Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Smartsheet's privacy policy, explaining how the project management platform collects and uses personal data about people who visit its website, sign up for a free trial, or use its services. The most important thing to know is that Smartsheet shares your personal data including name, email, usage behavior, and device information with advertising and analytics partners, and may use certain service data to improve AI features. California residents and EU/UK users have specific rights to access, delete, or opt out of certain data uses, which they can exercise by submitting a request through Smartsheet's privacy request form.
This document is the Smartsheet Privacy Notice, governing how Smartsheet Inc. collects, uses, and shares personal data across its website (smartsheet.com) and related services, with stated legal bases including contract performance, legitimate interests, consent, and legal obligation depending on jurisdiction. The notice states that Smartsheet collects personal data including identifiers, usage data, device information, location data, and customer-submitted content, and authorizes use of that data for product delivery, marketing, analytics, fraud prevention, and AI-related product improvement; it also discloses sharing with third-party service providers, advertising partners, analytics vendors, and business transferees. Notably, the notice distinguishes between Smartsheet's role as a data controller (for website and marketing data) and a data processor (for customer-submitted service data governed by separate customer agreements), a distinction that materially affects what rights individual users can exercise directly against Smartsheet. The notice expressly addresses GDPR obligations for EEA and UK residents, CCPA/CPRA rights for California residents, and references adequacy decisions and Standard Contractual Clauses as international transfer mechanisms; applicability of specific rights depends on jurisdiction and user classification. Compliance teams should note that AI feature data use, third-party advertising integrations, and the controller-processor distinction each create distinct regulatory evaluation points under GDPR, CCPA/CPRA, and potentially the EU AI Act.
Institutional analysis available with Professional
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.
Start Professional free trialMonitoring
Smartsheet has updated this document before.
Watcher includes same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
Professional Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Professional includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Professional free trialCross-platform context
See how other platforms handle Controller vs. Processor Bifurcation and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.