Asana
- Your data trains their AI unless you switch it off in settings.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Work content, usage, and ads tracking; AI metadata can train models unless an admin opts out.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, your work content, device and usage data, cookies, and sometimes video or audio.
Read the exact line
Privacy policy
“Asana processes information we receive directly from you, automatically collected when you use Asana or visit one of our websites, and collected by Asana from third parties.”
Training
They run the product, bill AI use, market Asana, and train ML models on metadata when AI is on.
Read the exact line
Privacy policy
“When features powered by Asana AI are enabled in your domain, we use metadata related to your domain’s use of Asana to train machine learning models.”
Sharing
Service providers, channel partners, ad partners, your org admin, and people in your workspace can see data.
Read the exact line
Privacy policy
“We may provide access or disclose your information to select third parties that use the information on our behalf to assist in providing Asana’s services, website, and features.”
Kept
They keep information as long as they say they need it, or longer if the law allows.
Read the exact line
Privacy policy
“We will retain your information for the period necessary to fulfill the purposes outlined in this Privacy Statement, to make our products and services available to you, or as instructed by you, unless a longer retention period is required or permitted by law.”
Controls
Admins can change AI settings; you can request access or deletion and manage cookies.
Read the exact line
Privacy policy
“To opt out of data contributions for LLM analysis of usage patterns to improve our products and services, you may change your settings in the Admin Console.”
Fine print
You own AI input and output; unused AI credits expire with no refunds; under 16 not allowed.
Read the exact line
Terms of service
“All unused AI Requests automatically expire at the end of Customer’s then-current Subscription Term. Expired AI Requests are forfeited, with no refunds or credits”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Ask an admin to change AI and data-contribution settings
Admin Console (Data Contributions / AI preferences)
Opt out of cookie sale/sharing and targeting ads
Cookies Preference Center / Manage settings, or enable Global Privacy Control
Request access or deletion of your information
form linked from the Privacy Statement, or privacy@asana.com
Unsubscribe from promotional email
Link at the bottom of marketing emails or privacy@asana.com
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If AI features are on for your company, they use usage metadata to train models that can also power other customers’ domains.
Read the exact line
Privacy policy
“When features powered by Asana AI are enabled in your domain, we use metadata related to your domain’s use of Asana to train machine learning models.”
For example, how your team uses projects could help train recommendations shown to other companies.
They send website data, including emails, to ad companies so you can be shown Asana ads elsewhere.
Read the exact line
Privacy policy
“We may also provide information collected when you visit an Asana website (which may include email addresses) to service providers, who may “match” this information in form to cookies”
For example, visiting asana.com could lead to Asana ads following you on other sites.
Channel partners can get your contact and how you use Asana.
Read the exact line
Privacy policy
“We may provide certain account information such as your contact and usage details to our trusted partners to assist in providing our services”
For example, a sales partner might get your email and usage to pitch extra training.
Unused paid AI usage dies at the end of the term and you do not get money back.
Read the exact line
Terms of service
“Expired AI Requests are forfeited, with no refunds or credits and cannot be carried over from one Subscription Term to the next.”
For example, leftover AI requests in December vanish in January with no credit.
If you use those features, they collect recordings and transcripts, not just live audio.
Read the exact line
Privacy policy
“Video and audio recordings, and transcripts of those recordings, if you use video messaging,reach out to customer support, or expressly enable our desktop call recording feature”
For example, a support call or recorded desktop meeting can be stored as audio and text.
People at Asana can use support chatbot chats to train staff.
Read the exact line
Privacy policy
“Store and process chat transcripts of conversations with AI chatbots for staff training and quality assurance purposes to help us improve our service and customer support”
For example, a chat with a help bot about a billing issue could be used to train support.
They do not stand behind AI answers and you bear the risk if they are wrong.
Read the exact line
Terms of service
“Asana makes regarding the accuracy, completeness, or reliability of the Output and disclaims for Customer’s use of Asana AI or any omissions or errors therein.”
For example, if an AI summary misses a deadline, they say they are not .
You keep ownership of what you type into Asana AI and what it generates.
Read the exact line
Terms of service
“As between the parties and to the extent permitted by applicable law, Customer retains all right, title, and interest in AI Input and AI Output.”
For example, a task list the AI writes is still your company’s content.
Outside AI vendors are not allowed to train their generative models on your customer data.
Read the exact line
Terms of service
“For purposes of clarity, Asana does not use or permit third-party AI partners to use Customer Data to train generative artificial intelligence models used to provide Asana AI.”
For example, a prompt you send through a partner LLM should not be used to train that vendor’s model.
Kids under 16 are not allowed, but it is a stated rule, not a described ID check.
Read the exact line
Privacy policy
“If you are under the age of 16, you may not have an Asana account or use Asana’s products or services.”
For example, a 15-year-old could still type a birthday and create an account.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- model training
- Using your content and conversations as examples to teach an AI system, which can then echo them in future answers. For example, a story you write in a chatbot may be studied by the company to make the next version of the bot.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
How we got here · grade C · score 44/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect account and work content plus usage logs, cookies, IP, device IDs, and approximate location from IP.
Does it record your voice, face or body, and what happens to that?
Video, audio, and transcripts are collected if you use messaging, support, call recording, or Meetings; research biometrics need consent.
Are your chats and uploads used to train AI models, and is that off by default?
With Asana AI on, domain metadata trains ML models; admins can opt out of some LLM usage-pattern contributions in the Admin Console. Third-party LLMs may not train on customer data.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use third-party targeting cookies and give website data, including emails, to advertising partners for ads on other sites.
Do they sell or share your data, and can you opt out?
They share with providers, channel partners, and ad partners; CCPA treats some cookie sharing as sale/sharing with an opt-out.
What rights do they take over what you type and what the AI makes?
The product terms say the customer keeps all rights in AI input and output.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep data as long as needed for stated purposes. Deletion is through a privacy request form, not a stated in-app 30-day wipe.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They log actions, infer how you work, and customize Asana, but they do not describe user-facing memory you can edit or turn off.
Do they commit to basic security, and have they leaked data?
They say they use technical and organizational measures and point to a Trust page, without naming an audit in this text.
Is there a real age gate, and are teens protected?
You may not have an account if you are under 16. They do not describe age checks.
Will they tell you when the rules change, and is the policy specific?
They list prior versions and say they will follow legal notice rules, but retention and some purposes stay general.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
For Asana AI they disclaim warranties on output accuracy and liability for errors.
Do subscriptions renew on their own, and can you get a refund?
Unused AI requests, studio credits, and resolutions expire at term end with no refunds or carryover.
The privacy policy is 5,967 words at a professional or legal expert level (Flesch reading ease 2.3); the terms are 2,931 words at a professional or legal expert level.
