Is Granola safe with your data?
Granola
Good disclosure · high confidence
Granola earns a B (67/100) because it discloses most of its data practices.
#17
of 211 apps ranked
67
score · Enterprise copilot avg 51
+16
vs category average
Granola's policy is detailed on data categories, legal bases and AI disclosure, but it trains on de-identified user data by default with only an account-settings opt-out, gives no retention number, no breach-notice timeline and no named security certification.
What Granola's privacy policy and terms of service say about your data
Training default
De-identified inputs feed model training unless the user opts out in account settings; Enterprise Workspace is opted out by default, so the consumer default is the weaker one.
Retention is unnumbered
The general rule is "as long as necessary to serve you" with no day count; the only zero-retention promise covers raw audio recordings after transcription, and de-identified data in models "may be retained indefinitely".
Sale clause carries a caveat
"Granola does not sell or share ... Personal Data for direct or cross-context behavioral advertising, unless disclosed" , the trailing qualifier stops this being an unconditional no-sale commitment.
Security gaps
Encryption is described as "AWS's encrypted database system" and "industry-standard" with no cipher or protocol named, there is no breach-notification clause anywhere in the text, and no ISO/SOC 2 certification or DPO is named beyond a generic privacy@granola.so address.
What the policy is silent or vague on
- Not stated: a deletion timeline after closure or request
- Not stated: shorter retention for AI conversation logs
- Not stated: breach notification
- Only partial: keeping user inputs out of model training
Granola privacy rating
Details
- Category
- Enterprise copilot
- Modalities
- audio, text
- Processes biometrics
- No
- Policy last updated
- 2026-07-24
- Region scored
- Global / US-default
- Last assessed
- 2026-08-13
Documents examined
Other enterprise copilot apps
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.