Glean procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Glean has certified to the Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework (DPF) Principles, the UK Extension to the EU–U.S. Data Privacy Framework, and the Swiss–U.S. Data Privacy Framework, and is committed to all relevant framework Principles. Glean is a certified participant listed on the Data Privacy Framework website at www.dataprivacyframework.gov . To the extent any conflict exists between this Privacy Statement and the applicable Data Privacy Framework Principles, the relevant Principles shall govern. To learn more about the EU-U.S. Data Privacy Framework program, the UK extension, and the Swiss-US Data Privacy Framework, please visit www.dataprivacyframework.gov . Binding Arbitration. Under certain conditions, individuals may invoke binding arbitration for DPF compliance complaints not resolved by any of the other DPF mechanisms. For more information, see Annex I of the DPF Principles at https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction . FTC Jurisdiction. Glean is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. Onward Transfer Liability. Glean uses standard contractual clauses for onward transfers to third parties unless we can demonstrate we were not a party to the events giving rise to any damages.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ To exercise these rights, contact: privacy@glean.com , or write to Glean Technologies, Inc., Attn: Privacy Department, 634 2nd Street, San Francisco, CA 94107, USA. ” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are located in Brazil, you have certain rights under the Lei Geral de Proteção de Dados (LGPD). Subject to certain limits, you have the right to obtain the following in relation to your Personal Information: Confirmation of the existence of processing; Access to the data; Correction of incomplete, inaccurate, or outdated data; Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data, in non-compliance with Brazilian law; Data portability to another service or product provider, upon express request, in accordance with Brazilian law, subject to commercial and industrial secrets; Deletion of Personal Information processed with the your consent, except where data retention is necessary in order to comply with legal, contractual and regulatory obligations; to safeguard and exercise rights, including in judicial, administrative, and arbitration proceedings; or as otherwise required by applicable law; Information about the public and private entities with whom Glean has shared data; Information about the possibility of not providing consent and the consequences of denial; Withdrawal of consent through a free and facilitated procedure, with ratification of the processing carried out before the deletion request; Review of decisions made solely based on automated processing of personal data that affect your interests, including decisions aimed at defining your personal, professional, consumption, and credit profile or aspects of your personality; and Information about the criteria and procedures used for automated decisionmaking, subject to commercial and industrial secrets. ” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For transfers from the European Economic Area (EEA), we rely on Standard Contractual Clauses approved by the European Commission to ensure equivalent protections. See also Section 11 regarding the EU–U.S. Data Privacy Framework. If you are located in the EEA, UK, or Switzerland, you have the following additional rights under the GDPR and equivalent laws: The right to object to processing or request restriction of processing; The right to data portability; The right to withdraw consent at any time (without affecting the lawfulness of prior processing); The right to lodge a complaint with your local data protection authority. To exercise these rights, contact: privacy@glean.com , or write to Glean Technologies, Inc., Attn: Privacy Department, 634 2nd Street, San Francisco, CA 94107, USA. Glean cooperates with EU data protection authorities (DPAs), the UK ICO, and the Swiss Federal Data Protection and Information Commissioner regarding unresolved complaints relating to data transferred from those jurisdictions.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ To submit a request, email privacy@glean.com . Authorized agents may submit requests on behalf of a California resident with written permission signed by the resident, or a power of attorney under Probate Code sections 4121–4130. We may verify the agent's authority and may contact the resident directly to confirm the request.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ For questions, corrections, or privacy requests of any kind: Email: privacy@glean.com Mail: Glean Technologies, Inc., Attn: Privacy Department, 634 2nd Street, San Francisco, CA, 94107, United States” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ California residents have the following rights under the CCPA/CPRA: Right to Know: You have the right to request a copy of the specific pieces of Personal Information collected, used, and disclosed about you over the past 12 months, including the sources, purposes, and categories of third parties involved. Right to Delete: You have the right to request deletion of Personal Information we have collected, subject to certain exemptions (e.g., where required to detect security incidents, complete a transaction, or comply with a legal obligation). Right to Correct: You have the right to request correction of inaccurate Personal Information. Right to Opt Out of Sharing: You have the right to request to opt out of sharing of your Personal Information for cross-context behavioral advertising purposes. Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right. California Shine-the-Light Law. California residents have the right to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Information (if any) for their direct marketing purposes in the prior calendar year, as well as the types of Personal Information disclosed to those parties. To exercise these rights, contact: privacy@glean.com , or write to Glean Technologies, Inc., Attn: Privacy Department, 634 2nd Street, San Francisco, CA 94107, USA. No Sale of Personal Information. Glean does not sell, and has not sold in the preceding 12 months, Personal Information as defined under the CCPA. Because Glean sells enterprise products to businesses rather than directly to consumers, we do not knowingly collect Personal Information from minors.