Read AI Privacy Policies Without Nodding Off

AI provider privacy policies are often written like a sofa made of fog. Soft, large, and surprisingly hard to get out of.

The trick is not to read them like literature. Read them like a mechanic. You are looking for parts: training, retention, access, sharing, deletion, subprocessors, user rights, and exceptions.

Start with training. Does the provider use customer content to train or improve models? Is the default opt-in or opt-out? Does the statement apply to API customers, consumer accounts, enterprise plans, image endpoints, file uploads, and fine-tuning data? “We do not train on your API data” is useful. “We may use content to improve services” is a very different animal.

Next read for retention. How long are prompts, images, outputs, logs, and files kept? Are there different rules for abuse monitoring, application state, saved projects, batch jobs, or image edits? If the policy uses “temporary,” hunt for the number.

Then read for access. Can provider staff review content? When? For abuse, support, legal compliance, debugging, or quality? Are human reviewers involved? Is review automatic, sampled, escalated, or available broadly inside dashboards?

After that, read for sharing. Which subprocessors handle data? Does content leave the region? Is data shared with model providers, infrastructure vendors, analytics tools, or support platforms? The word “subprocessor” is boring until one of them is where your customer photo actually went.

Finally, read deletion. Can the customer delete content? Does deletion cover active systems only? What about backups? What about generated outputs, thumbnails, and cached links? If deletion rights are described but the actual product has no usable delete path, congratulations, you found the gap.

Your goal is not to become a lawyer overnight. Your goal is to write a one-page internal summary that a normal teammate can understand. If you cannot summarise the provider’s behaviour, you are not ready to put customer images through it.

Further reading: What developers misunderstand about model training and uploaded images, What zero data retention really means across AI providers, and The problem with AI tools that hide retention in the fine print.