AI privacy policy gap analyzer
Most privacy policies were written before generative AI entered the workflow. If your product now sends user data to an LLM provider, makes automated decisions, or contributes to model training, your policy probably has blind spots. This tool scans your existing policy text for the AI-specific topics regulators increasingly expect and flags which ones appear to be missing.
How it works
Paste the full policy text and the analyzer runs keyword and phrase matching for a set of AI-relevant disclosures: automated decision-making and profiling, the right to human review, AI sub-processors and subprocessor lists, AI training data use, data retention by AI vendors, and a contact route for AI-related requests. For each topic it reports whether matching language was found, and if not, it explains why the topic matters and offers starter wording. All processing happens locally in your browser — the text never leaves your machine.
The gaps most commonly found in existing policies
Automated decision-making
GDPR Article 22 gives data subjects the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, along with the right to an explanation and the right to human review. Most privacy policies pre-dating 2022 either omit this entirely or mention it in a single vague sentence that does not explain what decisions are automated or how to request human review. If your product uses AI to score, rank, approve, or decline users in any meaningful way, this section needs updating.
AI subprocessors
When you call an LLM API, the provider processes your users’ data (if it appears in the prompts). That makes them a data processor or subprocessor under GDPR, and your privacy policy needs to list them or reference a maintained subprocessor list. Most policies from before 2022 do not contemplate LLM providers as subprocessors because they did not exist in the product stack at the time. Adding them is not just legal housekeeping — regulators have started asking specifically about AI vendor data flows during audits.
Training data disclosure
If user interactions with your product are used to train or fine-tune a model — your own or a third party’s — users need to know this and, in most jurisdictions, need the ability to opt out. This is a distinct disclosure from general data processing, and omitting it is increasingly flagged by data protection authorities. The analyzer checks for language about training use, model improvement, and user data in model training contexts.
Right to human review
Even where the automated decision-making section exists, the right to request human review is often described in such abstract terms that users have no idea how to exercise it. The analysis checks for a concrete mechanism — a process description or contact point — not just a statement that the right exists.
Tips and notes
- “Found” means mentioned, not adequate. A single passing keyword does not guarantee the clause is sufficient; read the relevant section before relying on it.
- Update after every AI integration. Adding a new LLM vendor is a sub-processor change and usually needs a policy and changelog update.
- Pair with a subprocessor register. Regulators expect a maintained list of who processes data, including AI APIs.
- Get legal sign-off. This is a triage checklist, not a substitute for qualified data-protection advice.
- Date the policy revision. A policy that has not been updated since before your AI integrations were added is itself a compliance signal; always include a “last updated” date and update it when the policy changes.