granola

Granola collects meeting content and communications from users and their contacts without explicit per-meeting consent. Calendar and meeting data may include sensitive information about third parties who did not consent.

Granola uses cookies, web beacons, and pixels for cross-context behavioral advertising (targeted advertising). Targeted advertising is enabled by default with no explicit opt-out at account creation, and the policy does not clearly disclose which third-party ad networks receive data.

De-identified and aggregated data is retained indefinitely for AI model training with no deletion mechanism. Even after account closure, Granola continues using information for 'legitimate business purposes and AI model improvement.'

Account administrators can override individual user privacy preferences, eliminating user control over their own data in organizational settings. Users cannot prevent mandatory service communications from continuing after opting out of marketing.

Granola shares personal data with an undefined set of 'Service Providers' and 'authorized third-party integration platforms' without itemizing which companies or what safeguards apply. De-identified data is shared indefinitely for AI model training with no removal mechanism.

Policy uses ambiguous language around data control responsibilities. Granola states it is a 'limited data controller' of account information but 'processor' of user-shared data, creating confusion about which privacy rights apply.