We do not allow third parties such as OpenAI or Anthropic to use your Personal Data to train AI models. We only use de-identified data to train AI models, which you can opt-out of within your Granola account settings . Enterprise Workspace Products have admin-enforced settings and are opted-out by default. We store your Personal Data in Amazon Web Services ("AWS") servers located in the U.S. All Personal Data is encrypted at rest and in transit using AWS's encrypted database system. Additionally, we implement a variety of security measures including firewalls, virtual private cloud (VPC) setups, and anti-virus/malware protection to help protect your Personal Data.
ADDEDEnterprise Services Users that are Covered Entities or Business Associates under HIPAA may execute a Business Associate Agreement with Granola to use the Services with Protected Health Information ("PHI").
Scope of This Privacy Policy Your Rights and Preferences Information We Collect Categories of Personal Data Category of Personal Data Examples of Personal Data We Collect Categories of Third Parties with Whom We Share this Personal Data Profile or Contact Data • First and last name • Email • Service Providers • Parties you Authorize, Access or Authenticate Payment Data • Payment card type • Last 4 digits of payment card • Billing address, phone number, and email • Service Providers (specifically our payment processing partner, currently Stripe, Inc.) Device/IP Data • IP address • IP-address-based location information • Device ID • Type of device/operating system/browser used to access the Services • System statistic information • Other applications that utilize the microphone function Web Analytics • Web page interactions • Referring webpage / app / source through which you accessed the Services • Performance and usage metrics Social Network Data • Social media profiles Professional or Employment-Related Data • Job title and role • Employer • Professional website Recordings and Transcriptions • Recordings and transcriptions of communications captured through our Services Other Identifying Information that you Voluntarily Choose to Provide • Identifying information in emails, letters, texts, or other communication you send us • Images or screenshots you upload to the Services • Calendar data, including but not limited to meeting invitations, body text, and sender and recipients • Meeting data, including but not limited to attendees, audio, and transcriptions • Any other identifying information you authorize Granola to access or elect to share with Granola Information That You Provide to Granola Automatic Information Collection Analytics and Functional Information Derived Information Collected or Received for AI Model Training Publicly available information via the Internet; Datasets that we obtain through commercial agreements with third party businesses; Materials flagged for safety, security, or policy review; Data that we generate internally; When opted in, data that our Users or workers provide, including inputs and outputs from our Services, that is de-identified and aggregated with other data; and Feedback that Users explicitly provide about our Services. Personal Data from Third Parties Children's Data How Granola Uses Your Personal Data For Account Registration, Access, and Servicing to create, provide access to, maintain, supplement, service, change or delete your user account; to take actions upon your account if you are an authorized User on an account owned by another User (e.g., you are an authorized User on a workspace owned by your employer or another User); for security purposes in order to verify or authenticate your authorized access to your account; and to resolve customer service questions, you may have about our Services and to follow up with you about your experience. To Communicate with You to communicate with you about our Services and your access or use of those Services; to communicate with you directly or through our authorized affiliates or Service Providers, including through targeted advertising where permitted by law and subject to your choices; and to identify and share offers for third-party products and services that we think you may find useful (absent your consent, we do not disclose your Personal Data to third parties for their independent marketing or promotional purposes). To Improve and Develop New Services to personalize your interactions and experiences with us and our Services, including to offer you potential choices, make recommendations, or to alert you to our Services that may be of interest to you, including information about how you interact with our emails, advertisements, and features (where permitted by law); to improve the quality of and to develop new products and services; and in combination with that from other individuals in order to better understand our Services and your use of them. To Provide our Services and Operate our Business operate our business, including fulfilling your requests, providing you with technical or customer support, and to help us protect our Services, including to combat fraud and protect your information; conduct research using your Personal Data, alone or in combination with that of other individuals. When we share that research outside of Granola for research, academic, marketing and/or promotional purposes, we do so in an aggregated or de-identified way such that no individual is identifiable, and we maintain safeguards designed to prevent re-identification; and maintain legal or regulatory compliance. To Facilitate Third-Party Integrations establish and maintain connections to third-party services; authenticate your using of access control features, such as license keys and authorization tokens, within the scope of permissions you grant; facilitate video conferencing platform capabilities (e.g., Zoom), including the sharing of meeting-related data, including real-time meeting audio and transcription, in accordance with the settings that you, your organization and the specific platform enable; and improve and troubleshoot integration issues, features and workflows and provide customer support. To the extent permitted by law, regulation, or contractual obligation, we will share your information across Granola's entities and use adequate technological and data minimization and protection measures to safeguard Personal Data during collection, processing, and transfer; With vendors, consultants or Service Providers who need access to such information to carry out work on our behalf, including cloud storage firms, application service providers, and website performance analytics providers; To enforce the terms of this Privacy Policy, or to