Sanity

Privacy Policy Overview

*Policy dated May 4, 2026. This summary is informational, not legal advice.*

1. Data Collection and Use

Sanity may collect:

• Account information: Name, email, password, profile picture, and information received from Google, GitHub, or enterprise identity providers. Sanity does not receive your third-party password.
• Payment and billing information: Organization or personal name, address, email, and phone number. Credit-card details are handled by a payment processor and are not available to Sanity.
• User-uploaded content: Text, images, video, music, and other content (“Subscriber Data”). Sanity generally acts as a processor for this content on the customer’s instructions.
• Technical and usage data: IP address, access times, browser and operating-system details, referring URL, data volume, latency, caching and performance information, feature interactions, authentication information, and audit logs.
• Cookie and tracking data: Information collected through cookies, web beacons, analytics tools, and advertising pixels, including potentially IP address, device information, browsing activity, and geolocation.
• Employment information: Résumés, education and employment history, contact details, demographic information, and—in an employment context—certain sensitive information such as health, ethnicity, sexual orientation, or union membership.
• Marketing information: Name and email address if you subscribe to newsletters, whitepapers, status updates, or marketing.

Uses include providing and securing the services, account administration, support, billing, debugging, analytics, personalization, marketing, fraud prevention, legal compliance, recruitment, enforcing terms, and improving lead-generation efforts by identifying people or companies resembling existing customers.

2. User Rights

Depending on location and applicable law, users may have the right to:

• Access and obtain a copy of their data
• Correct inaccurate data
• Request deletion
• Object to or restrict processing
• Withdraw consent
• Opt out of targeted or cross-context behavioral advertising and certain “sales” or sharing
• Lodge a complaint with a data-protection regulator
• Request information about automated decision-making

Requests may be sent to privacy@sanity.io. Sanity may verify identity, reject or limit requests where legally permitted, and charge for excessive or repetitive requests. Users may also use recognized opt-out signals such as Global Privacy Control (GPC).

Deleting an account generally results in removal within 90 days, unless retention is legally required. Logs are deleted or anonymized within 90 days. Dataset history, document IDs, CDN caches, and backups or subprocessors may persist longer. User-specified document IDs may remain indefinitely, so they should not contain personal or sensitive information.

3. Third-Party Sharing

Sanity may share data with:

• Employees, contractors, affiliates, and service providers
• Hosting, analytics, payment, error-monitoring, human-resources, and background-check providers
• Business partners and co-sponsors
• Advertising technology companies, social networks, and ad platforms
• Professional advisers
• Authorities where legally required or for security, fraud, safety, or enforcement reasons
• Buyers or successors in a merger, acquisition, bankruptcy, or change of control

Tracking partners include Google, Meta, LinkedIn, X, Microsoft, and others. Sanity states it does not sell data for money, but acknowledges that advertising-related disclosures may legally count as a “sale” or “sharing” under laws such as California’s CCPA.

Data may be transferred to the United States and other countries. EU/EEA/UK transfers are said to use safeguards such as standard contractual clauses.

4. AI/ML Training

The policy does not state that Sanity uses user data to train artificial-intelligence or machine-learning models, nor does it expressly promise that it will not. Uploaded content is described as being processed to provide the services under the Terms of Service and applicable customer agreement. Users should review those documents or obtain contractual clarification, particularly for confidential or proprietary content.

5. Key User Responsibilities and Risks

• Review the privacy policies of identity providers, social-media sites, analytics providers, and linked services.
• Avoid placing sensitive personal data in document IDs.
• Understand that user-configured APIs/SDKs may transmit logged-in user IDs to Sanity or connected systems.
• Manage cookies and advertising preferences; blocking cookies may impair functionality.
• Do not submit employment-related sensitive data outside the employment context.
• Customer-controlled content may remain in version history or caches unless properly purged.

6. Liability and Disputes

This Privacy Policy contains no detailed dispute-resolution clause, governing-law provision, damages cap, or specific privacy liability warranty. It states that Sanity uses commercially reasonable security measures but cannot guarantee security during transmission or storage. Disputes and broader liability issues are likely governed by the Terms of Service, customer agreement, or applicable law.

7. Policy Changes

Sanity may change the policy at any time. Changes are effective immediately when posted. Material changes will be prominently posted or otherwise communicated. Users should check the latest version at sanity.io/legal/privacy.

Terms of Service Overview

*This is a business-to-business subscription agreement between Sanity US Inc. and the named “Subscriber.” It may not provide the same protections as a consumer service agreement. Separate AI and Growth-plan terms may also apply.*

1. Data Collection and Usage

Subscriber Data

“Subscriber Data” includes electronic data and information:

• Submitted by or for the Subscriber to the Service; or
• Collected and processed using the Service on the Subscriber’s behalf.

