What happened at the companies we grade
Breaches, policy changes, and export-format changes. Every entry cites its source. Events never change a grade by themselves — grade moves happen only through the grade-change log.
Granola published a new privacy policy, effective 8 September 2026. It adds a HIPAA program for enterprise accounts: those customers can sign a business associate agreement, and under it Granola will not use protected health information to train AI models without express consent. Enterprise training stays off by default, but enterprise users can now opt in.
Lyft now lets you delete your account inside the app, under Privacy then Account Security. Its stated response time for data requests dropped from 45 days to 30.
Mistral published a new privacy policy, effective 3 September 2026. The Memory feature becomes Knowledge Base, existing memories carry over, and Mistral now states Knowledge Base will not seek to store sensitive data from your input.
Pinterest will replace its privacy policy on 12 November 2026 and has published a preview. By its own summary, the new policy adds detail on how it trains its models, including generative AI, on how long it keeps your information, and on international transfers. For users outside the EEA, Switzerland and the UK it describes sharing data with partners so advertisers can reach you on other sites and apps.
Notion removed workspace PDF export, as it said it would by 31 August 2026. Export to HTML, Markdown and CSV remains, and single pages still export to PDF. Notion also documented starting a workspace export through its admin API, in beta on the Enterprise plan.
Microsoft shipped a new Copilot app with a new privacy FAQ. The locations excluded from model training changed: the old FAQ named the EEA, UK and Switzerland; the new one names Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea and Vietnam. Signed-out users and users under 18 are also excluded, and the training opt-out remains.
Uber added a promise to its US privacy notice: it will not sell or share your phone number with third parties for marketing text messages.
xAI renamed itself SpaceXAI and published a new privacy policy, effective August 24, 2026.
Telegram narrowed its no-ads principle. The policy ruled out using your data for ads; it now rules out only the contents of your chats and contact lists, and sponsored messages now also appear in bots and stories.
Robinhood’s privacy policy now names third-party AI services among the connected services that can send Robinhood information about you.
Booking.com replaced its California-only privacy rights section with one covering all US residents, and now states it derives your location from your IP address.
Meta’s deletion page now describes deleting a Facebook profile rather than an account: other profiles in the same Meta Account are not affected.
How events become grade changes → events record other parties’ actions; the grade-change log records ours. When an event warrants a grade revisit, it enters the normal grading workflow — never an automatic move.