Tell customers how you use AI with their data
Customers increasingly expect a clear answer to “what does your AI do with my data?” — and regulators increasingly require one. This generator turns a short description of your product and its AI uses into a customer-facing policy covering what data is processed, why, which providers are involved, whether decisions are automated, and how to opt out. It builds the document in your browser; nothing you enter leaves the page.
How it works
You describe your product, the customer data involved, and each way you use AI (support, recommendations, content generation, fraud scoring, and so on). You indicate whether an opt-out exists, whether any AI-driven decisions are fully automated, and which model providers you want to disclose. The tool assembles these into a structured policy with sections for data used, purposes, provider disclosure, automated decision-making and human review rights, opt-out mechanics, retention, and contact. A copy button drops the formatted text straight into your privacy center.
What the policy covers and why each section matters
Data used — customers want to know which data the AI actually processes. “Your account data” is too vague; “your past support conversations and usage history” is honest and specific. Vague data descriptions are increasingly flagged by data protection authorities as failing the transparency standard.
Purposes — stating why you use AI (to personalise recommendations, to speed up support responses, to detect fraud) is different from just describing the feature. The purpose is what justifies the processing under most privacy regimes, and customers find it easier to consent to a stated purpose than to a black-box system.
Provider disclosure — when you send customer data to an AI model provider to run inference, that provider is typically a data processor or sub-processor, and privacy law generally expects you to name the category of recipients or the specific companies. Disclosing OpenAI, Anthropic, or Google Gemini by name is increasingly expected rather than exceptional, and it builds trust.
Automated decisions and human review — this is the section most likely to be legally required. If AI output drives a decision that affects a customer — a support case routed to a bot rather than a human, a fraud flag that restricts an account, a pricing adjustment — those affected users have rights in many jurisdictions, including the right to request a human review. The generated policy flags when AI materially informs decisions and includes the mechanism for requesting human review.
Opt-out — not every AI use allows an opt-out (if AI is core to the service, opting out may mean not using the service), but non-essential AI uses — training, personalisation, enhancement — should offer one. The policy distinguishes these and gives the customer a realistic picture of what opting out actually changes.
Training on customer data — this is the question customers ask most and trust hinges on. If you do not train on customer content, say so explicitly; it is one of the most trust-building lines in any AI transparency document. If you do train, explain the basis and how to object.
Tips and notes
- Name your providers. Listing the model vendors you rely on is a transparency expectation and a trust signal.
- Be honest about training. If you do not train on customer content, say so — it is one of the most reassuring lines you can include.
- Flag automated decisions. If AI materially affects a person, disclose it and offer human review.
- Publish it prominently. A disclosure buried in the footer of the privacy policy is weaker than a dedicated “How we use AI” page linked from your product.
- Have counsel review. This is a strong template, not a legal opinion for your specific processing and jurisdictions.