Gong AI
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“To gain a better understanding on how individuals use and interact with our Services, which content and data they have processed through our Services, and how we could improve their and others’ user experience and the value they can generate from using the Services, so we can continue improving our products, offerings and the overall performance of our…”
Watch: audit rights dpa residency
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
The open-ended 'other locations' language means users cannot be certain their personal data stays within jurisdictions with known, adequate data protection standards. While DPF and SCCs are referenced, the catch-all language reduces predictability.
Without specific retention periods, users cannot predict when their data will be deleted. The phrase 'maintain and expand our relationship' could justify indefinite retention for marketing purposes, which may conflict with data minimization principles under GDPR.
Restricts assignment of the agreement by either party without advance written consent of the other, with an exception permitting assignment in connection with a merger, reorganization, acquisition, or transfer of substantially all assets or voting securities; also restricts assignment if the acquiring party is a direct competitor of the other party.
Scores derived from 27 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Gong AI's training terms are conditional — check the tier, opt-out, and enterprise exceptions before relying on protection.
- Output ownership has conditions — review the commercial use and license carve-outs before building on these outputs.
- Data handling is conditional — 9 privacy or retention clauses warrant review before using Gong AI at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Gong AI's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 67 verified, verbatim-cited findings below — read the citations.
Based on 98 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 55 citationsstaticLast captured 2026-07-20
- Terms of ServiceVerified - read in full - 29 citationsstaticLast captured 2026-07-20
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Defines 'Customer Data' as electronic data and information submitted by or for Customer to the Services or collected and processed by or for Customer, and establishes Gong's reservation of rights in the Services while addressing the license Customer grants to Gong over Customer Data — operative definitions and rights-allocation clause.
" 2.1 Reservation of Rights. Subject to the limited rights expressly granted hereunder, Gong and its Affiliates and licensors reserve all of their right, title and interest in and to the Services, including all of their related intellectual ..."
Restricts federal government end users to only those technical data and software rights customarily provided to the public as defined in the Agreement, and requires negotiation of a written addendum for any additional government rights — operative restriction on scope of government use rights.
" Gong provides the Services for ultimate federal government end use solely in accordance with the following: Government technical data and software rights related to the Services include only those rights customarily provided to the public ..."
Grants Customer a non-exclusive, non-transferable, worldwide right during the applicable Order Form term to access and use the Services solely for Customer's internal business purposes, making explicit the scope and limitation of the license granted.
" 1.1 Provision and Access . Gong will make the Services available to Customer pursuant to this Agreement and the applicable Order Form and then-current version of any supporting technical documentation provided to Customer by Gong or availa..."
Prohibits Customer and Permitted Users from a specific list of activities including using Services for non-business calls, reselling or transferring rights, modifying Gong branding, making Services or generated content available to unauthorized third parties, and other enumerated misuses — operative use-restriction clause limiting permissible scope of the license.
" 1.4 Use Restrictions. Customer shall not use the Services in a manner that violates any applicable laws. Further, Customer shall not, and shall not allow or assist any Permitted User or third party to: (a) use the Services for non-business..."
Prohibits direct competitors of Gong from accessing or using the Services; also describes Gong's support and availability commitments using commercially reasonable efforts standards and acknowledges inability to guarantee uninterrupted service.
"Customer may not access or use the Services if it is a direct competitor of Gong. 1.5 Support. Gong uses commercially reasonable efforts to maintain the highest service availability. However, Gong cannot guarantee that the Services will op..."
Specifies that subscription volume or length decreases at renewal trigger re-pricing without regard to prior per-unit pricing, and sets out fee payment terms including a 30-day payment deadline from Order Form effective date — operative fee and renewal pricing obligation.
"Notwithstanding anything to the contrary, any renewal in which subscription volume or subscription length for any Services has decreased from the prior term will result in re-pricing at renewal without regard to the prior term’s per-unit pr..."
Obligates Customer to provide complete and accurate billing and contact information and to notify Gong of changes; also establishes Gong's right to accelerate unpaid obligations and suspend Services when charges are 30 or more days overdue (or 10 days for credit-card-authorized amounts).
