"Smartsheet presents a medium-high privacy risk (54/100) comparable to established SaaS platforms like Spotify/Netflix. The service collects diverse data including device identifiers and customer content, shares it with multiple affiliated companies and advertising platforms, and implements cross-platform tracking via Custom Audiences. While opt-out mechanisms exist and retention is bounded in most cases, the dual controller-processor role and reliance on SCCs for international transfers create governance concerns."
smartsheet Privacy Concerns & Scorecard
Smartsheet collects a broad range of data types including basic identifiers (email, account info), system/device data, IP addresses, cookies and tracking data, marketing preferences, and customer content. The policy indicates collection from multiple sources without clearly limiting scope.
Data is shared with multiple affiliated companies (Smartsheet UK Limited, Smartsheet Australia Pty Limited, Brandfolder Inc.) for internal business purposes and marketing, plus third-party service providers, agents, and Custom Audiences platforms for advertising. Government disclosure occurs beyond standard legal requirements.
Smartsheet implements Custom Audiences for targeted advertising and uses cookies, pixels, and similar tracking technologies to monitor user behavior across contexts. While opt-out options exist, the default is tracking-enabled.
Data is retained as long as reasonably necessary, typically not exceeding seven years following last communication, but longer retention occurs for tax, accounting, legal defense, dispute resolution, and contract enforcement—creating indefinite retention scenarios for certain data categories.
While opt-out mechanisms exist for marketing and custom audiences, the policy acts as both controller and processor depending on data type, creating potential accountability gaps. International data transfers rely on Standard Contractual Clauses rather than adequacy decisions, and children's privacy section appears incomplete.
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account management, customer communication, and service provision
Service functionality, security, fraud prevention, and analytics
Personalization, targeted advertising, Custom Audiences creation, and analytics
Service delivery and fulfillment of user requests
Marketing communications and targeted outreach
Recruitment and hiring process
Cross-Platform Tracking
Smartsheet uses Custom Audiences and third-party tracking pixels to monitor your behavior across other websites and apps for targeted advertising purposes. This cross-platform tracking allows Smartsheet to build profiles of your interests and activities outside the Smartsheet platform itself.
Tracking Methods:
Cookies and Local Storage
Session and persistent cookies stored in user's browser to maintain login state, preferences, and analytics tracking within Smartsheet services
Tracking Pixels
Invisible pixels embedded in emails and web pages that report back when users view content, enabling cross-platform behavioral tracking and Custom Audiences creation
Custom Audiences
Third-party data matching service that syncs Smartsheet user identifiers with external advertising platforms (Facebook, Google, etc.) to enable retargeting across the internet
Server-Side Analytics
Server logs capturing user requests, IP addresses, and interaction patterns to track usage, diagnose issues, and generate analytics reports
AI & Data Training
smartsheet does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed smartsheet
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.