Where to Find the Privacy Policy

Look for links in:

The website footer (often labelled “Privacy” or “Legal”)
Tool documentation or help centres
Sign-up screens or account settings

Search terms to try:

“[Tool name] privacy policy”
“[Tool name] GDPR compliance”
“[Tool name] data use”
“[Tool name] data retention”

Key Questions to Ask

Question	Why it Matters	Look For Terms Like...
Is my data stored?	Data might be logged or retained after use.	"retention", "log", "store", "data use"
Is it used to train models?	Content may be reused to improve the tool.	"training", "model improvement"
Can I opt out of data use?	Some tools allow stricter privacy controls.	"opt-out", "privacy settings", "control"
Is data processed outside the UK?	Data may be subject to different legal protections.	"international transfers", "SCC", "US"
Is there a Data Processing Agreement (DPA)?	Essential for business compliance with UK GDPR.	"DPA", "data processor", "enterprise"

Before Using an AI Tool with Personal or Customer Data

Tick off each of these:

I know where the data is processed
I’ve checked the default settings (e.g. logging or training options)
I’ve confirmed data won’t be used for training without consent
I have (or have requested) a DPA or written terms
I’ve reviewed this with our legal, IT, or data protection lead

Red Flags to Watch Out For

Vague terms like “data may be used to improve our services”
No option to disable training or data storage
No mention of GDPR or UK compliance
No available DPA (or only for paid plans)

Disclaimer

This checklist is for general informational purposes only and does not constitute legal advice. Always consult your organisation’s data protection officer or legal team before sharing personal or customer data with external AI tools.

AI Tools Data Privacy Policy Checklist

Want More Resources Like This?