"Customer is responsible for providing complete and accurate billing and contact information to Gong and notifying Gong of any changes to such information. 3.5 Suspension of Service and Acceleration. If any charge owing by Customer is 30 da..."
Defines 'personal data,' 'Customer Data,' 'Customer,' and 'Platform,' and describes the categories of personal data Gong collects, processes, and manages on behalf of customers, establishing the scope of data processing obligations under the policy.
" This Privacy Policy describes how Gong.io Inc. and its affiliated companies (collectively, “ Gong ”, “ we ”, “ our ” or “ us ”) collects, stores, uses and discloses the following categories of personal data: Customer Data : personal data ..."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"Usage, login credentials, and device information concerning Users and Prospects connectivity, technical and aggregated usage data, such as user agent, IP addresses and approximate location based upon such IP addresses, device data (like type, OS, device id, browser version, locale and language settings), activity logs, session recordings, log-in credentials to the Services, the cookies and pixels installed or utilized on their device, and inferred or presumed data generated from their use of the Services;"
The breadth of automatically collected data — including session recordings, inferred data, and device identifiers — constitutes comprehensive behavioral profiling. Users may not fully appreciate the scope of passive data collection when using the platform.
AI-generated interpretation, not legal advice.
"Sometimes we collect personal data automatically when an individual interacts with our Platform or Sites (such as through our website chat feature) and sometimes we collect personal data directly from an individual. At times, we may collect personal data about an individual from other sources and third parties (such as our Customers and Service Providers), even before our first direct interaction."
Collection of personal data from third parties prior to any direct relationship creates transparency issues and may conflict with data minimization and notice requirements under GDPR and CCPA.
AI-generated interpretation, not legal advice.
"To gain a better understanding on how individuals use and interact with our Services, which content and data they have processed through our Services, and how we could improve their and others’ user experience and the value they can generate from using the Services, so we can continue improving our products, offerings and the overall performance of our Services, including through the utilization and optimization of Artificial Intelligence and Machine Learning capabilities ( Legitimate Interests );"
The clause permits use of processed content and interaction data for AI/ML optimization under 'legitimate interests,' meaning users cannot easily opt out. This raises concerns about whether sensitive business conversations recorded through Gong's platform feed into model improvements.
AI-generated interpretation, not legal advice.
"To create aggregated statistical data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal and non-identifiable), which we or our business partners may use to provide and improve our respective services, or for any other purpose ( Legitimate Interests );"
Once data is aggregated or anonymized, Gong treats it as falling outside privacy restrictions and shares it with business partners for unlimited purposes. This creates risk if anonymization is incomplete or re-identification is possible.
AI-generated interpretation, not legal advice.
"To facilitate and optimize our marketing campaigns, ad management and sales operations, and to manage and deliver advertisements for our products and services more effectively, including on other websites and applications. Such activities allow us to highlight the benefits of using our Services, and thereby increase your engagement and overall satisfaction with our Services. This includes contextual, behavioral and interests-based advertising based on your activity, preferences or other data available to us or to our business partners ( Legitimate Interests; Consent );"
The clause allows Gong to use activity and preference data for targeted advertising on third-party sites via business partners, relying partly on legitimate interests. This may conflict with user expectations in an enterprise context and raises cross-context data sharing concerns.
AI-generated interpretation, not legal advice.
"Updates and Amendments : We may update and amend this Privacy Policy from time to time by posting an amended version on our Services. If we do, we will update the “effective date” at the bottom. The amended version will be effective as of the date it is published. We will provide prior notice if we believe that the changes involved materially alter your rights, via any of the communication means available to us or via the Services. After such notice period, if you continue to use our Services, the amendments will be deemed accepted by you."
Unilateral amendment with constructive acceptance upon continued use is a standard but user-disadvantageous term. The platform controls both what constitutes 'material' change and the notice period, leaving users with limited ability to negotiate.
