Grammarly

GDPR overview

Compliance is claimed in plain words: the privacy pages state that Grammarly complies with the GDPR, the CCPA and HIPAA, and the business pages repeat it. The implementation is documented rather than merely asserted. Superhuman Platform Inc. is named as data controller, with a San Francisco address. A dedicated European section tables the legal basis for every processing purpose, article by article: consent, contract, legal obligation and legitimate interest. VeraSafe is appointed Article 27 representative for the EEA and the UK, and Bird & Bird DPO Services SRL acts as external Data Protection Officer in Brussels. Transfers rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, with standard contractual clauses as fallback. A Data Privacy Addendum and a sub-processor list are public. The policy took effect on 6 July 2026.

Who owns the data?

Grammarly is unusually direct about ownership: you keep every right to what you write, copyrights and duplication privileges included. The company analyses your text to produce suggestions but never claims it. It states that it neither sells nor monetises user content, never uses it for advertising, and contractually forbids its AI service providers from training their models on it. Content does reach its published sub-processors and companies within the same corporate family. One exception matters: when an account is managed by an employer or a school, that organisation controls the account and the content it holds, and the consumer privacy policy no longer governs what is uploaded.

Reuse rights

Because the text stays yours, you may reuse, publish, sell or adapt anything Grammarly helped you write without asking permission; the terms place no restriction on the output side. The limits sit on the service instead. It is licensed rather than sold, credentials cannot be shared, entities must use it for internal business purposes only, and access is barred from countries under a United States embargo. Open-source components keep their own licences. On the data side you can view everything held against your account, delete individual documents from the Grammarly Editor, or remove all personal information by deleting the account outright.

Data retention & training

Hosting summary

Grammarly hosts data in Amazon Web Services data centres in the US East region, using native AWS backup tools for availability. Data in transit is protected with TLS 1.2, and data at rest is encrypted with AES-256 server-side encryption, with database keys managed through AWS Key Management Service; enterprise customers can supply their own encryption keys instead. All components that process data run inside a private network behind load balancers and a web application firewall, and each user's data is isolated from other users'. The controller is Superhuman Platform Inc., based in San Francisco, California, so the governing jurisdiction is the United States. The Data Privacy Addendum confirms processing in the United States and wherever the company's sub-processors operate. Transfers out of the EEA, the UK and Switzerland rely on the EU-U.S. Data Privacy Framework and its extensions, with standard contractual clauses as a fallback and Irish law governing clause 17. No European data residency option is offered. Security logs are retained for at least one year.