Privacy Policy

Legal Rights & Agreement Rules · Context

Policy covers the consumer Services and excludes business-customer content

Anthropic says this Privacy Policy explains how it collects, uses, discloses and processes your personal data when you use its website, Claude.ai or other Anthropic products and services, which the policy calls the “Services”. It states that the policy does not apply to content Anthropic processes on behalf of customers of its business offerings, such as Enterprise accounts; that data is instead governed by the customer agreements covering those offerings.

Supporting quotations

This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use our website, Claude.ai, or other Anthropic products and services (the “Services”).

This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings, such as our Enterprise accounts.

Qualifications & exceptions

• Applies to personal data processed when using the website, Claude.ai or other Anthropic products and services the policy calls the Services.
• Excludes content Anthropic processes on behalf of customers of its business offerings, such as Enterprise accounts.

Not stated here

• The customer agreements that govern business-offering content, such as Enterprise accounts, are not supplied here, so their data terms are not described.

Legal Rights & Agreement Rules · Context

This policy text is effective September 10, 2026, with a previous version linked

The policy page states that the text is effective September 10, 2026, and offers a link to a previous version. This analysis covers only the September 10, 2026 text; the earlier version is not supplied here, so changes between versions are not described.

Supporting quotations

Effective September 10, 2026

Previous Version

Qualifications & exceptions

• The stated effective date of this text is September 10, 2026.

Not stated here

• The previous version linked from this page is not supplied here, so differences from earlier policy versions cannot be described.

Data Access & Collection · Context

Model training and third-party data are covered by a separate Non-User Privacy Policy

The policy directs readers to a separate Non-User Privacy Policy for how Anthropic’s large language models are ‘trained’ and for how personal data obtained from third party sources, including data others may submit when using Anthropic’s services, may be used in developing or delivering its products and services. Section 1 repeats the same pointer where it introduces training data.

Supporting quotations

Please see our Non-User Privacy Policy for information on how our large language models are ‘trained’ and how personal data obtained from third party sources, including where others may submit personal data when using our services, may be used when developing or delivering our products and services.

For more information about how we collect and use personal data to develop our language models that power our Services

Qualifications & exceptions

• Covers training of Anthropic’s large language models and personal data obtained from third party sources, including data others submit when using the services.

Not stated here

• The Non-User Privacy Policy is separately linked and its text is not supplied here; this card records the pointer only, not that policy’s terms.

Legal Rights & Agreement Rules · Context

The policy describes privacy rights and points to Section 4 for how to exercise them

The policy states that it describes the reader’s privacy rights and that more information about those rights, and how to exercise them, is set out in Section 4 (“Rights and Choices”). Section 4 appears in this source under that heading.

Supporting quotations

This Privacy Policy also describes your privacy rights.

More information about your rights, and how to exercise them, is set out in Section 4 (“Rights and Choices”).

Qualifications & exceptions

• Further detail on the rights and on exercising them is placed in Section 4 (“Rights and Choices”).

Legal Rights & Agreement Rules · Context

Residents of Canada, Brazil and Korea are directed to regional supplemental disclosures

If you are located in Canada, Brazil or the Republic of Korea, the policy tells you to read the relevant Regional Supplemental Disclosure, which applies to you. This card records that location-based pointer; the disclosures themselves are section 11 of this policy page.

Supporting quotations

If you are located in Canada, Brazil, or the Republic of Korea, please read the relevant Regional Supplemental Disclosure which applies to you.

Qualifications & exceptions

• Applies by location: Canada, Brazil or the Republic of Korea.

Not stated here

• The regional supplemental disclosures are a separate section of this policy page and are not supplied in this card, so their substantive terms are not described here.

Use & Processing · Context

Consumer health data policy applies to Washington and similar states when health apps are integrated

If you are located in Washington or a state with similar consumer health data laws, the policy directs you to read Anthropic’s Consumer Health Data Privacy Policy, which applies if you integrate third party health applications with Claude.

Supporting quotations

If you are located in Washington or a state with similar consumer health data laws, please read our Consumer Health Data Privacy Policy

which applies to you if you integrate third party health applications with Claude.

Qualifications & exceptions

• Conditioned on residence in Washington or a state with similar consumer health data laws.
• Conditioned on integrating third party health applications with Claude.

Not stated here

• The Consumer Health Data Privacy Policy is a separately linked document whose text is not supplied here; this card records the pointer only.

Data Access & Collection · Company practice

Direct collection of identity and contact data at signup and on request

Anthropic collects identifiers — name, email address and phone number — when you sign up for an Anthropic account or ask to receive information about the Services, and it may also collect or generate indirect identifiers such as a user number.

Supporting quotations

Identity and Contact Data: Anthropic collects identifiers, including your name, email address, and phone number when you sign up for an Anthropic account, or to receive information on our Services.

We may also collect or generate indirect identifiers (e.g., “USER12345”).

Qualifications & exceptions

• Collection is tied to signing up for an Anthropic account or requesting information on the Services.
• Indirect identifiers may be collected or generated, not only received.

Charges & Financial Obligations · Company practice

Payment information is collected when you buy access to the Services

Anthropic collects payment information if you choose to purchase access to Anthropic’s Services. The policy does not describe which payment fields are collected or how payment processing is handled.

Supporting quotations

Payment Information: We shall collect your payment information if you choose to purchase access to Anthropic’s Services.

Qualifications & exceptions

• Collection is conditioned on choosing to purchase access to the Services.

Not stated here

• The policy text of this item does not say which payment details are collected, who processes them, or whether full card numbers are retained.

Data Access & Collection · Company practice

Inputs and Outputs from chats, coding sessions and connected services are collected

Anthropic collects what you submit through the Services — chat, coding, agentic sessions where Claude performs multi-step tasks, connected services, and content you upload or integrate — and calls it Inputs, while generated responses and actions are Outputs. Personal data or external content included in Inputs is collected and may be reproduced in Outputs. Depending on permissions granted to Claude, some Outputs can act outside the Services, such as sending communications, modifying files or interacting with third-party services on your behalf.