AI-generated interpretation, not legal advice.
"We retain personal data for as long as we deem it as reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy."
Without specific retention periods, users cannot predict when their data will be deleted. The phrase 'maintain and expand our relationship' could justify indefinite retention for marketing purposes, which may conflict with data minimization principles under GDPR.
AI-generated interpretation, not legal advice.
"Legal Compliance : We may disclose or allow government and law enforcement officials access to your personal data, including personal data contained in CCTV footage, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and services."
Permitting disclosure for internal business interests (not just legal obligation or imminent harm) expands the scope beyond what GDPR's legitimate interests balancing test would typically support for law enforcement-type disclosures. No notice-to-user obligation is stated.
AI-generated interpretation, not legal advice.
"For the avoidance of doubt, Gong may share personal data in additional manners, pursuant to your explicit approval, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous. We may transfer, share or otherwise use non-personal and non-identifiable data at our sole discretion and without the need for further approval."
Self-assessed anonymization with no independent verification creates risk of re-identification. The 'sole discretion' language means there is no contractual recourse if Gong's anonymization is later deemed insufficient.
AI-generated interpretation, not legal advice.
"This includes contextual, behavioral and interests-based advertising based on your activity, preferences or other data available to us or to our business partners ( Legitimate Interests; Consent ); To facilitate, sponsor and offer certain events, contests and promotions ( Legitimate Interests ). "
Permits Gong to use personal data for contextual, behavioral, and interest-based advertising based on user activity and preferences, and for sponsoring events and promotions, under legitimate interests and consent bases.
AI-generated interpretation, not legal advice.
" When we use the terms “ personal data ” or “ personal information ” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or deidentified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual. Sometimes we collect personal data automatically when an individual interacts with our Platform or Sites (such as through our website chat feature) and sometimes we collect personal data directly from an individual. At times, we may collect personal data about an individual from other sources and third parties (such as our Customers and Service Providers), even before our first direct interaction. Gong does not collect, use, or disclose sensitive personal data. We may collect or generate the following types of personal data about individuals through the Services: Usage, login credentials, and device information concerning Users and Prospects connectivity, technical and aggregated usage data, such as user agent, IP addresses and approximate location based upon such IP addresses, device data (like type, OS, device id, browser version, locale and language settings), activity logs, session recordings, log-in credentials to the Services, the cookies and pixels installed or utilized on their device, and inferred or presumed data generated from their use of the Services; Information concerning our Customers, Users and Prospects contact and business details such as name, email, phone number, position, workplace and related business insights, our communications with such individuals (correspondences, sensory information including call"
Defines 'personal data' and 'personal information' for purposes of the policy, including what is excluded (aggregated/deidentified data), and describes how personal data is collected automatically through platform and site interactions, establishing the scope of the data processing regime.
AI-generated interpretation, not legal advice.
" To gain a better understanding on how individuals use and interact with our Services, which content and data they have processed through our Services, and how we could improve their and others’ user experience and the value they can generate from using the Services, so we can continue improving our products, offerings and the overall performance of our Services, including through the utilization and optimization of Artificial Intelligence and Machine Learning capabilities ( Legitimate Interests ); To contact our Customers, Users and Prospects with general or personalized service-related messages, as well as promotional messages that may be of specific interest to them ( Performance of Contract; Legitimate Interests; Consent ); To support and enhance our data security measures and integrity of our Services, including for the purposes of preventing and mitigating the risks of fraud, error or any illegal, criminal or prohibited activity ( Performance of Contract; Legitimate Interests; Legal Obligation ); To create aggregated statistical data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal and non-identifiable), which we or our business partners may use to provide and improve our respective services, or for any other purpose ( Legitimate Interests ); To enforce our Terms and Conditions , and other applicable agreements, to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties ( Legitimate Interests ); To comply with our contractual and legal obligations and requirements, and maintain our compliance with applicable laws, regulations and standards ( Performance of Contract; Legitimate Interests; Legal Obligation ); and For"
Permits Gong to use Customer, User, and Prospect personal data to understand and improve services, including through AI and machine learning optimization, and to send personalized service-related messages, establishing explicit permission for AI/ML training and product improvement uses.
