Personal data is disclosed to and received from listed third-party categories for policy purposes
Anthropic states that it will disclose personal data to, and receive personal data from, the third-party categories listed in Section 3, for the purposes explained in the Policy.
Supporting quotations
Anthropic will disclose personal data to, or receive personal data from, the following categories of third parties for the purposes explained in this Policy:
Qualifications & exceptions
Purposes are those explained in the Policy; Section 3 does not restate them.
Sharing & Disclosure · Company practice
Personal data is disclosed between and among affiliates and related entities
Anthropic discloses the categories of personal data described earlier in the Policy between and among its affiliates and related entities.
Supporting quotations
Affiliates & corporate partners: Anthropic discloses the categories of personal data described above between and among its affiliates and related entities.
Not stated here
The policy does not identify the affiliates and related entities or their locations in this item.
Sharing & Disclosure · Company practice
Service providers and business partners receive data for listed business purposes
Anthropic may receive and disclose the categories of personal data described earlier with service providers and business partners for business purposes: website and data hosting, compliance with industry standards, research, auditing, data processing, investigating and resolving safety and security issues, preventing and investigating fraud, abuse and Usage Policy violations, and providing the Services.
Supporting quotations
Service providers & business partners: Anthropic may receive and disclose the categories of personal data described above with service providers and business partners for a variety of business purposes, including website and data hosting, ensuring compliance with industry standards, research, auditing, data processing, investigating and resolving safety and security issues, preventing and investigating fraud, abuse, and violations of our Usage Policy, and providing you with the Services.
Qualifications & exceptions
The list of purposes is introduced with “including”, so it may not be exhaustive.
Not stated here
The policy does not name the individual service providers here; the subprocessor list is linked separately at the end of Section 3.
Sharing & Disclosure · Company practice
Work email accounts may be linked to an employer's enterprise account
If a user uses an email address owned by an employer or another organization, the account may be linked to that organization’s enterprise account with Anthropic, as described in the Consumer Terms of Service.
Supporting quotations
Your Organization and Administrator: If you use an email address owned by your employer or another organization, your account may be linked to the organization’s enterprise account with us, as described in our Consumer Terms of Service.
Qualifications & exceptions
Linkage is conditional on using an organization-owned email address and described as possible (“may be linked”).
Not stated here
The Consumer Terms of Service is referred to but not supplied here, so what an administrator can see or control is not stated.
The policy does not say what data becomes visible to the organization or its administrator.
Sharing & Disclosure · Company practice
Personal data is transferred as part of mergers, transactions or bankruptcy
If Anthropic is involved in a merger, corporate transaction, bankruptcy or other situation involving the transfer of business assets, it will receive or disclose personal data as part of those corporate transactions.
Supporting quotations
As part of a significant corporate event: If Anthropic is involved in a merger, corporate transaction, bankruptcy, or other situation involving the transfer of business assets, Anthropic will receive or disclose your personal data as part of these corporate transactions.
Not stated here
The policy does not describe notice, choice or successor obligations in a corporate event.
Sharing & Disclosure · Company practice
Connectors, plugins, webhooks and APIs let users connect third-party services to Claude
The Services allow users to connect to and interact with third-party applications, services and content (“Third-Party Services”) through integrations they enable, such as Connectors, plugins, webhooks and external APIs.
Supporting quotations
Third-Party Websites, Integrations, and Services: Our Services allow you to connect to and interact with third-party applications, services, and content (“Third-Party Services”) via the Services and through integrations you enable, such as Connectors, plugins, webhooks, and external APIs.
Qualifications & exceptions
Integrations are enabled by the user.
Sharing & Disclosure · Company practice
Claude may send Inputs, Outputs and instructions to Third-Party Services, which process them under their own policies
Claude may send Inputs, Outputs and instructions to Third-Party Services to perform actions for the user, such as reading files, sending messages or retrieving information. The Third-Party Service receives that data directly and processes it under its own privacy policy.