Supporting quotations

You are able to interact with our Services in a variety of formats, including but not limited to chat, coding, agentic sessions (where Claude performs multi-step tasks or takes actions on your behalf), and connected services.

The content you submit to the Services through these interactions, including via third-party applications, services, and content you choose to upload, integrate or interact with using our Services, are your “Inputs”.

Inputs generate responses and actions (“Outputs”).

If you include personal data or reference external content in your Inputs, we will collect that information and it may be reproduced in your Outputs.

Depending on the permissions you grant Claude, some Outputs may result in actions with effects outside the Services, such as sending communications, modifying files, or interacting with third-party services on your behalf.

Qualifications & exceptions

• Covers interactions through the Services, including third-party applications, services and content you choose to upload, integrate or interact with.
• Actions outside the Services occur only depending on the permissions you grant Claude.

Data Access & Collection · Company practice

Rated feedback can capture the entire related conversation

Anthropic collects Feedback: ideas, suggestions for improvement, and ratings of an Output in response to an Input. If you rate an Output, for example with the thumbs up/thumbs down icon, Anthropic may store the entire related conversation as part of that Feedback. A separate help-centre article is linked for how Feedback is used.

Supporting quotations

We appreciate feedback, including ideas and suggestions for improvement or rating an Output in response to an Input ("Feedback").

If you rate an Output in response to an Input—for example, by using the thumbs up/thumbs down icon—we may store the entire related conversation as part of your Feedback.

Qualifications & exceptions

• Storing the whole related conversation is tied to rating an Output, not to every Feedback submission.

Not stated here

• The linked help-centre article on how Feedback is used is not supplied here; this card records only that the link exists.

Data Access & Collection · Company practice

Research-study participation data is collected and may be combined with account data

If you take part in Anthropic research studies, surveys or interviews, such as Anthropic Interviewer, Anthropic collects your responses, associated account data and related Technical Information, and may combine this with other account data for aggregated analysis.

Supporting quotations

Study Participation Data: If you participate in Anthropic research studies, surveys, or interviews (for example our Anthropic Interviewer), we collect the responses you provide, associated account data, and related Technical Information.

We may combine this data with other data from your account for aggregated analysis.

Qualifications & exceptions

• Collection is conditioned on participating in Anthropic research studies, surveys or interviews.
• Combination with other account data is stated as possible and described as for aggregated analysis.

Not stated here

• The policy text of this item does not define the “related Technical Information” it refers to.

Data Access & Collection · Company practice

Messages to Anthropic, including via the Help-site chatbot, are collected

If you communicate with Anthropic, including through the chatbot on its Help site, Anthropic collects your name, contact information and the contents of any messages you send.

Supporting quotations

Communication Information: If you communicate with us, including via our chatbot on our Help site, we collect your name, contact information, and the contents of any messages you send.

Qualifications & exceptions

• Collection is conditioned on communicating with Anthropic, including via its Help-site chatbot.

Data Access & Collection · Company practice

Age or identity verification can collect ID documents, images, facial templates and the result

Anthropic may ask you to verify your age or identity in certain circumstances. If you choose to do so, the data collected depends on the method: an image of your government-issued identity document and the information on it, such as ID number and date of birth; your image in photo or video form, facial geometry templates, which the policy says may be biometric data in some jurisdictions, and the result of the verification, for example whether your age meets the applicable threshold.

Supporting quotations

In certain circumstances, we may ask you to verify your age or identity.

If you choose to do so, data we will collect includes, depending on the method:

an image of your government-issued identity document and the information appearing on it (such as your ID number and date of birth

facial geometry templates (which may be considered ‘biometric data’ in some jurisdictions

and the result of the verification (for example, whether your age meets the applicable threshold).

Qualifications & exceptions

• Verification arises only in certain circumstances and only if you choose to verify.
• The fields collected depend on the verification method used.
• Facial geometry templates may be considered biometric data only in some jurisdictions.

Not stated here

• This item does not say which verification provider is used, how long verification data is retained, or what happens if you decline to verify.

Content & IP Rights · Restriction or exception

You are responsible for having the rights to the Inputs you provide

When you provide Inputs, including by uploading files, granting Claude access to third-party services, or instructing Claude to retrieve or act on information, you are responsible for ensuring you have the necessary rights, permissions or authority to do so.

Supporting quotations

When you provide Inputs—including by uploading files, granting Claude access to third-party services, or instructing Claude to retrieve or act on information—you are responsible for ensuring you have the necessary rights, permissions, or authority to do so.

Qualifications & exceptions

• Applies to Inputs provided by uploading files, granting Claude access to third-party services, or instructing Claude to retrieve or act on information.

Not stated here

• The policy does not state any consequence for providing Inputs without the necessary rights, permissions or authority.

Data Access & Collection · Company practice

Technical Information is received automatically when the Services are used

When you use the Services, Anthropic also receives certain technical data automatically, collectively called Technical Information, which the following items describe.

Supporting quotations

When you use the Services, we also receive certain technical data automatically (described below, collectively “Technical Information”).

Qualifications & exceptions

• Receipt is automatic and happens when you use the Services.

Not stated here

• “Technical Information” is a collective label for the items that follow; this card does not enumerate them.

Data Access & Collection · Company practice

Device and connection data, including IP and approximate location, is received automatically

Consistent with your device or browser permissions, your device or browser automatically sends Anthropic information about when and how you install, access or use the Services, such as device type, operating system, browser information and web page referers, mobile network, connection information, mobile operator or ISP, time zone, IP address including device location derived from it, identifiers including device and advertising identifiers, and device location.

Supporting quotations

Device and Connection Information: Consistent with your device or browser permissions, your device or browser automatically sends us information about when and how you install, access, or use our Services. This includes information such as your device type, operating system information, browser information and web page referers, mobile network, connection information, mobile operator or internet service provider (ISP), time zone setting, IP address (including information about the location of the device derived from your IP address), identifiers (including device or advertising identifiers, probabilistic identifiers, and other unique personal or online identifiers), and device location.