protect the rights, property or safety of Granola or its Users; In connection with a merger, sale of assets, bankruptcy proceedings, financing or acquisition of a part or all of our business to another entity, or in anticipation thereof. With the company with which you are affiliated, where such requests are authenticated and verified to our satisfaction (such as by the use of company-owned domain for your account login) as being made by organizations or individuals authorized to have such information. To law enforcement, governmental entities or regulatory organizations to aid an ongoing investigation or in response to a valid legal request or judicial or regulatory process. We may use and disclose de-identified, anonymized or aggregated data that does not identify and cannot reasonably be re-identified to any individual, for lawful business purposes, including analytics, benchmarking, and industry insights. We will not attempt to re-identify such data. Data Transfers Managing Your Data and Privacy Managing Marketing Communications From Us Contact Us or adjust your account settings to manage your preferences regarding your Personal Data and your interactions with Granola. If you are an authorized User on an account, the account admin may make selections which apply to and override some of your preferences. If you have received electronic communications from us and no longer wish to receive them, in emails you may click the "unsubscribe" or "opt-out" link in the promotional communication you received and for SMS messages you may reply "STOP" or follow the instructions in the message or settings to discontinue the communications. If you are receiving push notifications from us to your mobile device and no longer wish to receive these types of communications, you may turn them off at the device level. Essential Cookies. Essential Cookies are required for providing you with the Services that you have requested, such as enabling you to log into secure areas of our Services. Disabling these Cookies may make certain features or our Services unavailable. Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time, recognize you when you return to our Services and personalize our content for you (e.g., greet you by name, remember your language or region, adjust user settings). Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how users access and use our Services, such as by collecting information regarding the number of website visitors, what pages are viewed, and how long visitors are viewing pages. Performance/Analytical Cookies can also help us measure the performance of our advertising/marketing campaigns in order to help us improve our campaigns and the Services' content for those who engage with our advertising. Purpose Reasoning Processes To make our Services function appropriately. Authentication, Security, and Compliance To recognize you and authenticate your access; to prevent fraud, protect your data from unauthorized parties, and comply with legal requirements. Preferences Intended to remember information about how you prefer to interact with our Services; to customize your website, application or other Services experiences. Notifications Intended to allow us to notify you of options relating to your use of our Services. Advertising/Marketing Intended to make our marketing messages and other communications more relevant to you and certain third parties. Analytics Intended to help us understand how users interact with our websites, applications, systems or how our Services are performing. Do Not Track Data Retention and Your Access Rights Data Retention We will retain your information as long as necessary to serve you, to maintain your account for as long as your account is active, or as otherwise needed to operate our business. When you close your account, we may continue to communicate with you about your account, transactions, security, and other non-promotional matters, and we will only send promotional communications as permitted by applicable law and consistent with your marketing preferences. If you decide not to receive promotional communications from Granola, your opt-out will not apply to information provided by us as a result of a purchase, warranty registration, service experience or other transactions. We may also continue to use some of your information for our legitimate business purposes and to improve our Services (including AI-enabled features) or to develop new ones, subject to applicable law and your choices. De-identified and aggregated data, including when used in AI models, may be retained indefinitely, as it cannot reasonably be attributed to you individually. Data that has been de-identified, aggregated, and incorporated into AI or analytics models or databases may remain in those models and datasets indefinitely, as removal may not be technically feasible without complete model retraining or dataset reconstruction. For example, Granola may use models in which individual data points are incorporated into aggregate model weights and parameters during the training process. De-identification and aggregation safeguards are applied prior to model training. Once training is complete, it is not technically possible to isolate or extract any specific data from the resulting model. We will retain and use your information as required by applicable regulations and Granola's records and information management practices, comply with our legal and reporting obligations, resolve disputes, enforce our agreements, complete any outstanding transactions, and for the detection and prevention of fraud. Any recordings of communications using our Services are captured only for the purposes of providing you a transcription. We do not retain or store such recordings once the transcription is created. Access control features, such as license keys and authorization tokens, for third-party integrations or connections are retained only while the connection is active and are deleted promptly upon revocation of access. Responses from Granola Accessing, correcting, updating, or requesting deletion of your Personal Data. Objecting to or asking us to restrict the processing of your Personal Data. Requesting the portability of your information and providing the same in a timely manner and at no charge. Electing whether or not to receive marketing communications from us. Withdrawing your consent at any time for us to collect, use, process, store, or share your Personal Data (noting that such withdrawal will not affect the lawfulness of any processing that we conducted prior to your withdrawal, nor will it affect otherwise lawful processing or storage), opting out of certain processing such as targeted advertising where applicable, and appealing certain decisions we make regarding your requests where required by applicable law. Limited Data Controller Information Security