AI-generated interpretation, not legal advice.
" We retain personal data for as long as we deem it as reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements. If you have any questions about our data retention policy, please contact us by e-mail at [email protected] ."
Establishes Gong's obligation to retain personal data for the duration necessary to maintain services, meet legal and contractual obligations, and protect against disputes, and commits Gong to follow a data retention policy to determine appropriate retention periods, imposing a structured retention and deletion obligation.
AI-generated interpretation, not legal advice.
" Some cookies are strictly necessary for the Services to function properly and cannot be declined or disabled unless you delete and block them through your web browser settings. Other cookies, are optional, depending on your location and activities on the Services and used for:"
This segment restricts certain necessary cookies from being declined or disabled (except via browser settings), while distinguishing optional cookies for performance, analytics, functional, and advertising purposes, thereby limiting user control over strictly necessary data processing.
AI-generated interpretation, not legal advice.
"We use personal data as necessary for the performance of our Services (“ Performance of Contract ”); to comply with our legal and contractual obligations (“ Legal Obligation ”); and to support our legitimate interests in maintaining and improving our Services, e.g., in understanding how our Services are used and how our campaigns are performing, and gaining insights which help us dedicate our resources and efforts more efficiently; in marketing, advertising and selling our Services; providing customer service and technical support; and protecting and securing our Customers, Users, Prospects, ourselves and our Services (“ Legitimate Interests ”)."
Reliance on 'legitimate interests' as a legal basis is broad and may override user preferences absent explicit opt-out mechanisms. Marketing and advertising uses may be unexpected to users who primarily see Gong as a B2B tool.
AI-generated interpretation, not legal advice.
"We implement systems, applications and procedures designed to secure your personal data, to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. However, we cannot guarantee that our Services will be immune from any wrongdoings, malfunctions, unlawful interceptions or access, or other kinds of abuse and misuse."
The security disclaimer is a standard but meaningful limitation—the platform acknowledges it cannot guarantee protection of personal data, which could limit liability claims arising from data incidents.
AI-generated interpretation, not legal advice.
" 7.1 Limitation of Liability. EXCEPT FOR LIABILITIES ARISING FROM A PARTY’S INDEMNIFICATION OBLIGATIONS UNDER SECTION 6 (INDEMNIFICATION), EACH PARTY’S AGGREGATE LIABILITY TO THE OTHER PARTY ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE SERVICES WILL NOT EXCEED THE FEES ACTUALLY RECEIVED BY GONG FROM CUSTOMER FOR THE SERVICES UNDER THE APPLICABLE ORDER FORM IN THE TWELVE MONTHS PRIOR TO THE ACT THAT GAVE RISE TO THE LIABILITY. THE FOREGOING LIMITATION WILL APPLY, TO THE FULLEST EXTENT PERMITTED BY LAW, WHETHER AN ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF LIABILITY, BUT WILL NOT LIMIT CUSTOMER’S OR ITS AFFILIATES’ PAYMENT OBLIGATIONS UNDER THE “FEES AND PAYMENT” SECTION ABOVE. 7.2 Exclusion of Consequential and Related Damages. TO THE FULLEST EXTENT PERMITTED BY LAW, UNDER NO CIRCUMSTANCES WILL A PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES, IN EACH CASE, INCLUDING BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE. THE ABOVE LIMITATIONS WILL APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY AND ARE FUNDAMENTAL ELEMENTS OF THE BARGAIN BETWEEN THE PARTIES."
Caps each party's aggregate liability to the other at fees actually received by Gong in the twelve months prior to the act giving rise to liability, excludes indemnification obligations from this cap, applies the limitation to contract and tort claims regardless of theory, and to the fullest extent permitted by law — operative liability limitation clause.
AI-generated interpretation, not legal advice.
