Is Granola Private? Privacy Policy, GDPR, AI Training and the 2026 Lawsuit (Reviewed October 2026)

Granola is one of the most widely used bot-free AI notepads. In 2026 it also became one of the most closely examined. This guide comes from the BuildBetter team, which makes BB Recorder. It reviews Granola's privacy policy, GDPR position, AI training defaults, data storage, security certifications and the Chamberlain v. Granola class action. The sources are Granola's own documentation and the court complaint. Every claim was checked on 18 October 2026. Because we make a competing recorder, we quote Granola directly, link every source and credit Granola where it does well. Nothing here is legal advice.

Is Granola Private? The Short Verdict (Reviewed 18 October 2026)

Granola is reasonably secure, but it has real privacy trade-offs. How private it is depends on your plan, your settings and whether you tell meeting participants.

What it does well: SOC 2 Type II on all plans, notes encrypted at rest and in transit, notes private by default, no admin access to private notes, and Granola states that audio is deleted after transcription.

What to watch: model training on de-identified data is on by default for Free/Basic and Business; data is stored in the US only; there is no bot, so participants may not know they are being transcribed; there was a 2025 key-exposure incident; and a proposed wiretap class action, Chamberlain v. Granola, filed in July 2026, is pending.

Jump to the summary table, or read the full BB Recorder vs Granola comparison.

What Does Granola's Privacy Policy Say?

Granola's current privacy policy took effect on 8 September 2026. It covers two entities: Granola, Inc., a Delaware corporation, and Granola Labs Ltd, a UK company. The policy sits in Granola's help center, and granola.ai/privacy redirects there. The document opens with the line "Effective from 8th September 2026" (Granola privacy policy).

These are the commitments that matter most to a privacy reviewer:

• No third-party training: third parties such as OpenAI and Anthropic may not train on your personal data.
• First-party training on de-identified data: Granola trains its own models only on de-identified data, and users can opt out.
• US storage: data is stored on AWS in the United States.
• No retained recordings: recordings are not kept once the transcript exists.

There is one exception to the audio rule. Under the policy's HIPAA provisions, raw audio that contains protected health information (PHI) is kept only as long as needed to create the note.

Check the timing as well. The 8 September 2026 policy took effect about 40 days after the 30 July 2026 lawsuit was filed. If you used Granola before that date, the earlier policy may have governed your data. The Wayback Machine is a practical way to retrieve earlier versions for your records.

If this matters to you: BB Recorder works 100% offline and needs no account. Calls recorded in local mode stay on your computer unless you choose to upload them to a BuildBetter workspace.

Is Granola Private and Secure?

Granola has strong baseline security, with SOC 2 Type II, encryption at rest and in transit, and notes that are private by default and invisible to admins. It has no two-factor authentication of its own, hosts data in the US only, and has a disclosed incident history.

Granola's security page states: "Notes are stored in our US-hosted AWS Virtual Private Cloud. They are encrypted at rest and in transit." (granola.ai/security).

Privacy professionals keep two questions apart. Security asks whether data is protected from outsiders. Privacy asks whose data is collected, with whose knowledge, and for what purpose. Granola does well on security. Most of the open questions are about privacy.

Authentication

You sign in to Granola through Google, Microsoft or SSO. Granola has no native 2FA, so your account is only as secure as the 2FA on your identity provider. If a team member's Google account lacks 2FA, their Granola notes are exposed to the same risk.

The 2025 incident

In 2025 an exposed AssemblyAI API key left transcripts from 333 iOS beta testers open to access. Granola says no one exploited the exposure. Its security site lists further post-mortems.

Granola deserves credit for publishing post-mortems. Many vendors never disclose incidents of this size. For a vendor review, a written incident history is more useful than silence.

If this matters to you: BB Recorder transcribes on your own device and needs no account. Local recordings do not depend on a cloud API key unless you upload them.

Is Granola GDPR Compliant?

Granola says it complies with GDPR and UK GDPR. It offers a standard Data Processing Agreement (DPA) with EU and UK Standard Contractual Clauses (SCCs). It does not offer EU data residency or custom DPAs.

Granola's FAQ answers the question directly: "Yes. We comply with GDPR and UK GDPR." (Security, privacy and data FAQs).