ADDEDSpecial Considerations for Particular Types of Personal Data Protected Health Information and HIPAA do not use PHI to train, retrain, develop, or improve AI systems or models without the User's express consent; do not send PHI to publicly available or consumer-facing AI tools; require Service Providers and AI Subprocessors that handle PHI on our behalf to enter into written agreements that satisfy applicable HIPAA requirements, such as flowdown terms applicable to subcontractors under HIPAA; and retain raw audio recordings and interim or draft transcripts containing PHI only as long as reasonably necessary to produce the final note, after which they are deleted or rendered irrecoverable. Health Data in the EU and UK Unsupported Data Submissions
Artificial Intelligence and Automated Processing How We Use Artificial Intelligence AI-Generated Content AI Model Training Automated Decision-Making and Your Rights EU and EEA residents. Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you. Where any such processing occurs, you have the right to request human review, express your point of view, and contest the decision. Our AI system is operated in compliance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), including applicable transparency and disclosure obligations under Article 50. UK residents. Under UK GDPR Article 22, the same rights apply as for EU/EEA residents above. We comply with ICO guidance on AI and data protection, including obligations relating to automated decision-making and transparency. California residents. Under the California Privacy Rights Act (CPRA) and applicable regulations on automated decision-making technology (ADMT), you may have the right to opt out of certain automated processing and to request disclosure about how automated decisions are made. Residents of other jurisdictions. AI-specific laws granting rights in connection with automated processing are being enacted in many jurisdictions. Controlling Country and Regional Data Privacy Considerations United States Data Subject Rights Managing your Data Contact information that includes identifiers such as your first and last name, business entity name, e-mail address, and telephone number. Financial information (account or credit card numbers). Demographic information (address or age). Other unique identifiers such as your tax ID number (where applicable), IP addresses, and geolocation data (where enabled). Internet or other similar network activity, including but not limited to, browsing history, search history, activity history, informational materials from our websites, location data, logs, language, date and time of access, frequency, http response code, and other communication data or information regarding your interaction with us. Commercial information, including our Services with which you interact, historical or trend information, and inferences or profiling information created therefrom. Request access to your personal information as it is processed and stored by us. Correct or delete your personal information that we hold unless Granola is legally required to retain it. Restrict or object to our processing of your personal information. Opt-out of the sale or sharing of your personal information, including for cross-context behavioral advertising (targeted advertising), where applicable. The categories of personal information we collected about you. The categories of sources and third parties for the personal information we collected about you. our business or commercial purpose for collecting or selling that personal information. The categories of third parties with whom we share that personal information. The specific pieces of personal information we collected about you (also called a data portability request). US-based (California) Privacy Concerns EU, UK and Swiss Data Subject Rights Basis for Processing Recording and Transcripts Recordings and Transcripts Providing, customizing and improving the Services Marketing the Services Corresponding with you Meeting legal requirements and enforcing legal terms Completing corporate transactions Data Requests Access : you can request more information about the Personal Data we hold about you and request a copy of such Personal Data. You can also access certain of your Personal Data by logging on to your account. Rectification : If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data. Erasure : You are entitled to the erasure of your Personal Data. Some of these requests can be processed by you, including: Deleting your Granola Account: To delete your account, please refer to our Help Center for the latest information as to how to delete your account. Deleting a Meeting: you can delete any meeting summary from your dashboard by going to your meeting list on the Granola app and clicking on the 3 dots on the right of a meeting. Deleting Other Account-Related Information: you can delete certain other account-related information by opening your Granola app, clicking Granola on the top left of the screen -> Settings -> Profile. For questions or assistance with a request to delete your Personal Data, please email us at privacy@granola.so . Deleting your Granola Account: To delete your account, please refer to our Help Center for the latest information as to how to delete your account. Deleting a Meeting: you can delete any meeting summary from your dashboard by going to your meeting list on the Granola app and clicking on the 3 dots on the right of a meeting. Deleting Other Account-Related Information: you can delete certain other account-related information by opening your Granola app, clicking Granola on the top left of the screen -> Settings -> Profile. Withdrawal of Consent : If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services. Portability : you can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible. Objection : you can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes. Restriction of Processing : you can ask us to restrict further processing of your Personal Data. Right to File Complaint : you have the right to lodge a complaint about Granola's practices with respect to your Personal Data with the applicable supervisory authority. If you are located in the UK, you may lodge a complaint with the UK Information Commissioner's Office (ICO). If you are located in the European Economic Area, you may lodge a complaint with the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred. Transfers of Personal Data Changes to This Privacy Policy Contact Us