How to Evaluate an AI Tool's Privacy Claims
Translate “private” into a documented data flow, enforceable terms, technical controls, and a deletion test.
Bottom line
A practical privacy due-diligence method for separating AI marketing language from the product, plan, contract, and controls your organization will actually use.
Editorial accountability
Who checked this guide
- Evaluation type
- Research-based verification
- Last materially checked
- Evidence
- 4 listed sources
Hands-on testing is identified explicitly. Research-based coverage uses cited product documentation and other named sources; it does not imply every paid plan was used. Read the full methodology.
Editorial basis
What this guidance is based on
- Editorial basis
- Source-led analysis
- Primary references
- 4
- Products covered
- 0
- Last checked
- 2026-09-10
Important limits
- • Features, availability, and pricing can change after publication; confirm consequential details with the provider.
In this guide
*This buyer framework is not legal advice. Privacy obligations depend on jurisdiction, data, role, industry, and contract.*
The short answer
Evaluate an AI tool's privacy by mapping what data enters, every party that receives it, why it is processed, where it is stored, how long it remains, who can access it, and how deletion is verified. “We do not train on your data” answers one question and leaves most of the privacy assessment open.
The ten questions
| Question | Evidence to request |
|---|---|
| What data is collected? | Field-level data inventory and telemetry description |
| Is content used for training? | Product- and plan-specific contractual term |
| How long is it retained? | Default, minimum, backup, abuse, and deletion windows |
| Who receives it? | Current subprocessor list and change notice |
| Where is it processed? | Hosting and model-inference regions |
| Who can access it? | SSO, MFA, roles, support access, and audit logs |
| How is it protected? | Encryption, key management, isolation, incident process |
| Can it be deleted/exported? | Admin controls, API, SLA, and practical test |
| Do connectors expand scope? | Permission model and downstream data flow |
| What proves the claims? | DPA, security report, audit scope, and contract |
Watch for five misleading shortcuts
“Local” may describe storage while inference or search remains cloud-based. “Encrypted” says nothing about access after decryption. “SOC 2” describes scoped controls, not blanket product safety. “GDPR compliant” is not a regulator's approval. “Zero retention” may exclude logs, metadata, safety review, connectors, or backups.
The FTC warns AI companies to honor privacy and confidentiality commitments and notes that quiet changes to terms can be unfair or deceptive. The ICO's AI toolkit recommends due diligence across the processing supply chain, security, individual rights, accuracy, fairness, and risk assessment.
Run a privacy acceptance test
Privacy evidence can be misquoted as easily as research evidence, so use the companion [AI research and citation verification guide](/articles/how-to-verify-ai-research-and-citations) when documenting vendor claims.
Create a non-sensitive test record with a unique phrase. Upload it, share it under each permission level, revoke access, export it, delete it, and ask the vendor what remains in backups and logs. Test employee offboarding and a subprocessor outage. Record screenshots and contract references.
Use a data ladder
Approve public data first, then ordinary internal data. Require a formal assessment before personal, customer, health, financial, privileged, secret, or contract-restricted data. A tool can pass for one class and fail for another.
Bottom line
A credible privacy claim is specific to a product and plan, supported by evidence, reflected in the contract, and testable in the controls. If the vendor cannot draw the data flow, the buyer should not guess it.
Sources and verification
Product details and claims were checked against the following primary sources.
Frequently asked questions
What does 'we do not train on your data' mean?
It should mean defined customer content is excluded from model training, but it does not by itself answer retention, human access, subprocessors, metadata, safety review, or deletion.
Does SOC 2 mean an AI tool is private?
No. SOC 2 can provide useful evidence about scoped controls over time, but buyers must inspect the report scope, exceptions, product coverage, and their own configuration.
Is local AI automatically private?
No. Storage may be local while model inference, embeddings, web search, telemetry, updates, or connectors send data elsewhere.
What privacy evidence should a small business request?
At minimum: privacy terms, DPA, retention schedule, subprocessor list, hosting regions, training policy, security overview, access controls, deletion process, and incident contact.
Found this useful?
Get the next one in your inbox.
One five-minute briefing a week: a meaningful change, a practical workflow, and a clearer tool decision—already filtered for lean teams.
Free · one email a week · unsubscribe any time
Read next