"We may have disclosed identifiers and customer record information to event sponsors. Through participation in the Gong Visioneer Community, you may disclose identifiers and customer record information. We disclose Personal Information in pursuit of the business and commercial purposes described in Section 2 above. Mobile Information and SMS Compliance : Notwithstanding anything to the contrary in this Privacy Policy, no mobile information or personal data collected via our text messaging programs will be shared with third parties, partners, or affiliates for marketing or promotional purposes. All the above categories of data sharing exclude text messaging originator opt-in data and consent; this specific information will not be shared, sold, or rented to any third parties."
Discloses past sharing of identifiers and customer record information with event sponsors and through the community, while imposing a restriction that mobile information and personal data collected via SMS programs will not be shared with third parties, partners, or affiliates for marketing or promotional purposes — user-favorable prohibition on that specific use.
AI-generated interpretation, not legal advice.
Common questions about Gong AI's policies
- Who owns the content you create with Gong AI?
- You own outputs — with license carve-outs — based on 1 verified finding from Gong AI's published policy. Informational only, not legal advice.
- Can you use Gong AI's output commercially?
- Commercial use allowed — based on 9 verified findings from Gong AI's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Gong AI's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
13 verified clausesClauses in Gong AI's policies that work in your favour — commitments the platform made to you.
- Privacy & data usesale/sharing of personal data
“Individuals have rights concerning their personal data. Please contact us by e-mail at: [email protected] if you wish to exercise your privacy rights under any applicable law, including but not limited to the EU or UK General Data Protection Regulation (GDPR),…”
This segment enumerates data subject rights under applicable laws including GDPR, LGPD, CCPA, and FADP—such as the right to access, know, and request personal data—and establishes the procedure for exercising those right…
📍 § 9 (Data Subject Rights)Jump to exact text → - Audit rights, DPA & residency
“We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States of America, Europe, Israel, and other locations, as reasonably necessary for the proper performance and delivery of our Services, or as may b…”
Obligates Gong to maintain, store, and process personal data in specified jurisdictions (US, Europe, Israel) and commits Gong to protect personal data in accordance with the policy and appropriate lawful transfer mechani…
📍 § 3 (Data Location)Jump to exact text → - Privacy & data usebreach notification promises
“If you believe that we might have any such data, please contact us by e-mail at [email protected] . Data Protection Officer : Gong has appointed Mr. Aner Rabinovitz of PrivacyTeam Ltd. as our Data Protection Officer (DPO), for monitoring and advising on Gong’…”
This segment discloses the appointment of a Data Protection Officer (DPO) as required under applicable data protection law, identifies the DPO's role in monitoring compliance and serving as a contact point for data subje…
- Designated security contact: [email protected] (DPO: Mr. Aner Rabinovitz of PrivacyTeam Ltd., [email protected]); EU/UK representative: Prighter Group (https://app.prighter.com/portal/19799398593); Israel Database Controller: [email protected]
📍 § 12 (Additional Notices & Contact Details)Jump to exact text → - Moderation & enforcementterms can change anytime
“Updates and Amendments : We may update and amend this Privacy Policy from time to time by posting an amended version on our Services. If we do, we will update the “effective date” at the bottom. The amended version will be effective as of the date it is publis…”
This segment establishes the procedure for updating the Privacy Policy, including posting amendments, updating the effective date, providing prior notice for material changes, and deeming continued use as acceptance, con…
- Terms changes: advance notice promised
📍 § 12 (Additional Notices & Contact Details)Jump to exact text → - Audit rights, DPA & residency
“Certain data protection laws and regulations, such as the EU GDPR, UK GDPR, the Brazilian Data Protection Act, and the CCPA, typically distinguish between two main roles for parties processing personal data: the “data controller” (or under the CCPA, “business”…”
This segment defines the roles of 'data controller' and 'data processor' under GDPR, UK GDPR, LGPD, and CCPA, and identifies Gong's role as data controller for certain processing activities, constituting legally operativ…
📍 § 10 (Data Controller/Processor)Jump to exact text → - Audit rights, DPA & residency
“Gong.io Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) regarding the processing of personal data received from the European Union in reliance on the EU-U.S. DPF, a…”
States Gong's certification to the US Department of Commerce under the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework, creating compliance obligations and establishing the lawful tran…
📍 § 3 (Data Location)Jump to exact text →
+ 7 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
0 verified clausesWhat Gong AI requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in Gong AI's published policies yet.
