By business type

Privacy Policy Generator for AI companies

Written for training data, prompts and outputs, the EU AI Act and the questions enterprise buyers actually ask.

Generate your privacy policy Read the privacy policy guide

An AI privacy policy has to answer five questions plainly: what happens to prompts, what happens to outputs, whether either trains a model, who else sees the content, and how long any of it is kept. Everything else is standard - and getting those five wrong is what makes an AI policy fail both regulatory scrutiny and enterprise review.

AI companies face a disclosure problem no template handles: the same data can be an input, a training corpus, an output and a log, and each of those has a different legal character. A prompt containing personal data is processing; retaining it is storage; training on it is a new purpose; and generating an output about a person is processing again, with an accuracy obligation attached.

Regulators have moved fast here. Data protection authorities have opened and settled investigations into training data provenance, lawful basis for web scraping, the accuracy of model outputs about real people, and the adequacy of opt-outs. The EU AI Act adds a transparency layer of its own: people must be told when they are interacting with an AI system, synthetic content needs marking, and general-purpose model providers face documentation duties.

Commercially, the questions that actually decide deals are narrow and specific: do you train on customer data, how long do you retain prompts, which model providers are in the chain, can data be processed in a specified region, and can the customer opt out of everything above. A policy that answers those five questions plainly beats one that is comprehensive but evasive.

What a privacy policy for an AI company has to cover

Prompts and inputs: retention period, who can access them, and whether they leave your infrastructure
Outputs as personal data, with a route to correct false statements about identifiable people
Training: whether customer content is used, the opt-out, and the position on data already used
Human review and evaluation, disclosed rather than implied
Model providers named as sub-processors, with their regions, retention and training terms

If your product makes decisions with legal or similarly significant effects - screening applicants, scoring risk, moderating accounts - Article 22 applies and the policy needs to explain the logic involved and the route to human review.

How an AI company actually moves personal data

Prompts and inputs

Users paste anything into a prompt box, including personal data about third parties. Retention of prompts, and who inside the company can read them, is the first question in every review.

Outputs and generated content

Outputs about identifiable people are personal data. That brings accuracy, rectification and erasure obligations to content the model produced rather than content anyone stored.

Training and fine-tuning corpora

Scraped data, licensed datasets, and customer content if you use it. Provenance, basis and opt-out routes all need documenting, and the answer materially affects enterprise sales.

Human review and evaluation

Rating pipelines and red-teaming expose staff or contractors to user content. It is legitimate processing but it needs disclosing, because users assume nobody reads their prompts.

Model provider sub-processing

Calls to OpenAI, Anthropic, Google or an inference host move customer content to a third party with its own retention window and its own training position.

Telemetry, logs and abuse monitoring

Safety and abuse systems retain content longer than the product does, which is defensible but has to be described rather than discovered.

Third parties the draft will ask you about

OpenAI · Anthropic · Google Cloud Vertex · AWS Bedrock · Pinecone or Weaviate · Modal or Replicate · Scale or Surge for human evaluation · Datadog

The rules that apply

Lawful basis for training data

Scraped and licensed corpora containing personal data need a basis, and legitimate interests requires a documented balancing test that engages with the individuals’ expectations.

GDPR Article 22 and automated decisions

Where an AI system makes decisions with legal or similarly significant effects, the individual has rights to information, human intervention and challenge.

EU AI Act transparency duties

Disclosure when a person interacts with an AI system, marking of synthetic content, and documentation obligations for general-purpose models, phasing in on a set timetable.

Accuracy and rectification

A model that produces false statements about a real person engages the accuracy principle, and "the model generated it" is not a defence regulators have accepted.

Model provider chain

If you route customer content to a third-party model, that provider is a sub-processor with its own retention and training terms that flow through to your customers.