The Subscriber retains ownership of its data. However, it grants Sanity a broad, worldwide, royalty-free license to use, copy, process, store, transmit, distribute, display, modify, and create derivative works from the data when necessary to:

• Provide the Service; and
• Comply with applicable law.

The Subscriber is responsible for ensuring that all data submitted complies with applicable laws, including privacy and data-protection laws.

Service Usage Data

Sanity may collect information about how the Subscriber and its users interact with the Service. Sanity may use, share, and retain this “Service Usage Data” for business purposes at its discretion, including:

• Testing and development;
• Security and fraud or misuse prevention;
• Troubleshooting;
• Operational controls; and
• Service operation and improvement.

The Subscriber must obtain any required consent from its own end users for this collection. The Subscriber must also protect Sanity from claims arising from failure to obtain those consents.

Aggregated and Anonymized Data

Sanity may combine Subscriber Data with other customers’ information to create aggregated or anonymized statistics that do not identify the Subscriber or individuals. Sanity may use these statistics for its business purposes.

Retention and Export

After termination, Sanity will provide a copy of Subscriber Data in its standard database-export format if requested in writing and all amounts owed have been paid. Sanity is not required to retain the data for more than 30 days after termination or expiration, creating a significant data-retrieval deadline.

2. User Data Rights

The Terms expressly preserve the Subscriber’s ownership of Subscriber Data, but they do not describe detailed individual privacy rights such as access, correction, deletion, portability, or objection rights.

Those rights may depend on applicable privacy laws and separate Sanity privacy or data-processing documentation, none of which is included here. The Subscriber—not Sanity—is expressly responsible for obtaining necessary end-user consents and ensuring lawful processing.

3. Third-Party Sharing

Sanity may share or disclose data in the following circumstances:

• To provide the Service and comply with law;
• As part of aggregated or anonymized analytics;
• For Sanity’s use of Service Usage Data for business purposes;
• Through subcontractors used to perform the Service; and
• Potentially through Sanity’s suppliers or licensors supporting Sanity Technology.

Sanity remains responsible for subcontractors’ compliance with these Terms and applicable law. The Terms do not identify specific vendors, countries of processing, or detailed security measures.

4. AI and Machine-Learning Training

The Terms do not clearly state that Subscriber Data will be used to train general-purpose AI models.

However, Sanity owns “system performance data and machine learning,” including machine-learning algorithms, optimization data, service-improvement data, and machine-learning results and outputs. Sanity may also use Service Usage Data broadly for testing, development, and improvement.

AI features are subject to separate AI Terms. Users should review those terms before submitting confidential, regulated, or personal information to AI features.

AI outputs may be inaccurate, incomplete, or inappropriate. The Subscriber must independently verify outputs and remains responsible for decisions, published content, and other actions based on them. AI is supplied “as is,” with broad warranty disclaimers.

AI Credits are not property or currency, generally reset monthly, expire without compensation, and may be subject to consumption-rate changes that apply immediately to future actions.

5. Key User Obligations and Restrictions

The Subscriber must:

• Ensure all Permitted Users comply with the Terms;
• Protect account credentials and promptly report unauthorized access;
• Ensure data and use comply with applicable law;
• Pay fees, taxes, and late charges; and
• Stop using the Service when the Agreement ends.

Users may not:

• Resell, share, lease, or transfer access;
• Permit unauthorized third-party use;
• Copy, reproduce, modify, or reverse engineer the Service;
• Circumvent security controls;
• Benchmark the Service;
• Develop competing or functionally similar products; or
• Allow Sanity competitors or their employees to be Permitted Users.

The subscription generally renews automatically for one-year terms unless written non-renewal notice is given at least 60 days before the current term ends.

6. Liability and Disputes

Sanity provides only limited warranties that the Service will be professionally provided, substantially conform to Documentation, and initially lack malicious components. It does not promise uninterrupted, error-free, virus-free, or fully secure operation.

Neither party is generally liable for indirect, consequential, special, exemplary, or incidental damages, including lost revenue or data. Each party’s aggregate liability is generally capped at fees paid during the preceding 12 months.

The cap and exclusions do not apply to gross negligence, willful misconduct, unauthorized use or misuse of Sanity Technology, or indemnification obligations.

California law governs. Disputes must generally be brought exclusively in state courts in San Francisco, California.

7. Changes and Notices

Formal amendments require a written document signed by authorized representatives of both parties. Notices may be sent by email or mail and are deemed received relatively quickly—12 hours after email and 48 hours after mailing.

Important exception: Sanity may change AI Credit consumption rates by updating its Pricing Documentation, with changes applying immediately to future actions. Users should monitor account communications, Documentation, Pricing Documentation, and the separately referenced AI and Growth terms.