ClickUp

GDPR overview

GDPR compliance is claimed explicitly: a GDPR COMPLIANT badge sits in the site footer next to SOC 2, ISO 27001 and HIPAA. The privacy policy, effective 2 June 2026, lists eight data subject rights — access, rectification, erasure, restriction, portability, objection, withdrawal of consent and the right to lodge a complaint — exercised through support@clickup.com or by post to San Diego. EEA users are pointed to their local authority, UK users to the ICO. A Data Processing Addendum is published, along with a named subprocessor list, and transfers outside the EEA rely on the 2021 Standard Contractual Clauses with disputes heard by the Irish courts. New subprocessors are notified at least 30 days in advance. Two gaps: no Article 27 EU representative is named anywhere on the site, and no DPO is identified — the contact is a Privacy Agent.

Who owns the data?

You keep your content. ClickUp claims no ownership over the Customer Content you submit or create in your account, and any intellectual property in it remains yours; the terms grant the vendor only the limited rights it needs to run the service. Two carve-outs matter. ClickUp may access your content to improve the service and gauge satisfaction, and it may combine your reporting data with other companies' data for benchmarking and public reports, but only once anonymised so it no longer identifies you. Support staff may open your account to diagnose problems unless you object explicitly. The interface, code and visuals remain ClickUp's property, and no personal data is sold.

Reuse rights

Because you retain ownership of your own content, you can reuse, export and republish it freely without asking ClickUp for permission. The restrictions run the other way, covering the platform rather than your data. ClickUp grants a non-exclusive, non-transferable and revocable right of access limited to the intended use of the service: you may not redistribute or publicly display ClickUp's own content, create derivative works from the service, or run scraping, data mining or robots against it. Automated crawling and caching are prohibited outright, and the public API must be reached through authorised clients only. The desktop and mobile applications are licensed, not sold, and the ClickUp and Mango Technologies names and logos may not be reused without written permission.

Data retention & training

Hosting summary

ClickUp runs entirely on Amazon Web Services, and its published subprocessor list places that infrastructure in the United States, Ireland, Germany, Australia and Singapore. US, EU and APAC data residency is offered, but only on the Enterprise plan. The Data Processing Addendum allows storage and processing anywhere ClickUp or its subprocessors maintain facilities, subject to transfer rules: movements out of the EEA rely on the 2021 Standard Contractual Clauses, with disputes heard by the Irish courts. The terms likewise state that content may be transferred to and processed in the United States or any other country where the company operates. Subprocessors are named individually with purpose and location, including AI vendors such as Anthropic, OpenAI, Microsoft Azure AI Foundry and Google Gemini in the United States, and two generative video providers in China. Note that the domain resolves to an Amazon CDN node in Switzerland, which is routing rather than storage.