Supporting quotations
Claude may send your Inputs, Outputs, and instructions to Third-Party Services to perform actions on your behalf (such as reading files, sending messages, or retrieving information). The Third-Party Service receives this data directly and processes it according to its own privacy policy.
Inputs and Outputs: You are able to interact with our Services in a variety of formats, including but not limited to chat, coding, agentic sessions (where Claude performs multi-step tasks or takes actions on your behalf), and connected services. The content you submit to the Services through these interactions, including via third-party applications, services, and content you choose to upload, integrate or interact with using our Services, are your “Inputs”. Inputs generate responses and actions (“Outputs”).
Qualifications & exceptions
Disclosure happens only when the user's setup lets Claude act on that service; sending is described as possible (“may”).
Not stated here
Each Third-Party Service's privacy policy is not supplied here, so what that recipient does with the data is not stated.
The policy does not say what Anthropic contractually requires of Third-Party Services.
Sharing & Disclosure · Restriction or exception
Anthropic does not control Third-Party Services and users must confirm authority before enabling integrations
Anthropic states it does not control and is not responsible for the data practices of Third-Party Services. Before enabling an integration, granting Claude access or instructing Claude to act on a Third-Party Service, users should ensure they have authority to grant the access and that it complies with applicable terms, policies or confidentiality obligations, and should review the third party's privacy policy. Anthropic also says links to third-party websites do not imply endorsement.
Supporting quotations
Anthropic does not control, and is not responsible for, the data practices of Third-Party Services.
Before enabling an integration, granting Claude access to, or instructing Claude to take actions on a Third-Party Service, you should ensure you have the authority to grant such access and that doing so complies with any applicable terms, policies, or confidentiality obligations.
Before enabling an integration, you should review the third party's privacy policy.
Qualifications & exceptions
The steps are framed as what the user “should” do, not as a condition Anthropic verifies.
Not stated here
The third party's privacy policy is not supplied here, so what it permits is not stated.
The policy does not say whether Anthropic reviews integrations for compliance or what happens if a user lacks authority.
Sharing & Disclosure · Company practice
Data may be shared with authorities and third parties to meet legal, safety and enforcement requirements
Anthropic may share personal data with government authorities, law enforcement or other third parties where, on the information available, it has a good-faith belief that disclosure is required by law or regulation, necessary to protect safety and rights against imminent harm to persons or property, needed to detect, prevent or address fraud or other illegal activity, or needed to enforce its terms or protect the rights, property, security or safety of Anthropic, its users or others.
Supporting quotations
Pursuant to regulatory or legal requirements, safety, rights of others, and to enforce our rights or our terms. We may share personal data with government authorities, law enforcement, or other third parties where, based on the information available to us, we have a good-faith belief that disclosure is reasonably necessary to (i) comply with applicable law, regulation or legal process, including for legal, tax or accounting purposes, or in response to an enforceable governmental request; (ii) prevent serious harm to any person or to property; (iii) detect, prevent, or otherwise address fraud or other illegal activity; or (iv) enforce our terms, or protect the rights, property, security, or safety of Anthropic, our users, or others.
Qualifications & exceptions
The standard is Anthropic's good-faith belief based on the information available to it.
Four alternative grounds are listed, each sufficient on its own.
Not stated here
The policy does not describe notice to the user before such disclosure, or any challenge process.
The policy does not say what transparency reporting Anthropic publishes about these requests.
Sharing & Disclosure · Company practice
Aggregated, de-identified or anonymized research findings may be published
Anthropic may publish aggregated, de-identified or anonymized findings from its research, including research into how the Services are used and AI safety research.
Supporting quotations
Research publications: We may publish aggregated, de-identified, or anonymized findings from our research, including research into how our Services are used and AI safety research.
Not stated here
The policy does not define its aggregation, de-identification or anonymization standard or describe review before publication.
Sharing & Disclosure · Company practice
Other disclosures happen with the individual's permission or direction
Anthropic will otherwise disclose personal data when an individual gives it permission or directs it to disclose the information, including as part of the Services.