Qualifications & exceptions

• Subject to your device or browser permissions.
• Location information includes location derived from IP address and device location.

Data Access & Collection · Company practice

Usage information about access, browsing, searches and integrations is collected

Anthropic collects information about your use of the Services, such as dates and times of access, browsing history, search, information about links you click and about third-party applications, services and content you integrate or interact with, pages you view, other information about how you use the Services, and technology on the devices you use to access the Services.

Supporting quotations

Usage Information: We collect information about your use of the Services, such as the dates and times of access, browsing history, search, information about the links you click and about third-party applications, services, and content you integrate or interact with, pages you view, and other information about how you use the Services, and technology on the devices you use to access the Services.

Qualifications & exceptions

• Covers use of the Services and the technology on the devices used to access them.

Data Access & Collection · Company practice

Log and error-state information is collected when the Services perform or fail

Anthropic collects information about how the Services are performing when you use them, including log files. If you or your device experiences an error, it may collect information about the error, when it occurred, the feature being used, the application state at the time, and any communications or content provided at the time of the error.

Supporting quotations

Log and Troubleshooting Information: We collect information about how our Services are performing when you use them.

If you or your device experiences an error, we may collect information about the error, the time the error occurred, the feature being used, the state of the application when the error occurred, and any communications or content provided at the time the error occurred.

Qualifications & exceptions

• Error-related collection is conditioned on you or your device experiencing an error.
• Communications or content are collected only where provided at the time of the error.

Data Access & Collection · Company practice

Cookies serve operations, personalization, marketing and analytics with service providers

Anthropic and its service providers use cookies, scripts or similar technologies, called Cookies, to manage the Services and collect information about you and your use of them. The stated purposes are recognizing you, customizing or personalizing your experience, marketing additional products or services to you, and analyzing use of the Services to make them safer and more useful. The policy points to a separate Cookie Policy for details and opt-out controls.

Supporting quotations

Cookies & Similar Technologies: We and our service providers use cookies, scripts, or similar technologies (“Cookies”) to manage the Services and to collect information about you and your use of the Services.

These technologies help us to recognize you, customize or personalize your experience, market additional products or services to you, and analyze the use of our Services to make them safer and more useful to you.

For more details about how we use these technologies, and your opt-out controls and other options,

Qualifications & exceptions

• Cookies are used by Anthropic and its service providers, not by Anthropic alone.
• Marketing additional products or services appears among the stated purposes.

Not stated here

• The linked Cookie Policy, which describes the technologies in detail and the opt-out controls, is not supplied here; this card records the pointer only.

Data Access & Collection · Company practice

Models are trained on public internet information and commercially acquired datasets

Anthropic obtains personal data from third party sources to train its models, naming publicly available information from the Internet and datasets obtained through commercial agreements with third party businesses among the sources.

Supporting quotations

Anthropic obtains personal data from third party sources in order to train our models. Specifically, we train our models using data from the following sources:

Publicly available information via the Internet

Datasets that we obtain through commercial agreements with third party businesses

Qualifications & exceptions

• The Internet source is limited to publicly available information.
• Commercial datasets come through agreements with third party businesses.

Not stated here

• The commercial agreements and the datasets they cover are not supplied, so their terms and provenance are not described.

Data Access & Collection · Company practice

User and crowd-worker data trains models unless users opt out

Anthropic trains its models on data that users or crowd workers provide, including Inputs and Outputs from the Services, unless users opt out.

Supporting quotations

Data that our users or crowd workers provide, including Inputs and Outputs from our Services (unless users opt out)

Qualifications & exceptions

• Covers Inputs and Outputs from the Services as well as data from crowd workers.
• Excludes user data where the user has opted out.

Not stated here

• This item does not say how the opt-out is recorded or whether it applies to data already collected; the opt-out mechanism is described in the paragraph on training use in Section 2.

Data Access & Collection · Company practice

Feedback, safety-flagged materials and internally generated data are training sources

Anthropic also trains its models on Feedback that users explicitly provide about the Services, on materials flagged for safety, security or policy review, and on data it generates internally.

Supporting quotations

Feedback that users explicitly provide about our Services

Materials flagged for safety, security, or policy review

Data that we generate internally

Qualifications & exceptions

• Feedback counts as a training source where users explicitly provide it about the Services.
• The flagged-materials source covers safety, security or policy review flags.
• The policy states the internal-data source without describing what is generated.

Not stated here

• The policy does not describe what internally generated data contains or how flagged materials are selected.
• The standards for flagging materials for safety, security or policy review are not supplied here, so the review thresholds applied to training data are not described.

Data Access & Collection · Context

Training collection and use are detailed in the separate Non-User Privacy Policy

The policy points readers to Anthropic’s separate Non-User Privacy Policy for more information about how personal data is collected and used to develop the language models that power the Services, the steps taken to minimize privacy impact during training, and the choices available. The same pointer appears in the introduction to the policy.

Supporting quotations

For more information about how we collect and use personal data to develop our language models that power our Services, the steps we take to minimize the privacy impact on individuals through the training process, and your choices with respect to that information, please see our separate

Please see our Non-User Privacy Policy for information on how our large language models are ‘trained’ and how personal data obtained from third party sources, including where others may submit personal data when using our services, may be used when developing or delivering our products and services.

Qualifications & exceptions

• Covers model training, privacy-impact minimization during training, and related choices.

Not stated here

• The Non-User Privacy Policy is a separately linked document and its text is not supplied here; this card records the pointer only.

Use & Processing · Company practice

Providing and maintaining account products and services governed by the Terms of Service

Anthropic uses personal data to provide, maintain and facilitate the products and services offered with respect to your Anthropic account, which are governed by its Terms of Service.

