Smartsheet states it may use data from the service to train and improve AI features, but says it will obtain consent or rely on another legal basis where required by law before doing so.
This analysis describes what Smartsheet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
AI training on customer-submitted data is a growing area of regulatory scrutiny, and the scope of what data may be used and under what legal basis is not fully specified in the notice, creating ambiguity for enterprise customers evaluating data governance risk.
Interpretive note: The provision does not specify which categories of service data are in scope for AI training, what the default setting is, or how customers can restrict this use, creating interpretive uncertainty about scope and applicable legal basis.
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View change record →Removal of explicit AI training disclosure eliminates transparent notice about a significant data use practice, potentially leaving users unaware that their data may be used for AI model development.
View full change record →Data that users or their organizations submit into Smartsheet may potentially be used to improve Smartsheet's AI products, subject to consent or another legal basis, though the specific data categories and opt-out mechanisms are not fully detailed in this notice.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We may use data from the Service to develop, train, and improve our AI features and products. We will obtain your consent or rely on another legal basis as required by applicable law before using your personal data for AI training purposes.Excerpt from Smartsheet's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision may require evaluation under the EU AI Act, which imposes requirements on AI system developers depending on risk classification, as well as GDPR's requirements for lawful basis when processing personal …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
AI training on customer-submitted data is a growing area of regulatory scrutiny, and the scope of what data may be used and under what legal basis is not fully specified in the notice, creating ambiguity for enterprise customers evaluating data governance risk.
Data that users or their organizations submit into Smartsheet may potentially be used to improve Smartsheet's AI products, subject to consent or another legal basis, though the specific data categories and opt-out mechanisms are not fully detailed in this notice.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Smartsheet.