Supporting quotations
With an individual's consent: Anthropic will otherwise disclose personal data when an individual gives us permission or directs us to disclose this information, including as a part of our Services.
Qualifications & exceptions
This item covers disclosures outside the other Section 3 categories.
Sharing & Disclosure · Context
A subprocessor list is published separately
The policy points readers to a separately published list of the third parties Anthropic engages to help process personal data.
Supporting quotations
You can find information about the third parties Anthropic engages to help us process personal data
Not stated here
The subprocessor list is a separately linked page and is not supplied here, so the named processors, their services and locations are not stated.
Sharing & Disclosure · Company commitment
Anthropic does not sell personal data but offers an opt-out from targeted advertising sharing
Anthropic states that it does not “sell” personal data as defined by applicable law. Users can opt out of sharing their personal data for targeted advertising that promotes Anthropic's products and services, and Anthropic says it will honor global privacy controls.
Supporting quotations
Sale & targeted Anthropic marketing of its products and services: Anthropic does not “sell” your personal data as that term is defined by applicable laws and regulations. You can opt-out of sharing your personal data for targeted advertising to promote our products and services, and we will honor global privacy controls.
The no-sale statement uses the legal definition of sale, which varies by jurisdiction.
The opt-out covers targeted advertising of Anthropic's own products and services, not third-party ads generally.
Not stated here
The Cookies page linked for more detail is a separate document and its text is not supplied here, so the advertising partners and controls are not described.
The policy does not say how global privacy control signals are detected and applied.
Sharing & Disclosure · Company practice
Korean processing is delegated to the Korea Credit Bureau and Kim & Chang
Anthropic delegates processing of personal data as described on its subprocessor page and to two named delegates in Korea: the Korea Credit Bureau, for fraud and abuse detection and identity verification, and Kim & Chang, for assisting with the domestic representative's duties.
Supporting quotations
Anthropic delegates the processing of personal data as described here and below, and the delegatees may process personal data according to the purpose of the delegation.
Korea Credit Bureau: Fraud and abuse detection and identity verification
Kim & Chang: Assisting with the domestic representative related duties
Qualifications & exceptions
Delegatees may process personal data according to the purpose of the delegation, not for their own purposes as stated.
Not stated here
The linked subprocessor page is not supplied here, so the full delegate list and its terms cannot be described.
The policy does not state what safeguards or contract terms bind these two Korean delegatees.
Sharing & Disclosure · Company practice
Korean data is transferred to Persona in the United States for identity verification and fraud detection
Anthropic delegates processing to affiliates and third parties located overseas and, for Korea, transfers personal data to Persona (privacy@withpersona.com) in the United States. The transferred items are name, birthdate, sex, native-foreigner-code and DI; the recipient's purpose is fraud and abuse detection and identity verification; the retention period is three years; and the stated legal basis is PIPA Article 28-8(1)(iii) delegation.
Supporting quotations
Anthropic delegates the processing of personal data to affiliates and third parties, all of whom are located overseas. In addition, Anthropic transfers personal data overseas as follows:
Recipient’s Name (Contact Information): Persona (privacy@withpersona.com)
Country to which Personal Data to be Transferred: United States
Items of Personal Data to be Transferred: Name, birthdate, sex, native-foreigner-code, and DI (duplication information)
Recipient’s Purpose of Use: Fraud and abuse detection and identity verification
Period of Retention and Use by Recipient: 3 years
Legal Basis for Overseas Transfer: PIPA Article 28-8(1)(iii) delegation
Qualifications & exceptions
Three years is the recipient's retention period, which the policy does not tie to account deletion.
The named transfer is to one recipient; affiliates and other third parties are covered by links instead.
Not stated here
The affiliate and subprocessor links are not supplied here, so the other overseas recipients cannot be identified.
The policy does not explain how the three-year recipient retention interacts with the account-deletion period stated above.
The text of PIPA Article 28-8(1)(iii) is not supplied here.