Controller vs processor: what it means in practice

Under Granola's terms, your organisation is the data controller and Granola is the processor. That puts most of the GDPR work on you:

• Lawful basis: you must establish one. This is usually legitimate interests backed by a documented legitimate interests assessment (LIA), or consent.
• Transparency: you must give Article 13/14 information to everyone recorded, including external participants who have never heard of Granola.
• DPIA: many EU data protection officers will expect a Data Protection Impact Assessment (Article 35) before you systematically record employees or customers.

International transfers

EU and UK data is transferred to the US under SCCs. That is a recognised transfer mechanism. However, it does not meet internal policies that require in-region hosting. If your security standard says "EU data stays in the EU", Granola cannot meet it today.

If this matters to you: BB Recorder can run fully offline, so local recordings stay on your machine. If you later upload recordings, the BuildBetter platform is GDPR compliant. No tool makes you compliant by itself, though. Lawful basis and notice are still your job.

Does Granola Train AI on Your Data?

Yes, by default on the Free/Basic and Business plans. Granola trains its own models on anonymised or de-identified data unless each user opts out. Enterprise customers are opted out by default.

The security FAQ states: "By default on Free and Business plans, anonymised data may be used for Granola's own model improvements." The model training page adds: "Enterprise customers are opted out by default, and admins can enforce the setting across the entire organization." (Granola model training).

How to opt out

Go to Settings > Preferences > Data & sharing and turn off 'Use my data to improve models for everyone'.

Caveats

• Per-user on Business: "On the Business plan, each user needs to opt out individually." Admins cannot flip one switch for the whole team.
• No Android toggle yet: the setting is not yet in the Android app. Use desktop or iOS.
• Not retroactive: data already used for training stays in the models.

The pricing page shows the same split, listing "Model training opt-out Per user Per user Workspace-wide" across its plans (granola.ai/pricing). Granola also states that OpenAI and Anthropic never train on your data.

Two points for security reviewers. First, "de-identified" does not mean anonymous under GDPR. Data that can be re-identified is still personal data (Recital 26). Meeting content is hard to anonymise because names, companies and context are embedded in speech, so ask Granola for its de-identification method. Second, because the opt-out is not retroactive, the time to decide is at onboarding, before the first meeting.

If this matters to you: BB Recorder lets you chat with calls using BuildBetter's models, your own API keys or a local model. With a local model, processing stays on your device.

Where Does Granola Store Your Data?

All Granola customer data is stored on AWS servers in the United States, encrypted at rest and in transit. Notes are also cached on your device.

The FAQ states: "All data is stored on Amazon Web Services (AWS) servers located in the United States." (Security FAQ).

Granola has no data residency option for the EU, the UK, Canada or Australia. The company operates from the US and the UK, but customer data is hosted only in the US.

These groups should look closely at that limit:

• Public-sector teams with sovereign hosting rules.
• Regulated EU and UK teams in financial services, healthcare or legal, where in-region hosting is often written into policy.
• Any organisation with in-country requirements in contracts or customer commitments, for example a promise to customers that their call data never leaves Canada.

The local cache matters too. Notes on a laptop are subject to that device's security, so disk encryption, screen lock and endpoint management still apply.

If this matters to you: BB Recorder stores recordings locally on your computer and works offline, so you decide where the files live.

What Security Certifications Does Granola Have?

Granola holds SOC 2 Type II on all plans. HIPAA with a Business Associate Agreement (BAA) is available only on Enterprise, and only for the desktop apps. Granola does not hold ISO 27001, FERPA or NHS DSP Toolkit certification.

The FAQ says: "We currently hold SOC 2 Type II. ISO 27001 is not yet available." You can request the SOC 2 report through Granola's Vanta trust center.

The desktop-only HIPAA scope affects healthcare teams. A clinician who records an in-person consultation on an iPhone is outside the BAA's coverage.

If this matters to you: the BuildBetter platform is SOC 2 Type II, HIPAA and GDPR compliant for teams that upload recordings from BB Recorder. These certifications cover the platform. They do not make your local recording practice legally compliant.

Does Granola Support Enterprise SSO and Admin Controls?

Yes, but only on the Enterprise plan. SSO and SCIM require 50 or more active members or a 50-seat commitment.

Granola's setup guide states: "SSO and SCIM are available on the Enterprise plan only." (SSO setup guide).

