You don’t need to be a lawyer to vet an AI tool’s privacy practices. You need ten minutes, a skeptical eye, and this checklist. Run through it before you create an account — it’s much easier to avoid a bad tool than to extract your data from one later.
This is general information to help you ask the right questions, not legal advice. For specific situations, consult a qualified professional.
The 10-minute checklist
1. Find the privacy policy and data processing agreement
Scroll to the footer of the tool’s website. There should be a privacy policy link — if there isn’t one, stop here; that’s disqualifying. Open it and skim for the essentials: what data they collect, why, and who they share it with. If you’ll use the tool for work involving other people’s data, also look for a Data Processing Agreement (DPA). Reputable providers offer one, often linked from a security, trust, or legal page. No DPA available usually means the tool isn’t meant for business use with personal data.
2. Check where your data is stored
Look for statements about data location or “data residency.” Phrases like “data processed in the EU” or “EU data centers” are what you want to see. If the policy says data is transferred outside the EU, check whether it names the safeguard used — the standard term to look for is “Standard Contractual Clauses.” Vague statements like “your data may be processed anywhere in the world” with no further detail are a yellow flag.
3. Find out if your data trains their models — and how to opt out
Search the privacy policy or help center for “train,” “training,” or “improve our models.” You want a clear answer to two questions: does the company use customer inputs to train AI models, and can you opt out? The best tools state this plainly and offer a toggle in settings. If the answer is buried, contradictory, or missing, assume the worst and either opt out aggressively in settings or choose another tool.
4. Check retention and deletion options
How long do they keep your data, and can you delete it? Look for a retention period (“we keep chat history for X months/years”) and a clear deletion path — ideally a self-service option in account settings, not just an email address you have to beg. Under the GDPR you have a right to erasure, but a tool that makes deletion easy in practice is worth more than one that merely acknowledges the right in theory.
5. Look at the sub-processors list
AI companies rarely do everything themselves — they use cloud hosts, analytics providers, payment processors. Many publish a “sub-processors” page listing these third parties. It doesn’t need to be exciting; it needs to exist. A company that won’t tell you who else touches your data is asking for trust it hasn’t earned.
6. Find the Data Protection Officer contact
Under the GDPR, many companies must appoint a Data Protection Officer (DPO) and publish a way to reach them. Look for a dpo@ email address or a data-protection contact in the privacy policy. Its presence signals the company has at least thought about compliance structurally. Its absence, in a company large enough to obviously need one, is a red flag.
Red flags: walk away when you see these
- No privacy policy at all. Non-negotiable. Don’t sign up.
- Vague wording everywhere. “We may use your data to improve our services” with no specifics about what that means is not transparency — it’s decoration.
- No deletion option. If you can’t find any way to delete your account data, your GDPR erasure right exists only on paper.
- Forced consent with no real choice. If the only way to use the tool is agreeing to every data use including advertising and training, with no opt-outs, keep looking.
- No information about data location. A tool handling your inputs should be able to say where they go.
- Reviews or news about data incidents with no public response. Everyone can have a breach; trustworthy companies disclose and explain.
What to do when information is missing
Sometimes a tool looks promising but the documentation is thin. You have two moves. First, ask support directly: “Do you use my inputs to train models, and how do I opt out? Where is my data stored? How do I delete my data?” A clear, prompt answer is a good sign; evasion or silence is your answer too. Second, if the answers don’t come, pick an alternative. The AI tool market in 2026 is crowded enough that you can almost always find a comparable tool with better documentation. Never trade your data for convenience when you have a choice. And if you do keep using a tool with thin documentation, limit what you share with it: use a separate email for signup, avoid uploading personal files, and assume anything you type could be retained longer than stated.
Make it a habit
The first time you run this checklist it takes ten minutes. The fifth time, three — you’ll know exactly where to look. That small habit is the difference between using AI tools confidently and hoping for the best. Your data is the price of admission to every free AI tool; this checklist just makes sure you read the price tag first.
This article is general information only and is not legal advice. For specific situations, consult a qualified data protection professional.