What the policies actually cover
8 topics- Product telemetry & usage tracking6 clauses
- Advertising & tracking6 clauses
- Sale or sharing of personal data1 protective2 clauses
- Sensitive data (biometric, location, health)1 clause
- Government & law-enforcement disclosure2 clauses
- Terms can change at any time2 protective2 clauses
- Deletion rights & post-termination survival2 clauses
- Breach-notification promises1 protective2 clauses
61 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
The Terms of Service, § 2.1 describes rights the platform takes in user content, and the Privacy Policy, § 5 (Data Disclosure) describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
Verified retention clauses point in different directions: the Privacy Policy, § 4 (Data Retention) describes broad or open-ended retention, while the Terms of Service, § 9.4 describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal data for as long as we deem it as reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning ...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal data for as long as we deem it as reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning ...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal data for as long as we deem it as reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning ...”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“Please note that under certain conditions (as described under the DPF Principles that Gong.io Inc. adheres to), you can invoke a binding arbitration by delivering a notice to us via [email protected] .”Open source citation
The clause includes sublicensable, transferable, or assignable rights.
“1.1 Provision and Access. Gong will make the Services available to Customer pursuant to this Agreement and the applicable Order Form and then-current version of any supporting technical documentation provided to Customer by Gong or available on Gong’s website (“Documentation”). The Services are provided on a subscription basis for the applicable subscription term. Gong hereby grants to Customer a non-exclusive, no...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | audit rights dpa residency | worsens | HIGH | 9 |
| All applicable tiers | commercial use | conditional | MEDIUM | 1 |
| All applicable tiers | confidentiality | conditional | MEDIUM | 1 |
| All applicable tiers | data retention | conditional | MEDIUM | 3 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 1 |
| All applicable tiers | indemnity liability | conditional | MEDIUM | 4 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 6 |
| Free | indemnity liability | conditional | MEDIUM | 1 |
| Free | output ownership | conditional | MEDIUM | 4 |
| Pro / Paid | indemnity liability | conditional | MEDIUM | 1 |
| Team / Business | commercial use | worsens | HIGH | 2 |
| Team / Business | privacy data use | conditional | MEDIUM | 3 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“Confidential Information does not include information which: (a) is or becomes publicly known through no act or omission of the receiving party; (b) was in the receiving party’s lawful possession prior to the disclosure; (c) is rightfully disclosed to the receiving party by a third party without restriction on disclosure; or (d) is independently developed by the receiving party, which independent development can be shown by written evidence.”Before citation
“Under some US data protection laws, like the CCPA, our disclosure of certain internet activity and device information with third parties through cookies on our website may be considered a “sale” or “sharing” of personal information. We do so in pursuit of the business and commercial purposes described in Section 2 above. For the purposes of the CCPA, in the last 12 months we may have “sold” or “shared” Internet or other electronic network activity information, Geolocation data, Commercial information, and Inferences with our analytics and advertising Service Providers. Gong has not knowingly sold or shared the personal information of individuals under the age of 16. If you access our Sites, from California, you can opt out of all Cookies that may result in a “sale” and/or “sharing” of your personal information in the following ways: Click the “ Your Privacy Choices ” button (on our website’s footer), move the toggle switch next to “Share or Sale of Personal Information” to grey (disabled), then click the “Confirm my Choices” button. If you visit us from a different device or browser, or clear cookies, then you need to return to this screen to re-select your preferences. Set the Global Privacy Control (GPC) for each participating browser system that you use to opt out of the use of third-party Advertising or other relevant cookies (instructions on how to download and use GPC are available here ).”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“For the purposes of the CCPA, in the last 12 months we may have “sold” or “shared” Internet or other electronic network activity information, Geolocation data, Commercial information, and Inferences with our analytics and advertising Service Providers.”Before citation