Supporting quotations

To provide, maintain and facilitate any products and services offered to you with respect to your Anthropic account, which are governed by our Terms of Service;

Use & Processing · Company practice

Providing optional services and features that enhance platform functionality

Anthropic uses personal data to provide, maintain and facilitate optional services and features that enhance platform functionality and user experience.

Supporting quotations

To provide, maintain and facilitate optional services and features that enhance platform functionality and user experience;

Use & Processing · Company practice

Service updates, communications and tailored recommendations

Anthropic uses personal data to provide service updates and communications, and to make tailored recommendations about its Services that may be of interest to you.

Supporting quotations

To provide you with service updates, communications, and to provide tailored recommendations about our Services that may be of interest to you;

Use & Processing · Company practice

Creating and administering the Anthropic account

Anthropic uses personal data to create and administer your Anthropic account.

Supporting quotations

To create and administer your Anthropic account;

Use & Processing · Company practice

Facilitating payments for Anthropic products and services

Anthropic uses personal data to facilitate payments for products and services provided by Anthropic.

Supporting quotations

To facilitate payments for products and services provided by Anthropic;

Use & Processing · Company practice

Fraud prevention, safety protection and legal-obligation purposes

Anthropic uses personal data to prevent and investigate fraud, abuse and violations of its Usage Policy, unlawful or criminal activity, and unauthorized access to or use of personal data or its systems and networks; to protect its rights, the rights of others and personal safety; and to meet legal, governmental and institutional policy obligations.

Supporting quotations

To prevent and investigate fraud, abuse, and violations of our Usage Policy, unlawful or criminal activity, unauthorized access to or use of personal data or Anthropic systems and networks, to protect our rights and the rights of others, to protect your safety or that of any other person, and to meet legal, governmental and institutional policy obligations;

Not stated here

• The Usage Policy is a separately linked document and its text is not supplied here, so the rules whose violation this purpose addresses are not described.

Use & Processing · Company practice

Investigating and resolving disputes

Anthropic uses personal data to investigate and resolve disputes.

Supporting quotations

To investigate and resolve disputes;

Use & Processing · Company practice

Investigating and resolving security issues

Anthropic uses personal data to investigate and resolve security issues.

Supporting quotations

To investigate and resolve security issues;

Use & Processing · Company practice

Debugging and repairing errors that impair functionality

Anthropic uses personal data to debug and to identify and repair errors that impair existing functionality.

Supporting quotations

To debug and to identify and repair errors that impair existing functionality;

Use & Processing · Company practice

Improving the Services and conducting AI research, including model training

Anthropic uses personal data to improve the Services and conduct research, including training its models and broader research on AI-related topics such as the societal impacts of AI.

Supporting quotations

To improve the Services and conduct research, including training our models and conducting broader research on AI-related topics such as the societal impacts of AI; and

Use & Processing · Company practice

Enforcing the Terms of Service and similar agreements

Anthropic uses personal data to enforce its Terms of Service and similar terms and agreements, including its Usage Policy.

Supporting quotations

To enforce our Terms of Service and similar terms and agreements,

Not stated here

• The Terms of Service and the Usage Policy are separately linked documents and their text is not supplied here, so the terms being enforced are not described.

Inference & Profiling · Company practice

Inputs and Outputs train models unless you opt out, with two exceptions after opting out

Anthropic may use Inputs and Outputs to train and improve Anthropic AI models unless you opt out through account settings. Even after opting out, it will use Inputs and Outputs for model improvement when conversations are flagged for safety review to improve detection of harmful content, enforce policies or advance AI safety research, or when you have explicitly reported the materials, for example through feedback mechanisms.

Supporting quotations

We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings.

Even if you opt-out, we will use Inputs and Outputs for model improvement when: (i) your conversations are flagged for safety review to improve our ability to detect harmful content, enforce our policies, or advance AI safety research, or (ii) you've explicitly reported the materials to us (for example via our feedback mechanisms).

Qualifications & exceptions

• Training use of Inputs and Outputs is the default unless you opt out through account settings.
• The opt-out is not absolute: safety-flagged conversations and materials you explicitly report remain available for model improvement.

Not stated here

• The policy does not say whether opting out affects models already trained, how opt-out status is verified, or which account settings control it.

Legal Rights & Agreement Rules · Context

Section 10 holds the legal bases for the processing described in Section 2

The policy directs readers to Section 10 for details of its legal bases for processing personal data. The Section 10 table appears in this source and is read here, but its rows are decided with the legal-bases section rather than with this uses section.

Supporting quotations

Please see Section 10 below for details of our legal bases for processing your personal data.

Qualifications & exceptions

• Refers to Section 10 of this policy for the legal bases of the processing described.

Sharing & Disclosure · Company practice

Personal data is disclosed to and received from listed third-party categories for policy purposes

Anthropic states that it will disclose personal data to, and receive personal data from, the third-party categories listed in Section 3, for the purposes explained in the Policy.

Supporting quotations

Anthropic will disclose personal data to, or receive personal data from, the following categories of third parties for the purposes explained in this Policy:

Qualifications & exceptions

• Purposes are those explained in the Policy; Section 3 does not restate them.

Sharing & Disclosure · Company practice

Personal data is disclosed between and among affiliates and related entities

Anthropic discloses the categories of personal data described earlier in the Policy between and among its affiliates and related entities.

Supporting quotations

Affiliates & corporate partners: Anthropic discloses the categories of personal data described above between and among its affiliates and related entities.

Not stated here

• The policy does not identify the affiliates and related entities or their locations in this item.

Sharing & Disclosure · Company practice

Service providers and business partners receive data for listed business purposes

Anthropic may receive and disclose the categories of personal data described earlier with service providers and business partners for business purposes: website and data hosting, compliance with industry standards, research, auditing, data processing, investigating and resolving safety and security issues, preventing and investigating fraud, abuse and Usage Policy violations, and providing the Services.

