Ask what happens to one real document
Take a customer transcript or internal plan and trace it through the system. Which vendor receives it? Where is it stored? How long? Can a support engineer access it? Is it used to improve a model? Can you delete it and prove deletion? A privacy policy that cannot answer those questions is not an operating control.
The privacy surface
- Input collection and unnecessary personal data.
- Provider retention and training settings.
- Workspace and tenant separation.
- Access roles and audit logs.
- Logs, backups, exports, and deletion.
- Third-party tools and subprocessors.
Privacy is not solved by using an AI API
A server-side API key prevents users from seeing your credential, but it does not decide whether the data should be sent, retained, or exposed. Data minimization, permissions, contracts, and retention rules still belong in the product design.