Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Smartsheet's Privacy Notice, covering how the company collects and uses personal data from visitors to www.smartsheet.com and users of its work management platform. The notice authorizes collection of identifiers, device information, usage activity, location-inferred data, and payment information, and permits sharing with advertising, analytics, and third-party service providers. For enterprise customers, the notice acknowledges Smartsheet may act as a data processor handling content uploaded by business users, with the terms of that processing governed separately by customer agreements.
The Smartsheet Privacy Notice governs how Smartsheet Inc. collects, uses, shares, and retains personal data across its website (www.smartsheet.com) and associated services, with stated legal bases including consent, contractual necessity, legitimate interests, and legal obligations depending on jurisdiction. The notice states that Smartsheet collects identifiers, contact details, account credentials, device and usage data, location-inferred data, payment information, and content data submitted through the platform, and authorizes sharing with service providers, advertising and analytics partners, corporate affiliates, and business transaction parties. The notice discloses a layered structure composed of a main page and additional product-specific or region-specific sub-notices, which means the full scope of data practices may require review across multiple linked documents rather than a single instrument. The notice engages GDPR and UK GDPR for EU and UK residents, CCPA and CPRA for California residents, and references additional regional frameworks, with Smartsheet acting as a data controller for site and marketing data and as a data processor for customer-uploaded content processed on behalf of enterprise clients. Compliance teams should note that the processor-controller distinction has material implications for data subject rights fulfilment, contractual obligations with enterprise customers, and the scope of Smartsheet's direct regulatory obligations under applicable data protection law.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial3 important changes detected
4 versions captured · Last updated: June 2026
Smartsheet updated its privacy policy to replace the term 'Offerings' with 'Services' throughout the document, and added a single sentence directing readers to a Glossary for definitions of capitalized terms. …
View change record →Monitoring
Smartsheet has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Controller-Processor Distinction for Enterprise Data and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.