Supporting quotations

Service providers & business partners: Anthropic may receive and disclose the categories of personal data described above with service providers and business partners for a variety of business purposes, including website and data hosting, ensuring compliance with industry standards, research, auditing, data processing, investigating and resolving safety and security issues, preventing and investigating fraud, abuse, and violations of our Usage Policy, and providing you with the Services.

Qualifications & exceptions

• The list of purposes is introduced with “including”, so it may not be exhaustive.

Not stated here

• The policy does not name the individual service providers here; the subprocessor list is linked separately at the end of Section 3.

Sharing & Disclosure · Company practice

Work email accounts may be linked to an employer's enterprise account

If a user uses an email address owned by an employer or another organization, the account may be linked to that organization’s enterprise account with Anthropic, as described in the Consumer Terms of Service.

Supporting quotations

Your Organization and Administrator: If you use an email address owned by your employer or another organization, your account may be linked to the organization’s enterprise account with us, as described in our Consumer Terms of Service.

Qualifications & exceptions

• Linkage is conditional on using an organization-owned email address and described as possible (“may be linked”).

Not stated here

• The Consumer Terms of Service is referred to but not supplied here, so what an administrator can see or control is not stated.
• The policy does not say what data becomes visible to the organization or its administrator.

Sharing & Disclosure · Company practice

Personal data is transferred as part of mergers, transactions or bankruptcy

If Anthropic is involved in a merger, corporate transaction, bankruptcy or other situation involving the transfer of business assets, it will receive or disclose personal data as part of those corporate transactions.

Supporting quotations

As part of a significant corporate event: If Anthropic is involved in a merger, corporate transaction, bankruptcy, or other situation involving the transfer of business assets, Anthropic will receive or disclose your personal data as part of these corporate transactions.

Not stated here

• The policy does not describe notice, choice or successor obligations in a corporate event.

Sharing & Disclosure · Company practice

Connectors, plugins, webhooks and APIs let users connect third-party services to Claude

The Services allow users to connect to and interact with third-party applications, services and content (“Third-Party Services”) through integrations they enable, such as Connectors, plugins, webhooks and external APIs.

Supporting quotations

Third-Party Websites, Integrations, and Services: Our Services allow you to connect to and interact with third-party applications, services, and content (“Third-Party Services”) via the Services and through integrations you enable, such as Connectors, plugins, webhooks, and external APIs.

Qualifications & exceptions

• Integrations are enabled by the user.

Sharing & Disclosure · Company practice

Claude may send Inputs, Outputs and instructions to Third-Party Services, which process them under their own policies

Claude may send Inputs, Outputs and instructions to Third-Party Services to perform actions for the user, such as reading files, sending messages or retrieving information. The Third-Party Service receives that data directly and processes it under its own privacy policy.

Supporting quotations

Claude may send your Inputs, Outputs, and instructions to Third-Party Services to perform actions on your behalf (such as reading files, sending messages, or retrieving information). The Third-Party Service receives this data directly and processes it according to its own privacy policy.

Inputs and Outputs: You are able to interact with our Services in a variety of formats, including but not limited to chat, coding, agentic sessions (where Claude performs multi-step tasks or takes actions on your behalf), and connected services. The content you submit to the Services through these interactions, including via third-party applications, services, and content you choose to upload, integrate or interact with using our Services, are your “Inputs”. Inputs generate responses and actions (“Outputs”).

Qualifications & exceptions

• Disclosure happens only when the user's setup lets Claude act on that service; sending is described as possible (“may”).

Not stated here

• Each Third-Party Service's privacy policy is not supplied here, so what that recipient does with the data is not stated.
• The policy does not say what Anthropic contractually requires of Third-Party Services.

Data Access & Collection · Company practice

Content retrieved from Third-Party Services becomes part of the user's Inputs

Claude may retrieve content and data from Third-Party Services the user interacts with, and that data becomes part of the user's Inputs.

Supporting quotations

Claude may retrieve content and data from Third-Party Services you interact with. This data becomes part of your Inputs.

Retention & Deletion · Company practice

Integrations may keep access to Third-Party Services until the user disables them

Some integrations or features may allow Claude to access Third-Party Services on an ongoing basis until the user disables the feature or disconnects the integration in the settings.

Supporting quotations

Some integrations or features may allow Claude to access Third-Party Services on an ongoing basis until you disable the feature or disconnect the integration in your settings.

Qualifications & exceptions

• Access ends when the user disables the feature or disconnects the integration.

Sharing & Disclosure · Restriction or exception

Anthropic does not control Third-Party Services and users must confirm authority before enabling integrations

Anthropic states it does not control and is not responsible for the data practices of Third-Party Services. Before enabling an integration, granting Claude access or instructing Claude to act on a Third-Party Service, users should ensure they have authority to grant the access and that it complies with applicable terms, policies or confidentiality obligations, and should review the third party's privacy policy. Anthropic also says links to third-party websites do not imply endorsement.

Supporting quotations

Anthropic does not control, and is not responsible for, the data practices of Third-Party Services.

Before enabling an integration, granting Claude access to, or instructing Claude to take actions on a Third-Party Service, you should ensure you have the authority to grant such access and that doing so complies with any applicable terms, policies, or confidentiality obligations.

Before enabling an integration, you should review the third party's privacy policy.

Qualifications & exceptions

• The steps are framed as what the user “should” do, not as a condition Anthropic verifies.

Not stated here

• The third party's privacy policy is not supplied here, so what it permits is not stated.
• The policy does not say whether Anthropic reviews integrations for compliance or what happens if a user lacks authority.

Sharing & Disclosure · Company practice

Data may be shared with authorities and third parties to meet legal, safety and enforcement requirements

Anthropic may share personal data with government authorities, law enforcement or other third parties where, on the information available, it has a good-faith belief that disclosure is required by law or regulation, necessary to protect safety and rights against imminent harm to persons or property, needed to detect, prevent or address fraud or other illegal activity, or needed to enforce its terms or protect the rights, property, security or safety of Anthropic, its users or others.