Enterprise admins get these controls:

• SSO enforcement
• Workspace-wide sharing limits
• Model-training opt-out, enforced across the organisation
• Transcript retention policies
• Controls over MCP, API and integrations
• Audit API
• Usage analytics

Granola keeps one privacy protection even at this tier: admins cannot see users' private notes. Many workplace tools give admins full content access, so this is a real design choice in employees' favour.

The gap is in the middle tier. Teams on the Business plan, usually under 50 people, get no SSO, no SCIM provisioning and no central training opt-out. Their privacy posture depends on every user changing a setting. In a 20-person team, one person who skips the toggle means their meetings, including what customers said on those calls, can feed Granola's model training.

Does Granola Record Audio or Video?

Granola says it does not save audio or video. It captures your microphone and system audio, streams it to transcription providers, deletes it, and keeps only the transcript and your notes.

The transcription docs state: "It does not record or save audio or video at any point during the call, so there's no way to access audio from your meetings." (Granola transcription). Deepgram and AssemblyAI are the named transcription providers.

• Desktop transcribes in real time.
• Mobile caches audio briefly before processing.
• You start each note manually.
• HIPAA exception: raw audio with PHI may be kept only as long as needed to create the note.
• Granola Watermark: places an overlay on your video feed but does not record it.

Keeping no audio is a genuine privacy benefit. If nothing is stored, there is less to breach, subpoena or misuse. The cost is that you cannot check the source later. If a transcript misattributes a quote or mishears a number in a pricing discussion, you have no recording to verify it against.

If this matters to you: BB Recorder takes the opposite approach. It keeps full video and audio locally on your computer, so you have a record you can verify that stays on your own machine.

Does Granola Use a Bot? Will Other Participants Know?

No bot joins a Granola meeting. Audio is captured on your device, so other participants will not see an extra attendee unless you turn on a transparency feature or tell them.

The FAQ is explicit: "No bot joins your meeting — other participants will not see any additional attendee."

Granola offers optional transparency features:

• Automated chat message announcing that Granola is in use.
• Granola Watermark overlay on your video.
• Org-wide "Granola is being used" notification, listed on the pricing page as a pilot.

On Free and Business, each person decides whether to use these features. On Enterprise, admins can require them.

This point is central to the 2026 lawsuit. With bot-free capture, most of the people whose speech is processed are not Granola customers. They have no account, no opt-out toggle and have seen no privacy notice. Unless the user tells them, nothing on screen shows that a transcript is being made. That gap applies to any on-device recorder, which is why consent practice matters more than the choice of tool.

If this matters to you: BB Recorder can send a visible BuildBetter bot or record locally with no bot. You can switch between the two mid-call, and the local recording keeps going.

The Granola Lawsuit: Chamberlain v. Granola, Inc. (2026) Explained

Chamberlain v. Granola, Inc., No. 3:26-cv-07926-EMC (N.D. Cal.), is a proposed class action filed on 30 July 2026. It alleges that Granola secretly records participants who did not consent and trains on their data by default.

Case facts

• Plaintiff: Tarra Chamberlain, a Florida resident.
• Defendants: Granola, Inc. and Granola Labs Ltd.
• Court: US District Court for the Northern District of California, assigned to Judge Edward M. Chen.

The seven claims

1. Intrusion upon seclusion
2. Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2510 et seq.
3. California Invasion of Privacy Act (CIPA) § 631
4. CIPA § 632
5. California Comprehensive Computer Data Access and Fraud Act (CDAFA), Cal. Penal Code § 502
6. Unfair Competition Law (UCL)
7. Unjust enrichment

The complaint draws a contrast with bot-based tools: "Unlike its competitors, Granola purposefully created and designed its technology to do the opposite." (complaint, CourtListener).

Lawyers watch these claims because of their statutory damages. CIPA § 637.2 allows $5,000 per violation or three times actual damages. The ECPA civil remedy (18 U.S.C. § 2520) allows the greater of $100 per day or $10,000 per plaintiff. Whether any amount is awarded is up to the court.

Status as of 18 October 2026

• Granola's response deadline was extended to 12 October 2026.
• The docket shows later filings, but we could not confirm an answer or motion to dismiss.
• Docket filings after 28 September are not publicly readable.
• Granola has made no public statement and, as reported, did not respond to Computerworld.

