Glean

Scope excludes the product

The policy states it "does not apply to your use of our products and services (collectively, 'Solutions')," so it never addresses whether copilot inputs train models or who owns outputs. Those indicators are silent rather than adverse, which is why no dealbreaker applies.

Full data-subject rights

Section 10 grants access ("Right to Know"), deletion ("Right to Delete"), correction ("Right to Correct"), portability, and objection across GDPR, CCPA/CPRA, and LGPD, all exercisable via privacy@glean.com, with a 30-day response commitment.

Does not sell, named transfer safeguards

It states "Glean does not sell, and has not sold in the preceding 12 months, Personal Information" and relies on "Standard Contractual Clauses approved by the European Commission" plus EU-U.S. Data Privacy Framework certification. Both clauses appear verbatim in the snapshot.

Retention stays vague, no breach clause

Retention is described only as "as long as necessary to fulfill the legitimate business purposes," with no day-count or deletion-completion timeline. Section 6 lists generic physical, administrative, and technical safeguards but includes no breach-notification timeframe.