The change

Asana makes work management software that teams use to plan projects and track tasks. On September 1, 2026, it updated its Subscriber Terms, the contract that applies when a company buys an Asana subscription, and its Data Processing Addendum (DPA).

The new Subscriber Terms apply to new orders and renewals from September 16, 2026. The version they replace took effect on August 10, 2026, and Asana keeps it online as an archived copy.

What changed

• No more aggregation rule. Customer data that Asana uses to improve its service no longer has to be combined into totals or statistics.

• A switch for customers. Customers can now control this use of their data in the Asana Admin Console.

• A new purpose in the DPA. Asana may de-identify or aggregate customer personal data for analysis and service improvement.

• Slower deletion. Asana now has up to 180 days to destroy your data after you ask, instead of 90.

• Faster backup deletion. Backups are deleted within 30 days after that period, instead of 60.

The product improvement clause

The August version of Section 7.2 let Asana use customer data to improve its service under three conditions: it followed the confidentiality section, it did not publicly identify the customer or its users, and “such data is used in a statistical or aggregated form.”

The September version keeps the first two conditions and drops the third. Asana may now use customer data to “improve the Services as long as (i) such data is used in accordance with Section 6 (Confidentiality) of this Agreement and (ii) neither Customer nor its End Users are publicly identified.”

Aggregated data is data combined into totals or statistics, so no single customer stands out. The clause no longer asks for that. The only privacy condition left is that Asana does not name you or your users in public.

The switch in the Admin Console

Right after that clause, Asana added: “Customer can control whether Customer Data is used for product improvement purposes via the Asana Admin Console.” The terms do not say whether the setting starts on or off, or where in the Admin Console to find it.

Only certain admin roles in Asana can open the Admin Console. If nobody with that role looks for the setting, nothing changes.

Asana’s Privacy Statement, updated in August 2026, describes one use of this kind in more detail. Asana may aggregate or de-identify how people use Asana and use AI language models to find usage patterns and grade the quality of its features, including AI answers. It says: “To opt out of data contributions for LLM analysis of usage patterns to improve our products and services, you may change your settings in the Admin Console.” The words “opt out” suggest this use is on until an admin turns it off.

What the DPA adds

The DPA is the contract that covers personal data customers put into Asana, such as names, email addresses and the text of projects and tasks. Section 3.1 lists the reasons Asana may process that data. An earlier version listed four: providing the service, following the customer’s instructions, complying with the law, and anything else agreed in writing.

The September 1 version adds a new one: “to de-identify or aggregate such Customer Personal Data for analysis and Service improvement, provided that Asana shall not make any attempt to re-identify such de-identified or aggregate data.” De-identifying means removing the details that link data to a person, and Asana promises not to try to reverse it.

Deleting your data takes longer

Section 5.4 covers your data after you leave. You still have 30 days to ask for an export. If you then ask Asana to destroy your data, the August version said it would do so “within ninety (90) days of receipt of such request.” The September version says “within one-hundred and eighty (180) days of receipt of such request.”

Backups now go within 30 days after that period instead of 60, so the longest wait grows from 150 days to 210. You also now log the request in Asana’s help center instead of writing to [email protected].

When the new terms apply to you

New orders placed on or after September 16, 2026 are on the new terms. For current customers, Asana says: “If you are an existing Customer and previously agreed to a version of the Subscriber Terms before September 16, 2026, these updated Subscriber Terms will go into effect upon the renewal date of your next Order Form.”

Companies that signed their own written contract with Asana are not covered by the online terms.

What improved

• Customers now have a switch in the contract to control product improvement use of their data.

• The DPA now promises that Asana will not try to re-identify de-identified or aggregated data.

• Backups are deleted faster after the main deletion period: 30 days instead of 60.

Why this matters

Product improvement clauses are where vendors make room to use customer data for more than running the service. TaxDome can now use client data to improve its own products, Mixpanel replaced its AI data opt-in with a standing right, and Retool dropped its promise not to train its own AI on customer data. Asana’s version comes with a switch, but a switch only helps if someone at your company knows it is there.

Longer exit timelines are a pattern too. Airtable no longer gives you 30 days to export data after you leave. Changes like these are easy to miss unless you monitor vendor terms of service yourself.

Potential impact

If you use Asana, check five things:

• Has anyone at your company found the product improvement setting in the Admin Console and decided how it should be set?

• When does your Asana subscription renew, which is when these terms start to apply to you?

• Do you put customer or employee personal data in Asana tasks and projects?

• Do your own privacy notices or customer contracts limit how your vendors may use that data?

• Do you have a separate signed contract with Asana that the online terms do not override?

How Venpo detected it

Venpo monitors Asana’s legal pages and compared the new versions line by line with the earlier ones on record. The details are on the Asana Subscriber Terms change page and the Asana DPA change page. Every quote in this article was checked against Asana’s current pages and its archived August 2026 terms, and the pages were unchanged when Venpo checked them again on November 8, 2026.

Business outcome

Teams that check the setting now decide for themselves whether their Asana data goes into product improvement. Teams that miss it move to the new terms at renewal without having looked. That gap is why continuous monitoring of vendor legal changes belongs in continuous vendor risk monitoring.

Key takeaway

Since September 2026, Asana’s Subscriber Terms let it use customer data to improve its product without aggregating it, give customers an Admin Console switch for that use, and give Asana up to 180 days to destroy your data after you ask.