These are allegations, not findings. Nothing has been decided. Expect class certification and motion practice to continue into 2027. For the wider legal picture, read AI notetaker lawsuits and how to record meetings legally.

Is Granola AI Safe to Use?

The answer is mixed. In the security sense, Granola is safe: it has SOC 2 Type II, encryption and no retained audio. The privacy risk comes mainly from bot-free capture without disclosure, default model training and US-only storage.

Granola puts the consent duty on you: "You are responsible for obtaining consent from participants before using Granola." Whether Granola is safe for you depends on who you are:

• Safe enough: a solo user who opts out of training before their first meeting and announces Granola at the start of every call.
• Needs care: Business-plan teams. Each user must opt out individually, and without SSO, offboarding and access depend on each person's Google or Microsoft account.
• Possibly unsuitable: teams that need EU data residency, ISO 27001, FERPA, the NHS DSP Toolkit, or HIPAA coverage on mobile.

Legal and compliance staff should take one more step and map who is on your calls. If your sales and research teams speak with customers in California, Florida or the EU, the strictest rule among those participants applies to your process.

If this matters to you: compare the trade-offs side by side in BB Recorder vs Granola.

Consent: The Rule That Applies to Every Bot-Free Recorder (Including BB Recorder)

The core issue in the Granola lawsuit is recording without disclosure, and that risk applies to every bot-free recorder, including BB Recorder in local mode.

The basics are as follows. This is not legal advice. Federal law under ECPA (18 U.S.C. § 2511(2)(d)) is generally one-party: one participant can consent for the whole call. Roughly a dozen US states require all parties to consent for at least some recordings. California is the best known, under CIPA § 632, and Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington are among the others. A single video call can include people in several states and countries. A cautious approach is to follow the strictest rule that applies to anyone on the call.

Practical consent checklist

• Announce the recording at the start of the call, in plain words.
• Add a note to calendar invites, for example "This meeting is recorded and transcribed for note-taking."
• Use a visible signal where available: Granola's chat message or Watermark, or BB Recorder's visible bot option.
• Pause when someone objects. BB Recorder supports pause and resume within the same recording.
• Document your consent practice in a written policy that your team actually follows.

To be explicit: BB Recorder has no consent-collection feature, and it does not make you legally compliant on its own. Telling participants is your responsibility, whichever tool you use. For more detail, see how to record meetings legally.

Granola vs BB Recorder: Privacy Summary Table

The main difference is where the data lives. BB Recorder keeps full recordings on your computer, while Granola keeps transcripts and notes in US cloud storage and deletes the audio.

Data verified 18 October 2026 for Granola and 15 October 2026 for BB Recorder.

How to Make Granola More Private: A 5-Minute Checklist

If you keep using Granola, these six steps cover most of its privacy gaps.

1. Turn off training. Go to Settings > Preferences > Data & sharing and disable 'Use my data to improve models for everyone'. Do this on desktop or iOS, because the toggle is not yet in the Android app.
2. Audit your Business team. On Business, confirm that every teammate has opted out individually. A shared screenshot or a short form makes this easy to track.
3. Turn on visible signals. Enable the automated chat message, the Granola Watermark, or both.
4. Harden sign-in. Turn on 2FA with your Google or Microsoft identity provider, since Granola has no native 2FA.
5. Enterprise admins: enforce SSO, the training opt-out, transcript retention policies, and limits on MCP, API and integrations.
6. Get the paperwork. Request the SOC 2 report through the Vanta trust center if your vendor review needs it, and ask for Granola's de-identification method at the same time.

Do steps 1 and 2 before anyone records a real meeting. Because the opt-out is not retroactive, any data processed before you change the setting stays in the models.

A Local-First Option: BB Recorder by BuildBetter

BB Recorder is a free, local-first meeting recorder from BuildBetter for teams that want their recordings on their own machine. It records meetings without a bot, keeps the files on your computer, and only sends data to the cloud if you choose to.

• Free, 100% offline, no account required.
• Records Zoom, Google Meet and Microsoft Teams with full audio and video stored locally.
• Detects meetings on Mac and Windows and starts recording automatically.
• Transcribes on device with local models such as Whisper, Parakeet or Apple Intelligence, with speaker diarization.
• Template-based summaries for customer discovery, 1:1s and standups, plus chat with the transcript.
• Built-in dictation and screen recording, using ScreenCaptureKit on macOS.
• Imports from Plaud recorders for in-person conversations.

