Gong — privacy & data policy

Provider: Gong.io. PromptPrivacy score: 48/100. Last verified October 18, 2026.

What happens to your data?

Gong collects and processes business communications, recordings, transcriptions, and interaction logs to provide revenue intelligence services and improve its machine learning models. Data is shared with third-party service providers, commercial partners, and affiliates as needed for service operations. Customer Data is processed under the direct instructions of the enterprise customer in accordance with a Data Processing Addendum.

Does it train on your data?

Gong uses collected data—including content processed through the services—under the legal basis of legitimate interests to improve its products and offerings, specifically noting the utilization and optimization of Artificial Intelligence and Machine Learning capabilities.

Can you opt out?

Yes, users can opt out of promotional messages, disable advertising cookies, signal opt-out via Global Privacy Control (GPC), and submit data subject deletion or objection requests via email. However, core service processing and customer-directed processing require engaging directly with the customer administrator.

Data retention

Gong retains personal data for as long as it deems reasonably necessary to fulfill its services, maintain business relationships, comply with statutory recordkeeping obligations, and protect against legal claims. Retention periods are determined based on data sensitivity, potential harm from unauthorized exposure, and applicable legal obligations.

Encryption & security

Gong states that it implements systems, applications, and procedures to secure personal data and reduce risks of theft, loss, or unauthorized access. Specific technical cryptographic standards (such as TLS or AES) and audit certifications are not detailed in the policy text itself, which links out to an external security trust center.

Is it safe for work?

Yes, Gong is designed specifically for business and enterprise environments. It operates under standard Data Processing Addenda (DPAs), recognizes data controller/processor boundaries, and complies with international data transfer frameworks including the EU-U.S. Data Privacy Framework.

Source policy: https://www.gong.io/privacy-policy