10 Total
2 High severity
6 Medium severity
2 Low severity
Summary

This document establishes ClickUp's data collection, use, and sharing practices for users of its task management platform. ClickUp collects personal data including account information, email, payment details, usage patterns, device information, and workspace content, and shares specified categories of this data with third-party advertising and analytics partners. The policy provides that user data transfers to successor entities in acquisition or merger scenarios, and establishes data subject rights for residents of California and the EU, including access, correction, deletion, and opt-out mechanisms exercisable via privacy@clickup.com.

Technical / Legal Breakdown

This document is ClickUp's Privacy Policy governing the collection, use, storage, and disclosure of personal data for users of ClickUp's project management platform, with stated legal bases including consent, legitimate interests, and contractual necessity under applicable frameworks including GDPR and CCPA. The policy states that ClickUp collects categories of personal data including account information, usage data, device and browser data, payment information, and content users upload to the platform, and the terms authorize sharing this data with third-party service providers, advertising partners, and in the context of business transfers such as mergers or acquisitions. Notably, the policy distinguishes between 'Customer Data' (content uploaded by users and their teams) and data ClickUp collects about users for its own operational and marketing purposes, a separation that has operational significance for business customers who control workspace data but may have limited visibility into how ClickUp uses behavioral and telemetry data. The policy engages GDPR for EU and UK users, CCPA and CPRA for California residents, and references data subject rights including access, deletion, portability, and opt-out of sale or sharing; jurisdiction-dependent rights mean the practical scope of protections varies significantly depending on where a user is located. Business customers deploying ClickUp in enterprise contexts should assess the data processing agreement terms separately, as this policy does not fully govern the controller-processor relationship for Customer Data.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Start Compliance free trial

1 important change detected

2 versions captured · Last updated: June 2026

June 2, 2026

medium
What changed ClickUp replaced its previous privacy rights section with a structured enumeration of data subject rights aligned with GDPR and similar data protection frameworks. The prior policy listed general opt-out mechanisms and data access procedures; the updated policy explicitly states eight distinct rights including access, rectification, erasure, restriction, portability, objection, consent withdrawal, and complaint filing. This change makes individual rights more formally defined and legally referenced rather than operationally described.
Why this matters The updated policy now explicitly recognizes eight distinct data subject rights, including rights to access, correct, delete, restrict processing, receive data in portable format, object to processing, withdraw consent, and lodge complaints with regulators. Previously, ClickUp described privacy controls through general opt-out options and data access procedures without formal legal framing. The revised language aligns with GDPR and similar data protection frameworks, providing clearer legal reference points for how users may exercise control over their personal data. You can exercise these rights by contacting ClickUp's support team.
View full change record →

Recent Provision Changes Jun 2, 2026

10 provisions unchanged.

View full change record →
High — 2 provisions
Medium — 6 provisions
Low — 2 provisions

Monitoring

ClickUp has updated this document before.

Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Start Monitor free trial Or create a free account →

Compliance Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Start Compliance free trial

Cross-platform context

See how other platforms handle AI and Product Improvement Use of Workspace Content and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CCPA/CPRA
California, USA
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
CAN-SPAM
United States Federal
View official text ↗
DMA
European Union
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
VPPA
United States Federal
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured June 2, 2026 21:14 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000710
Version ID CA-V-003360
SHA-256 d0a3316c1395c5cd27442a27c2b913ec53535cfe305f3467569da1615d276702
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.

Create free account Compare plans