When you need more than a recorder, upload calls to a BuildBetter workspace. There, recordings sit alongside Slack conversations, support tickets and surveys, and become PRDs, tickets and insights. The workflow runs from customer conversation to shipped decision, combining what your team discusses internally with what customers tell you.

There is a trade-off. Local recording means you manage storage, retention and disclosure yourself. If you specifically want no audio kept anywhere, Granola's design fits that preference better. If you want a record you can verify that stays on your own machine, BB Recorder fits better.

For more options, see the best Granola alternatives for product teams, or download BB Recorder.

FAQ: More Granola Privacy Questions

Is Granola private?

Partly. Granola is SOC 2 Type II certified, encrypts notes at rest and in transit, keeps notes private from admins, and says it deletes audio after transcription. However, model training on de-identified data is on by default for Free/Basic and Business, data is stored only in the US, and no bot tells participants they are being transcribed. How private it is depends on your plan, settings and disclosure habits.

Does Granola train on my data?

By default on the Free/Basic and Business plans, de-identified data may be used to improve Granola's own models. Enterprise is opted out by default. To opt out, go to Settings > Preferences > Data & sharing and turn off 'Use my data to improve models for everyone'. Opting out is not retroactive, and you cannot yet do it from the Android app.

Do OpenAI or Anthropic train on my Granola notes?

No. Granola states that its third-party AI providers, including OpenAI and Anthropic, may not train on your data.

Is Granola GDPR compliant?

Granola says it complies with GDPR and UK GDPR and provides a standard DPA with EU/UK SCCs. Data is transferred to and stored in the US, and there is no EU residency or custom DPA. Your organisation, as controller, must establish a lawful basis and inform participants.

Where does Granola store data?

On AWS servers in the United States, inside a Virtual Private Cloud, encrypted at rest and in transit. Notes are also cached on your device.

What platforms does Granola run on?

macOS 14+, Windows, iPhone, Android, and Apple Watch through the iPhone. Mobile cannot capture virtual meeting audio ("Phones don't let apps capture audio from other apps…"). It is for in-person meetings, plus outbound calls on iOS.

Who are Granola's subprocessors?

We could not confirm the full list at trust.granola.ai/subprocessors, because the page loads its content with JavaScript. Providers named elsewhere are AWS (storage), Stripe (payments), Deepgram and AssemblyAI (transcription), and OpenAI and Anthropic (summarization).

Does Granola have two-factor authentication?

Not natively. Sign-in goes through Google, Microsoft or SSO, so use the 2FA on that provider.

Can Granola admins read my notes?

No. Notes are private by default, and admins cannot see private notes.

If I opt out of training, is my old data removed?

No. Opting out is not retroactive.

Is Granola HIPAA compliant?

Only on Enterprise with a BAA, and only for the desktop apps.

Has Granola responded to the lawsuit?

We could not confirm a response. Granola has made no public statement, and filings after 28 September 2026 are not publicly readable.

Does Granola offer a custom DPA?

No. It offers only a standard DPA with EU/UK SCCs.

Does the Granola Watermark record my video?

No. It is an overlay only.

Sources and Further Reading

Granola primary sources

• Granola privacy policy
• Granola security
• Security, privacy and data FAQs
• Model training
• Pricing
• SSO setup guide
• Transcription
• Setting up Granola for the first time
• Granola iOS getting started

Court records

• Chamberlain v. Granola, Inc. complaint (CourtListener)

External background

• General Data Protection Regulation (Wikipedia)
• Electronic Communications Privacy Act (Wikipedia)

Related BuildBetter reading

• BB Recorder vs Granola
• AI notetaker lawsuits: how to record meetings legally
• Best Granola alternatives for product teams
• BB Recorder download

Record, dictate, and capture — all on your device.

BB Recorder is one app with three tools: a no-bot meeting recorder, voice-to-text dictation and screen recording. It runs on your machine with Apple Intelligence, Whisper or your own API keys. It has no watermarks, no upload prompts and no required account, and more than 55,000 professionals in over 100 countries use it.

Download for Mac