“Confidential Information does not include information which: (a) is or becomes publicly known through no act or omission of the receiving party; (b) was in the receiving party’s lawful possession prior to the disclosure; (c) is rightfully disclosed to the receiving party by a third party without restriction on disclosure; or (d) is independently developed by the receiving party, which independent development can be shown by written evidence.”After citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“In such instances, we may share relevant contact, business and usage details with the respective partner, to allow them to engage with those entities and individuals for such purposes. If you directly engage with any of our partners, please note that any aspect of that engagement which is not directly related to the Services and directed by Gong is beyond the scope of Gong’s Terms and Conditions and Privacy Policy, and may therefore be covered by the partner’s terms and privacy policy. Service Integrations : You may choose to use a third-party service to integrate with our Services, for example, to upload or retrieve personal data to or from the Services, or to enrich the data you have processed on either service or enhance your usage thereof (provided that such integration is supported by our Services). The provider of this integrated third-party service may receive certain relevant data about or from your account on the Services, or share certain relevant data from your account on the third-party provider’s service with our Services, depending on the nature and purpose of such integration. This could include your Customer Data and/or User Data. Note that we do not receive or store your passwords for any of these third-party services (but do typically require your API key to integrate with them). Event Sponsors : If you attend an event or webinar organized by us, or download or access an asset on our Sites related to such an event, webinar or other activity involving third-party sponsors or presenters, we may share your personal data with them.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“Protecting Rights and Safety : We may share personal data with others if we believe in good faith that this will help protect the rights, property or personal safety of Gong, any of our Users or Customers, or any members of the public. Gong Subsidiaries and Affiliated Companies : We may share personal data internally within our group, for the purposes described in this Privacy Policy. In addition, should Gong or any of its subsidiaries or affiliates undergo any change in control or ownership, including by means of merger, acquisition or purchase of substantially all or part of its assets, personal data may be shared with or transferred to the parties involved in such an event. We may disclose personal data to a third party during negotiation of, in connection with or as an asset in such a corporate business transaction. Personal data may also be disclosed in the event of insolvency, bankruptcy or receivership. For the avoidance of doubt, Gong may share personal data in additional manners, pursuant to your explicit approval, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous. We may transfer, share or otherwise use non-personal and non-identifiable data at our sole discretion and without the need for further approval. For the purposes of the CCPA, in the past 12 months, we may have disclosed the following categories of Personal Information, as defined in the CCPA: identifiers; customer record information; internet or other electronic network activity information; professional or employment-related information; geolocation data; commercial information; inferences; and audio, electronic and visual information to Service Providers, partnerships, service integrations, Gong subsidiaries and”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We may have disclosed identifiers and customer record information to event sponsors. Through participation in the Gong Visioneer Community, you may disclose identifiers and customer record information. We disclose Personal Information in pursuit of the business and commercial purposes described in Section 2 above. Mobile Information and SMS Compliance : Notwithstanding anything to the contrary in this Privacy Policy, no mobile information or personal data collected via our text messaging programs will be shared with third parties, partners, or affiliates for marketing or promotional purposes. All the above categories of data sharing exclude text messaging originator opt-in data and consent; this specific information will not be shared, sold, or rented to any third parties.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“You can also reach out to [email protected] . Please note that opting out of promotional communications will not affect your receipt of important service-related communications, such as account notifications, security alerts, or transactional messages. For SMS communications, your mobile phone number and your consent to receive SMS messages will not be shared, sold, or rented with third parties, affiliates, or partners for marketing or promotional purposes. Gong may share this information with service providers that support the delivery and operation of our SMS communications on our behalf.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-07-20· verified 2026-07-20
- Terms of Service:Last captured 2026-07-20· verified 2026-07-20
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 18 more findings this quarter vs last (98 vs 80). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Gong AI's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Gong AI's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.