Supporting quotations

Pursuant to regulatory or legal requirements, safety, rights of others, and to enforce our rights or our terms. We may share personal data with government authorities, law enforcement, or other third parties where, based on the information available to us, we have a good-faith belief that disclosure is reasonably necessary to (i) comply with applicable law, regulation or legal process, including for legal, tax or accounting purposes, or in response to an enforceable governmental request; (ii) prevent serious harm to any person or to property; (iii) detect, prevent, or otherwise address fraud or other illegal activity; or (iv) enforce our terms, or protect the rights, property, security, or safety of Anthropic, our users, or others.

Qualifications & exceptions

• The standard is Anthropic's good-faith belief based on the information available to it.
• Four alternative grounds are listed, each sufficient on its own.

Not stated here

• The policy does not describe notice to the user before such disclosure, or any challenge process.
• The policy does not say what transparency reporting Anthropic publishes about these requests.

Sharing & Disclosure · Company practice

Aggregated, de-identified or anonymized research findings may be published

Anthropic may publish aggregated, de-identified or anonymized findings from its research, including research into how the Services are used and AI safety research.

Supporting quotations

Research publications: We may publish aggregated, de-identified, or anonymized findings from our research, including research into how our Services are used and AI safety research.

Not stated here

• The policy does not define its aggregation, de-identification or anonymization standard or describe review before publication.

Sharing & Disclosure · Company practice

Other disclosures happen with the individual's permission or direction

Anthropic will otherwise disclose personal data when an individual gives it permission or directs it to disclose the information, including as part of the Services.

Supporting quotations

With an individual's consent: Anthropic will otherwise disclose personal data when an individual gives us permission or directs us to disclose this information, including as a part of our Services.

Qualifications & exceptions

• This item covers disclosures outside the other Section 3 categories.

Sharing & Disclosure · Context

A subprocessor list is published separately

The policy points readers to a separately published list of the third parties Anthropic engages to help process personal data.

Supporting quotations

You can find information about the third parties Anthropic engages to help us process personal data

Not stated here

• The subprocessor list is a separately linked page and is not supplied here, so the named processors, their services and locations are not stated.

Legal Rights & Agreement Rules · Restriction or exception

Rights depend on residence and law, are limited, and training-dataset requests are complex

Anthropic says that rights depend on where the reader lives and on the laws of that country; the rights are limited, and the processes for acting on requests about the training dataset are complex. Anthropic may also decline a request where it has a lawful reason, and says it strives to protect personal data and comply with applicable privacy laws.

Supporting quotations

Depending on where you live and the laws that apply in your country of residence, you may enjoy certain rights regarding your personal data, as described further below. However, please be aware that these rights are limited, and that the processes by which we may need to action your requests regarding our training dataset are complex.

We may also decline a request if we have a lawful reason for doing so.

Qualifications & exceptions

• Rights are contingent on the law of the reader's country of residence.

Not stated here

• The policy does not say how a training-dataset request is handled or what makes one complex.

Legal Rights & Agreement Rules · Procedure

Requests go to privacy@anthropic.com and may require identity verification and authorization evidence

A user or an authorized agent may submit a rights request by contacting Anthropic at privacy@anthropic.com. Anthropic may then verify the request by asking for information sufficient to confirm identity, such as email address or billing details. Where a third-party representative submits for a data subject, Anthropic requires evidence of authorization.

Supporting quotations

To exercise your rights, you or an authorized agent may submit a request by contacting us.

After we receive your request, we may verify it by requesting information sufficient to confirm your identity (e.g. email address, billing details).

Where a third party representative submits a request on behalf of a data subject, we require evidence of authorization to act on behalf of the data subject.

Verification Data: In certain circumstances, we may ask you to verify your age or identity. If you choose to do so, data we will collect includes, depending on the method: an image of your government-issued identity document and the information appearing on it (such as your ID number and date of birth); your image in photo or video form, facial geometry templates (which may be considered ‘biometric data’ in some jurisdictions); and the result of the verification (for example, whether your age meets the applicable threshold).

Qualifications & exceptions

• Verification is described as something Anthropic may do, not something it always does.

Not stated here

• The policy does not say how long verification material is kept or what happens if verification fails.
• The policy does not specify what counts as acceptable evidence of authorization for an agent.

Legal Rights & Agreement Rules · Procedure

One month under the GDPR, extendable by two months, with an appeal route and no discrimination

Anthropic responds within the period required by the applicable data protection law. Where the EU or UK GDPR applies it responds within one calendar month of a verifiable request, and may extend that by up to two further months where the request is complex or the user has made several requests in a short time. Users may appeal a denial by emailing privacy@anthropic.com, and Anthropic says it will not discriminate against people for exercising privacy rights.

Supporting quotations

We will respond to your request within the period required by the data protection law that applies to you. For example, where the EU GDPR or UK GDPR applies, we will respond within one calendar month of receiving a verifiable request,

and where your request is complex or you have made a number of requests within a short timeframe, we may extend that period by up to a further two months.

You may also have the right to appeal requests that we deny by emailing privacy@anthropic.com.

Anthropic will not discriminate based on the exercising of privacy rights you may have.

Qualifications & exceptions

• The one-month and two-month figures are examples for EU and UK GDPR; other laws set the period that then applies.
• The extension applies to complex requests or several requests in a short timeframe.

Not stated here

• The policy does not say how an extension is notified, or what the appeal decision process and timing are.

Legal Rights & Agreement Rules · User right or choice

Right to know what personal data is processed and who receives it

Depending on applicable law, users have a right to know what personal data Anthropic processes about them, including the categories of personal data, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom it is disclosed.

Supporting quotations

Right to know: the right to know what personal data Anthropic processes about you, including the categories of personal data, the categories of sources from which it is collected, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it.

Qualifications & exceptions

• The right is stated as one the reader may enjoy depending on the law that applies.

