Asana AI — privacy & data policy

Provider: Asana. PromptPrivacy score: 64/100. Last verified October 18, 2026.

What happens to your data?

Asana processes your account details, task inputs, uploaded content, and usage metadata to run its productivity platform and power automated features. For AI-assisted tasks, queries may be sent to third-party LLM partners that are contractually banned from training their models on your data. In business accounts, your employer acts as the data controller and manages your access and retention settings.

Does it train on your data?

Third-party LLM service providers leveraged by Asana are contractually prohibited from using customer data to train their models. When Asana AI features are enabled, Asana uses domain usage metadata to train internal machine learning models. Domain administrators can manage or disable AI preferences in the Admin Console and can opt out of data contributions for LLM usage pattern analysis.

Can you opt out?

Yes. Administrators can adjust AI settings in the Admin Console and opt out of data contributions used for LLM analysis of usage patterns. Individual users can submit requests to access, export, or delete their personal data, opt out of marketing emails, and manage tracking cookies or utilize Global Privacy Control signals.

Data retention

Asana retains personal and workspace data for the period necessary to fulfill the purposes outlined in the Privacy Statement, deliver the services, or as instructed by the account holder, unless a longer period is mandated or permitted by law. Specific retention windows are not detailed in the policy.

Encryption & security

The policy text does not specify encryption protocols (such as TLS in transit or AES at rest) or specific security certifications, referring users to its Trust page. It notes that user passwords are stored in hashed form and that Asana implements technical and organizational measures against unauthorized access, loss, or alteration.

Is it safe for work?

Yes, Asana AI is generally safe for business use. Business accounts operate under enterprise terms or Data Processing Addenda (DPAs) where the organization is the data controller, third-party LLMs are barred from training on customer data, and administrators retain centralized control over AI features.

Source policy: https://asana.com/terms/privacy-statement