Read the Fine Print: What Your Go-To SaaS Tools Are Actually Doing With Your Data
Let's do a quick thought experiment. Open your browser right now and count the SaaS tabs you have running. Project management tool, maybe a code editor in the cloud, a communication platform, a CRM, a time tracker. For a lot of US-based teams—especially remote ones—that number is somewhere between six and twelve before lunch.
Each one of those tabs is a data relationship. And most of us clicked "I agree" without reading a word of what we agreed to.
We spent several weeks doing what most people don't: actually reading privacy policies, digging into data processing agreements, and cross-referencing what ten popular productivity and developer SaaS platforms say they collect versus what their terms actually permit. The results ranged from "fine, actually" to "huh, that's a lot."
Why This Matters More Than It Used To
Data privacy used to feel like a consumer problem—something to worry about with social media apps and shopping sites. But as more business operations move into SaaS tools, the stakes have shifted. We're talking about source code, client communications, financial workflows, and internal strategy documents all living inside third-party platforms.
For US-based businesses, the regulatory landscape is also getting more complicated. California's CPRA is in effect. Several other states have passed or are passing their own privacy laws. And if you work with any European clients or vendors, GDPR is still very much a factor. What your tools collect isn't just a philosophical concern—it can be a compliance one.
What We Actually Found Across Ten Platforms
We looked at a cross-section of tools that show up on a lot of American teams' stacks: Notion, Slack, GitHub, Figma, HubSpot, Zoom, Jira (Atlassian), Linear, Intercom, and Monday.com. We focused on three questions:
- What data do they collect beyond the obvious?
- How is that data used—especially for product improvement and AI training?
- What sharing or selling practices exist?
Usage telemetry is nearly universal. Every single platform we reviewed collects behavioral data—what features you click, how long you spend in certain views, what you search for. This is mostly used for product analytics, and it's pretty standard. But the granularity varies a lot. Some platforms log individual keystrokes in search fields. Others track cursor movement patterns. None of this is necessarily malicious, but it's worth knowing.
AI training clauses are the new gray area. This is where things got interesting. Several platforms—we won't name names without citing their current terms, since these change frequently—have language in their privacy policies or terms of service that allows user-generated content to be used for improving AI features. For a note-taking app, that might mean your meeting summaries are training data. For a dev tool, it could mean code snippets. Some platforms offer opt-outs; others make it the default with no clear toggle.
Third-party data sharing is more common than "we don't sell your data" suggests. A lot of platforms use that phrase carefully. They may not sell data in the traditional sense, but many share data with analytics partners, advertising infrastructure (even B2B tools use ad retargeting), and subprocessors—third parties who handle parts of the service. The subprocessor lists on some of these platforms run to dozens of companies.
Enterprise tiers generally offer more control. Almost across the board, the higher-tier plans came with stronger data governance options: data residency choices, the ability to disable telemetry, stricter retention policies. If your team is on a free or entry-level plan, you're typically sharing more and controlling less.
The Stuff That Actually Warrants Concern
Not everything we found is alarming—some of it is just the cost of using software that someone else built and maintains. But a few things stood out as worth flagging:
Metadata collection is underappreciated. Even if a platform claims not to read your content, metadata tells a story. Who you communicate with, when, how frequently, from what location—that data is valuable and almost always collected.
Integration permissions compound quickly. When you connect two SaaS tools via OAuth or an API integration, you're often granting both platforms broader access than you might realize. A CRM connected to your email client, for example, may sync far more than just contact records.
Free tiers and freemium models have to make money somehow. If you're not paying for the product, your usage data is often part of the value exchange. That's not inherently wrong, but it should be a conscious choice.
What Privacy-Conscious Teams Can Actually Do
We're not here to tell you to throw out your entire stack. That's not realistic, and frankly, most of these tools earn their place. But there are practical steps worth taking:
Actually read the DPA. Most SaaS platforms have a Data Processing Agreement available—sometimes you have to ask for it. This document is more specific than the public privacy policy and outlines exactly what the vendor does with your data in a B2B context.
Check for AI opt-outs. If AI-assisted features exist on a platform you use, look for settings related to content training or model improvement. Many platforms added these options quietly after user backlash. They're not always easy to find.
Audit your integrations. Do a quarterly review of which tools are connected to which. Revoke OAuth permissions for anything you're not actively using. This is basic hygiene that most teams skip.
Consider alternatives for sensitive workflows. For things like legal documents, financial data, or proprietary code, it's worth asking whether a self-hosted or privacy-first alternative makes sense. Tools like Gitea (self-hosted GitHub alternative), Nextcloud, or privacy-forward communication platforms exist and are more capable than they used to be.
Ask vendors directly. If you're evaluating a new tool for your team, send them a question about their data practices before signing. Legitimate vendors will answer clearly. Vague or deflecting answers tell you something too.
The Bottom Line
The SaaS tools powering your team are, for the most part, genuinely useful and not operating in bad faith. But the data they collect is real, the uses are broader than most users assume, and the responsibility for understanding that falls on the people signing up—and increasingly, on the procurement and engineering leads who decide what goes into a company's stack.
At Verilo, we think testing software means understanding the full picture—not just what it does for you, but what it does with you. That's part of what a real test drive looks like.