Key Facts
Under certain conditions, what may users pursue?
Under certain conditions, users may pursue binding arbitration through the Data Privacy Framework Panel.
What will govern in any conflict between the Privacy Notice and the Data Privacy Framework Principles?
Smartsheet establishes that in any conflict between this Privacy Notice and the Data Privacy Framework Principles, the Data Privacy Framework Principles will govern.
May Smartsheet be required to disclose personal data in response to lawful requests by public authorities?
Smartsheet may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
May Smartsheet disclose personal data to meet national security or law enforcement requirements?
Smartsheet may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
What are Smartsheet's commitments under the Data Privacy Framework Principles subject to?
Smartsheet's commitments under the Data Privacy Framework Principles are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.
May residents of the EEA, UK, or Switzerland whose complaints cannot be resolved through Smartsheet's internal process contact JAMS?
Smartsheet provides that residents of the EEA, UK, or Switzerland whose complaints cannot be resolved through Smartsheet's internal process may contact JAMS, a U.S.-based third-party dispute resolution provider, free of charge.
How will Smartsheet notify users if it makes any material changes that affect the way it treats their data?
Smartsheet will notify users by email, through the Site or Services, or by other legally acceptable means if it makes any material changes that affect the way it treats their data.
Will Smartsheet notify users by email if it makes any material changes that affect the way it treats their data?
Smartsheet will notify users by email, through the Site or Services, or by other legally acceptable means if it makes any material changes that affect the way it treats their data.
Will Smartsheet discriminate against users who exercise their privacy choices and rights?
Smartsheet will not discriminate against users who exercise their privacy choices and rights by denying Services, charging different rates, or providing a different level or quality of Services.
What will Smartsheet not do to users who exercise their privacy choices and rights?
Smartsheet will not discriminate against users who exercise their privacy choices and rights by denying Services, charging different rates, or providing a different level or quality of Services.
Summary
This document sets out how Smartsheet handles your personal data — including how long it keeps it (generally no more than seven years), when it may share it with third parties or disclose it to authorities, and what rights you have over it. Smartsheet will not treat you differently if you exercise your privacy rights, and if it makes material changes to how it handles your data, it will notify you directly. You can opt out of having your personal data shared for advertising and marketing by completing a form.
Analysis
The Smartsheet Privacy Policy establishes the substantive terms under which Smartsheet collects, retains, transfers, shares, and protects personal data. It sets a general seven-year retention ceiling with defined exceptions, excludes collection of Sensitive Personal Data as enumerated under applicable U.S. state laws, and obtains consent to international transfer at the point of data provision. The document subordinates its own terms to the Data Privacy Framework Principles where conflicts arise, subjects Smartsheet's DPF commitments to FTC investigatory and enforcement authority, and preserves Smartsheet's ongoing liability for personal data transferred to third-party agents. Material changes to data treatment trigger notification obligations via email, the Site or Services, or other legally acceptable means.
What this means for you
As an individual user, your personal data is subject to a general seven-year retention limit, though it may be held longer for tax, legal, or dispute-related purposes. Smartsheet will not deny you access, charge you more, or reduce the quality of your service because you exercise your privacy rights. If your data is transferred to a third-party agent, Smartsheet remains liable for how that agent handles it. If you want to stop Smartsheet from sharing your personal data for advertising and marketing, you can do so by completing the opt-out form Smartsheet provides.
3 important changes detected
4 versions captured · Last updated: June 2026
What changed
Smartsheet updated its privacy policy on June 9, 2026 to clarify corporate structure and Data Privacy Framework participation. The policy previously stated that 'Smartsheet and its U.S. affiliates' participate in the EU-U.S., UK, and Swiss Data Privacy Frameworks. The updated language now specifies 'Smartsheet Inc.' and adds an explicit list of four U.S. affiliates that adhere to the DPF Principles: Artefact Product Group LLC (dba 10,000ft), Brandfolder Inc., On Brand Holdings Inc. (dba Outfit), and TernPro Inc. (dba Slope). This change provides clearer identification of which legal entities within the Smartsheet corporate group are responsible for complying with data transfer frameworks.
Why this matters
The updated policy clarifies the corporate structure and identifies specific U.S. entities within the Smartsheet group that are responsible for complying with international data transfer frameworks. Previously, the policy referred to 'Smartsheet and its U.S. affiliates' in general terms; the updated language now explicitly names Artefact Product Group LLC (10,000ft), Brandfolder Inc., On Brand Holdings Inc. (Outfit), and TernPro Inc. (Slope) as entities bound by the Data Privacy Framework Principles. This provides greater specificity about which entities handle personal data subject to cross-border transfer protections.
View full change record →
What changed
Smartsheet modified a single sentence in its Privacy Policy on June 5, 2026 describing which entities participate in the EU-U.S. Data Privacy Framework. The updated language specifies that 'Smartsheet and its U.S. affiliates' participate in the framework, whereas the previous version stated 'Smartsheet and its affiliates' without the geographic qualifier. This change narrows the scope of framework participation to U.S.-based affiliates only, which may affect how personal data transfers are handled for non-U.S. affiliated entities.
Why this matters
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View full change record →
May 21, 2026
low
Smartsheet updated its privacy policy to replace the term 'Offerings' with 'Services' throughout the document, and added a single sentence directing readers to a Glossary for definitions of capitalized terms. …
View change record →
Archival ProvenanceSource & Archival Record
Last Captured
June 9, 2026 01:26 UTC
Capture Method
Automated scheduled archival capture
Document ID
CA-D-000712
Version ID
CA-V-003570
SHA-256
1005b45002f15a946947ae6982fdfe847ec225b5bc09bd230cef4b2f20f3b62e
✓ Snapshot stored
✓ Text extracted
✓ Change verified
✓ Hash verified