The policy states that ClickUp shares user data with third parties for analytics, error tracking, and marketing, and that outside contractors including hosting providers, credit card processors, and mailing list services may access personally identifiable information in the course of providing services to ClickUp.
This analysis describes what ClickUp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies the categories of third parties that receive user data and the stated purposes for sharing, which are relevant to CCPA sharing definitions and GDPR data processor and controller determinations. The policy requires contractors to protect personal data consistent with the Privacy Policy or Data Protection Addendum and to use it only for contracted purposes.
Interpretive note: Whether data shared with advertising and market research partners constitutes sharing under CPRA's cross-context behavioral advertising definition depends on specific data flows not fully enumerated in the policy.
The updated policy now explicitly recognizes eight distinct data subject rights, including rights to access, correct, delete, restrict processing, receive data in portable format, object to processing, withdraw consent, and lodge complaints with regulators. Previously, ClickUp described privacy controls through general opt-out options and data access procedures without formal legal framing. The revised language aligns with GDPR and similar data protection frameworks, providing clearer legal reference points for how users may exercise control over their personal data. You can exercise these rights by contacting ClickUp's support team.
View change record →Under this provision, personally identifiable information including identifiers and usage data may be accessed by outside contractors providing hosting, payment processing, and mailing services, and shared with analytics and marketing partners. The agreement requires these parties to limit use to contracted purposes and to comply with the policy's privacy standards.
Cross-platform context
See how other platforms handle Third-Party Data Sharing with Analytics, Marketing, and Contractor Partners and similar clauses.
Compare across platforms →"The only data we share with third parties is for analytics, error tracking, and marketing. We may employ independent contractors, vendors and suppliers (collectively, 'Outside Contractors') to provide specific services and products related to the ClickUp Service, such as hosting, credit card processing and fraud screening, and mailing list hosting for the ClickUp Service. In the course of providing products or services to us, these Outside Contractors may have access to information collected through the ClickUp Service, including your personally identifiable information.Excerpt from ClickUp's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 28 (processor obligations), CCPA and CPRA definitions of sharing and service provider relationships, and FTC Act standards for data handling representations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision identifies the categories of third parties that receive user data and the stated purposes for sharing, which are relevant to CCPA sharing definitions and GDPR data processor and controller determinations. The policy requires contractors to protect personal data consistent with the Privacy Policy or Data Protection Addendum and to use it only for contracted purposes.
Under this provision, personally identifiable information including identifiers and usage data may be accessed by outside contractors providing hosting, payment processing, and mailing services, and shared with analytics and marketing partners. The agreement requires these parties to limit use to contracted purposes and to comply with the policy's privacy standards.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ClickUp.