Legal Rights & Agreement Rules · User right or choice

Right to a copy of personal data and, in some cases, to port it

Users have a right to request a copy of the personal data Anthropic processes about them, subject to exceptions and conditions, and in certain cases and subject to applicable law a right to port their information.

Supporting quotations

Access & data portability: the right to request a copy of the personal data Anthropic processes about you, subject to certain exceptions and conditions. In certain cases and subject to applicable law, you have the right to port your information.

Qualifications & exceptions

• Both the access copy and portability are subject to exceptions, conditions and applicable law.

Retention & Deletion · User right or choice

Right to deletion, plus immediate conversation deletion with 30-day back-end removal

Users have a right to request deletion of personal data collected from them when they use the Services, subject to exceptions. Separately, users can delete individual conversations, which are removed immediately from conversation history and automatically deleted from the back end within 30 days.

Supporting quotations

Deletion: the right to request that we delete personal data collected from you when you use our Services, subject to certain exceptions.

You also are able to delete individual conversations, which will be removed immediately from your conversation history and automatically deleted from our back-end within 30 days.

Qualifications & exceptions

• The deletion right is subject to exceptions that this item does not list.
• Conversation deletion is a separate tool with its own timing, not the same as a rights request.

Not stated here

• The retention article linked for more detail is a separate page and its text is not supplied here, so the full retention schedule is not stated.
• The policy does not say what happens to copies already used for training when a conversation is deleted.

Legal Rights & Agreement Rules · User right or choice

Right to correction, with no guarantee that Outputs are factually accurate

Users have a right to request correction of inaccurate personal data Anthropic retains, subject to exceptions. Anthropic says it cannot guarantee the factual accuracy of Outputs; where Outputs contain factually inaccurate personal data about the user, a correction request can be submitted and Anthropic will make a reasonable effort to correct it, but technical complexity may make correction impossible.

Supporting quotations

Correction: the right to request that we correct inaccurate personal data Anthropic retains about you, subject to certain exceptions. Please note that we cannot guarantee the factual accuracy of Outputs. If Outputs contain factually inaccurate personal data relating to you, you can submit a correction request and we will make a reasonable effort to correct this information—but due to the technical complexity of our large language models, it may not always be possible for us to do so.

Qualifications & exceptions

• Correction of Output-derived data is a reasonable-effort undertaking, not a guaranteed outcome.

Not stated here

• The policy does not say what happens to a correction that cannot be implemented in model Outputs.

Legal Rights & Agreement Rules · User right or choice

Right to object, including to profiling, with a direct-marketing opt-out

Users have a right to object to processing of their personal data, including profiling on grounds of public or legitimate interest. Where that right applies, Anthropic will stop processing unless it demonstrates compelling legitimate grounds that override the user's interests, rights and freedoms, or grounds relating to legal claims. For direct marketing, users can object and opt out using the unsubscribe link in those messages.

Supporting quotations

Objection: the right to object to processing of your personal data, including profiling conducted on grounds of public or legitimate interest. In places where such a right applies, we will no longer process the personal data in case of such objection unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise or defense of legal claims.

If we use your information for direct marketing, you can object and opt out of future direct marketing messages using the unsubscribe link in such communications.

Qualifications & exceptions

• Objection can be overridden by compelling legitimate grounds or legal-claim needs.

Not stated here

• The policy does not describe how an objection is assessed or how the user is told the outcome.

Legal Rights & Agreement Rules · User right or choice

Right to restrict processing in certain circumstances

Users have a right to restrict Anthropic's processing of their personal data in certain circumstances; the policy does not list those circumstances in this item.

Supporting quotations

Restriction: the right to restrict our processing of your personal data in certain circumstances.

Qualifications & exceptions

• The circumstances are left unstated here.

Not stated here

• The policy does not say how a restriction request is implemented or what happens to processing during it.

Legal Rights & Agreement Rules · User right or choice

Consent can be withdrawn, for example by disconnecting a health app integration

Where processing is based on consent, users have a right to withdraw it. The policy gives the example of disconnecting a health app integration and withdrawing consent in settings, and says withdrawal does not affect the lawfulness of earlier processing based on consent.

Supporting quotations

Withdrawal of consent: Where Anthropic’s processing of your personal data is based on consent, you have the right to withdraw your consent. For example, you can disconnect your health app integration and withdraw your consent in your settings. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Qualifications & exceptions

• Withdrawal is prospective: earlier consent-based processing remains lawful.

Inference & Profiling · Company commitment

No decision-making based solely on automated processing with legal or similarly significant effects

Anthropic states that it does not engage in decision-making based solely on automated processing or profiling that produces a legal effect or significantly affects the person in a similar way, such as significantly affecting financial circumstances or access to essential goods or services.

Supporting quotations

Automated decision-making: Anthropic does not engage in decision making based solely on automated processing or profiling in a manner which produces a legal effect (i.e., impacts your legal rights) or significantly affects you in a similar way (e.g., significantly affects your financial circumstances or ability to access essential goods or services).

Qualifications & exceptions

• The commitment is framed by the legal standard: solely automated decisions with legal or similarly significant effects.

Not stated here

• The policy does not describe what automated review exists that falls short of that standard, or any human review process.

Sharing & Disclosure · Company commitment

Anthropic does not sell personal data but offers an opt-out from targeted advertising sharing

Anthropic states that it does not “sell” personal data as defined by applicable law. Users can opt out of sharing their personal data for targeted advertising that promotes Anthropic's products and services, and Anthropic says it will honor global privacy controls.

Supporting quotations

Sale & targeted Anthropic marketing of its products and services: Anthropic does not “sell” your personal data as that term is defined by applicable laws and regulations. You can opt-out of sharing your personal data for targeted advertising to promote our products and services, and we will honor global privacy controls.

To learn more, click here.

Qualifications & exceptions

• The no-sale statement uses the legal definition of sale, which varies by jurisdiction.
• The opt-out covers targeted advertising of Anthropic's own products and services, not third-party ads generally.

