripts * Other Identifying Information that you Voluntarily Choose to Provide We may also de-identify or anonymize Personal Data to further our legitimate interests. Examples of these legitimate interests include: * Providing, customizing and improving the Services * Marketing the Services * Corresponding with you * Meeting legal requirements and enforcing legal terms * Completing corporate transactions Consent: In some cases, we process Personal Data based on the consent you grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection. Other Processing Grounds: We may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of Granola, you or other data subjects, or if it is necessary for a task carried out in the public interest. #### Data Requests For more information about these rights, or to submit a request, please email us at [privacy@granola.so](mailto:privacy@granola.so "mailto:privacy@granola.so") with the subject line: “GDPR Request: \[nature of request]”. Requests must include sufficient information for us to verify your identity, relationship with Granola, and the nature of your request. In some circumstances, we may not be able to fully comply with your request, such as if we are unable to verify your identity, your request is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law. In such instances, we will respond and seek clarification such that we may comply with your request as fully as legally and practically possible. If we process your Personal Data on behalf of another organization (such as an enterprise customer), you may need to submit your request directly to that organization. * **Access**: you can request more information about the Personal Data we hold about you and request a copy of such Personal Data. You can also access certain of your Personal Data by logging on to your account. * **Rectification**: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data. * **Erasure**: You are entitled to the erasure of your Personal Data. Some of these requests can be processed by you, including: * Deleting your Granola Account: To delete your account, please refer to our [Help Center](/help-center/deleting-your-account) for the latest information as to how to delete your account. * Deleting a Meeting: you can delete any meeting summary from your dashboard by going to your meeting list on the Granola app and clicking on the 3 dots on the right of a meeting. * Deleting Other Account-Related Information: you can delete certain other account-related information by opening your Granola app, clicking Granola on the top left of the screen —> Settings —> Profile. For questions or assistance with a request to delete your Personal Data, please email us at [privacy@granola.so](mailto:privacy@granola.so "mailto:privacy@granola.so"). * **Withdrawal of Consent**: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services. * **Portability**: you can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible. * **Objection**: you can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes. * **Restriction of Processing**: you can ask us to restrict further processing of your Personal Data. * **Right to File Complaint**: you have the right to lodge a complaint about Granola’s practices with respect to your Personal Data with the applicable supervisory authority. If you are located in the UK, you may lodge a complaint with the UK Information Commissioner's Office (ICO). If you are located in the European Economic Area, you may lodge a complaint with the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred. #### Transfers of Personal Data Our Services are hosted and operated in the U.S. through Granola and its Service Providers. Laws in the U.S. may differ from the laws where you reside. By using our Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to Granola in the U.S. and will be hosted on U.S. servers, and you authorize Granola to transfer, store and process your information to and in the U.S., and possibly other countries. In some circumstances, your Personal Data may be transferred to the U.S. pursuant to a data processing agreement incorporating standard data protection clauses or other lawful data transfer mechanism. ## Changes to This Privacy Policy *We may make changes to our Privacy Policy or our supporting privacy procedures at any time.* We may change or update this Privacy Policy at any time. All changes are effective once they are posted to our website with the new effective date thereon or as they are provided to you in our Services or in other communications to you. If we believe the changes are material, we will endeavor to provide notice of the changes thirty (30) days before the changes take effect. ## Contact Us If you have any questions or concerns about this Privacy Policy, our privacy practices, or your choices regarding your Personal Data and information, please contact us at the following: Email to [privacy@granola.so](mailto:privacy@granola.so "mailto:privacy@granola.so") is the fastest and most-preferred way to reach us with your data management or privacy related questions and concerns. Direct Mail to: Granola, Inc. (US)\ 1151 Walker Rd Ste 417\ Dover DE 19904\ United States\ Attn: Legal Granola Labs Ltd (UK)\ 4-6 Spicer Street\ St. Albans AL3 4PQ\ England\ Attn: Legal