What the generated privacy policy contains

Identity and contact details of the controller
Your legal entity, trading name, registered address and a working contact route - plus a representative or DPO where one is required.
Categories of personal data and their sources
What you collect directly, what you observe automatically, and what you receive from third parties such as payment providers or ad platforms.
Purposes and lawful basis, purpose by purpose
A table that pairs each processing purpose with its lawful basis rather than listing all six bases and hoping one fits.
Recipients and sub-processors
The categories of recipient, and for the ones that matter to users - payment, hosting, analytics, support - the named provider.
International transfers and their safeguards
Where data leaves its home jurisdiction, and the mechanism relied on: adequacy, standard contractual clauses, the UK addendum or IDTA.
Retention periods per data category
Concrete periods or the criteria used to set them, which is what regulators ask for first when a complaint lands.
Rights and how to exercise them
Access, rectification, erasure, portability, objection and restriction, with the actual route to make a request and the deadline you work to.
Complaints and supervisory authority
The regulator a user can escalate to, named, with a link - not a generic "your local authority".

The AI compliance document set

Write the training position first
One paragraph, in plain language: whether customer content trains models, whether there is an opt-out, and what happens to data already used.
Set and publish retention windows
For prompts, outputs, logs and abuse-monitoring copies - which are usually different from each other.
Document training data provenance
Sources, licences, and the legitimate interests assessment for anything scraped.
Build a rectification route for outputs
A way for someone to report a false generated statement about themselves, and a documented response.
Publish the model provider chain
Which providers process customer content, in which regions, with what retention and training terms.
Add AI Act transparency where it applies
Interaction disclosure, synthetic content marking, and the documentation duties for general-purpose models.

Where this usually goes wrong

Silence on training

If the policy does not say whether customer content trains models, buyers assume the worst answer and regulators treat the omission as a transparency failure.

An opt-out that only covers future data

If a user opts out, the honest position on data already in a training set has to be stated - including where removal is not technically possible.

No accuracy or rectification route for outputs

People have complained to regulators about false generated statements. Having no process is worse than having an imperfect one.

Undisclosed human review

Users are consistently surprised that humans read prompts. Disclosure costs almost nothing; discovery costs a great deal.

Retention windows set by the model provider, not by you

Provider defaults - often thirty days for abuse monitoring - become your retention period unless you configure otherwise, and your policy should reflect what is actually configured.

Treating the AI Act as a future problem

The transparency obligations arrive on a schedule, and the documentation they require takes longer to assemble than the deadline suggests.

Frequently asked questions

Do I need to disclose that I train on user data?

Yes. Training is a distinct purpose from providing the service, it needs its own lawful basis, and both regulators and enterprise buyers treat silence as an answer. The disclosure should be specific enough to act on, not a general reservation of rights.

Are AI outputs personal data?

Where they relate to an identifiable person, yes - which means accuracy, rectification and erasure obligations apply to generated content, not just to stored content.

What does the EU AI Act require of my privacy documentation?

Transparency where people interact with an AI system, marking of synthetic content, and documentation for general-purpose models. It sits alongside GDPR rather than replacing it, and the obligations phase in on a published timetable.

Is a model provider a sub-processor?

If customer content is sent to it, yes. That brings a contractual chain, a transfer question, and an obligation to tell your customers who is in the chain and on what terms.

Can users ask to be removed from a training set?

They can ask, and you have to answer honestly. Where removal from an already-trained model is not technically feasible, say so and explain what you can do instead - exclusion from future training, output filtering, or deletion of the source record.

Is a privacy policy legally required?

If you process personal data, in almost every market yes. GDPR and UK GDPR require the disclosure at the point of collection, CCPA/CPRA requires a notice at collection plus an annually reviewed policy, and app stores and payment processors require a public policy URL before they will list or onboard you.

Can I copy another company’s privacy policy?

It is both a copyright problem and a compliance problem. A copied policy describes someone else’s data flows, processors and retention periods, so it is inaccurate the moment you publish it - and an inaccurate transparency notice is itself a breach of GDPR Article 13.

How often does a privacy policy need updating?

Whenever your processing changes - a new analytics tool, a new payment provider, a new market - and as a backstop, review it annually. CPRA makes the twelve-month review explicit.

Does PolicifyAI give legal advice?

No. PolicifyAI is a technology provider, not a law firm. The output is a structured, jurisdiction-aware draft that a qualified adviser should review before you rely on it.