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Glean is a global organization. Your Personal Information may be transferred to, and processed in, the United States or other jurisdictions where data protection laws may differ from those in your country of residence. By using our websites, where applicable law permits, you consent to such transfers. Legal Basis for Processing. For website and other Business Operations, we process your Personal Information on the basis of contract performance, legitimate interests, or your consent. Controller vs. Processor. Controller vs. Processor. When Glean acts as data controller (e.g., for website interactions or direct marketing), submit requests to privacy@glean.com . When Glean acts as data processor (e.g., for Solutions provided through your employer), the data controller is the customer organization. Identity Verification. Identity Verification. We may verify submitted information (which may include name, email, company, and country/state) before fulfilling any data subject request.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain Personal Information only as long as necessary to fulfill the legitimate business purposes for which it was collected, or as required to meet legal, accounting, reporting or other business obligations; resolve disputes; protect assets; and enforce agreements. In determining retention periods, we consider the nature and sensitivity of the information, the risk of unauthorized use or disclosure, whether purposes can be achieved through other means, and applicable legal requirements.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ b. Zero Day Data Retention : Glean has separately negotiated agreements with Azure OpenAI and OpenAI to include zero day data retention for those services. While using Glean's Azure OpenAI or OpenAI key, Customer’s data will be subject to the terms of Glean’s negotiated agreement, including a zero-day retention policy. This means that Customer data processed through Glean's integration with Azure OpenAI's and OpenAI’s generative AI service will not be stored beyond the operational transaction.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Glean is a global organization. Your Personal Information may be transferred to, and processed in, the United States or other jurisdictions where data protection laws may differ from those in your country of residence. By using our websites, where applicable law permits, you consent to such transfers. Legal Basis for Processing. For website and other Business Operations, we process your Personal Information on the basis of contract performance, legitimate interests, or your consent. Controller vs. Processor. Controller vs. Processor. When Glean acts as data controller (e.g., for website interactions or direct marketing), submit requests to privacy@glean.com . When Glean acts as data processor (e.g., for Solutions provided through your employer), the data controller is the customer organization. Identity Verification. Identity Verification. We may verify submitted information (which may include name, email, company, and country/state) before fulfilling any data subject request.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Identifiers (name, email, IP address, etc.) Corporate affiliates; service providers California Customer Records (Cal. Civ. Code § 1798.80(e)) — primarily employment-related Corporate affiliates; service providers Protected classification characteristics — employment-related only Corporate affiliates; service providers Commercial information (purchase records, etc.) Corporate affiliates Internet or network activity (browsing/search history, etc.) Vendors; service providers Professional or employment-related information Corporate affiliates; service providers ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “With Your Consent. With Your Consent. We may share Personal Information in other ways when we notify you and obtain your consent. Aggregated or Anonymized Data. Aggregated or Anonymized Data. We may share data in a form that cannot reasonably be used to identify you. To opt out of sharing for third-party marketing purposes, contact privacy@glean.com .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ a. Explicit Feature Usage : Glean will only transmit customer data to Azure OpenAI/OpenAI upon explicit usage of generative AI features within the Glean platform. This condition reinforces the principle of data minimization and ensures that data is only shared with Azure OpenAI/OpenAI when necessary for the specific purposes of providing the requested generative AI functionalities.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 10. Third Party Software and Services. As part of the Glean Services, Service Provider may make third party software and services available to Customer. Such third party software and services are governed by their respective terms and conditions, and this Agreement in no way modifies or alters such third party terms and conditions or imposes additional terms and conditions other than those set forth herein. In particular, when using Azure OpenAI or OpenAI third party through the Glean Services, the following terms and conditions apply:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell your Personal Information as “sell” is defined under applicable privacy laws. We may share it with third parties for the purposes of our Business Operations, such as in the following circumstances: Within Glean. We share Personal Information among our global subsidiaries for data processing and storage purposes. Service Providers and Vendors. Service Providers and Vendors. We share Personal Information with authorized third-party agents, contractors, and service providers who act on our behalf to support website hosting, data analysis, payment processing, order fulfillment, IT infrastructure, customer service, email delivery, marketing, and auditing. Channel Partners and Resellers. Channel Partners and Resellers. If you inquire about Solutions typically fulfilled through channel partners or resellers, we may share your information with those parties, who may also inform you about third-party products or services that may be of interest. Business Transactions. Business Transactions. In connection with a merger, acquisition, asset sale, consolidation, restructuring, or financing, we may disclose Personal Information to the relevant parties. Legal Requirements and Safety. Legal Requirements and Safety. We will disclose Personal Information to law enforcement, government authorities, or other third parties as required to comply with applicable law or legal process, meet national security requirements, or protect the rights, property, or safety of Glean, our partners, or others. ” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Service Provider provides generative AI capabilities that allows users to the following features: Glean AI Answers, Glean Summarization and Glean Chat. Glean Assistant features will respect the same infrastructure, configuration, security and permissions listed in Agreement. Customer has the ability to use Service Provider’s generative AI key provided by OpenAI or Azure OpenAI or their own generative AI key provided by OpenAI or Azure OpenAI. Customer has a soft cap of 60 chats per user per month.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.