Not stated here

• The Cookies page linked for more detail is a separate document and its text is not supplied here, so the advertising partners and controls are not described.
• The policy does not say how global privacy control signals are detected and applied.

Account & Service Control · Company practice

Data-management tools are collected in Privacy Settings

Anthropic points users to a variety of tools for managing their data, available in the Privacy Settings of their account.

Supporting quotations

Anthropic gives you access to a variety of tools to help you manage your data.

You can access these in your Privacy Settings.

Not stated here

• The policy does not list the tools in this paragraph; they are only reachable through the settings page.

Legal Rights & Agreement Rules · Company practice

Personal data is transferred to the US and other countries for the Policy's purposes

Anthropic describes itself as a global company and states that, when a user accesses the Services, personal data is transferred to its servers in the US or to other countries outside the EEA and the UK, for the purposes outlined in Section 2, such as providing the Service, training models or conducting research. The transfer may be a direct provision to Anthropic or a transfer it or a third party makes, and the Trust Center is offered for details about affiliates and third parties and their locations.

Supporting quotations

Anthropic is a global company, and when you access our Services, your personal data is transferred to our servers in the US, or to other countries outside the European Economic Area (“EEA”) and the UK for the purposes outlined in Section 2 of this Privacy Policy, for example to provide you with the Service, or to train our models, or to conduct research.

This may be a direct provision of your personal data to us, or a transfer that we or a third party make.

You can find more details about the affiliates and third parties we transfer data to, including their locations, in our Trust Center.

Anthropic delegates the processing of personal data to affiliates and third parties, all of whom are located overseas. In addition, Anthropic transfers personal data overseas as follows:

Qualifications & exceptions

• The listed destinations and examples are not exhaustive; purposes are those of Section 2.

Not stated here

• The Trust Center pages for affiliates and third parties are separately linked and not supplied here, so the full recipient list and locations are not stated.

Legal Rights & Agreement Rules · Company practice

Transfers outside the EEA or UK rely on adequacy decisions or standard contractual clauses

For transfers outside the EEA or the UK, Anthropic says it ensures an adequate level of data protection by relying on the mechanisms it then lists.

Supporting quotations

Where Anthropic transfers information outside the EEA or the UK, we ensure it benefits from an adequate level of data protection by relying on:

Qualifications & exceptions

• The mechanisms are exhaustive as presented: the list follows a colon with no further catch-all mechanism in this paragraph.

Legal Rights & Agreement Rules · Company practice

Adequacy decisions support transfers to recognized countries

Anthropic relies on European Commission adequacy decisions under Article 45 GDPR, or equivalent decisions under other laws, for transfers to countries recognized as offering an adequate level of data protection, and refers readers to the EU and UK adequacy lists.

Supporting quotations

Adequacy decisions: These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) where they recognize that a country outside of the EEA offers an adequate level of data protection.

We transfer your information as described in “Collection of Personal Data” to some countries with adequacy decisions, such as the countries with EU adequacy decisions listed here and countries with UK adequacy decisions listed

Not stated here

• The EU and UK adequacy lists are separately published and not supplied here, so which countries currently qualify is not stated.
• The policy does not say which of Anthropic's recipient countries rely on this mechanism.

Legal Rights & Agreement Rules · Company practice

Standard contractual clauses cover transfers to countries without an adequacy decision

Anthropic relies on European Commission standard contractual clauses under Article 46 GDPR, and their UK and Swiss equivalents, to transfer information to certain affiliates and third parties in countries without an adequacy decision. For Brazil, it says it relies on ANPD-approved standard contractual clauses where required and where no adequacy decision covers the transfer.

Supporting quotations

Standard contractual clauses: The European Commission has approved contractual clauses under Article 46 GDPR that allows companies in the EEA to transfer data outside the EEA. These (and their approved equivalent for the UK and Switzerland) are called standard contractual clauses.

We rely on standard contractual clauses to transfer information as described in “Collection of Personal Data” to certain affiliates and third parties in countries without an adequacy decision.

In the case of Brazil, we will rely on standard contractual clauses (SCCs) for our data transfers where required and in instances where they are not covered by an adequacy decision. These SCCs have been approved by the Brazilian Data Protection Authority (ANPD), which is the "competent supervisory authority" for these transfers, as governed by Brazilian Data Protection Laws.

Qualifications & exceptions

• The clauses cover affiliates and third parties in countries without an adequacy decision.

Not stated here

• The clause text and the ANPD resolution are separately published and not supplied here, so the contractual terms are not stated.
• The policy does not say which entities have signed the clauses or how a user can obtain a copy.

Legal Rights & Agreement Rules · Restriction or exception

Some transfers rely on statutory derogations, with a contact route for questions

In certain situations Anthropic relies on derogations provided for under applicable data protection law to transfer information to a third country, and invites questions about international transfers or the safeguards it applies to privacy@anthropic.com.

Supporting quotations

In certain situations, we rely on derogations provided for under applicable data protection law to transfer information to a third country.

Qualifications & exceptions

• The derogations are not identified in this paragraph.

Not stated here

• The policy does not say which derogations are used or in what situations.

Retention & Deletion · Company practice

Data is kept as long as reasonably necessary for the Policy's purposes and criteria

Anthropic retains personal data for as long as reasonably necessary for the purposes and criteria outlined in the Policy, which it says are explained further in its privacy center.

Supporting quotations

Anthropic retains your personal data for as long as reasonably necessary for the purposes and criteria outlined in this Privacy Policy and explained further in our privacy center

Qualifications & exceptions

• Retention is tied to purposes and criteria rather than to fixed periods in this paragraph.

Not stated here

• The privacy center article with the retention schedule is separately linked and not supplied here, so the periods for each data type are not stated.

Retention & Deletion · Company practice

Data no longer required is destroyed, deleted, erased or anonymized with service providers

When collected personal data is no longer required, Anthropic and its service providers carry out the procedures needed to destroy, delete, erase or convert it into an anonymous form, as permitted or required by applicable law.

Supporting quotations

When the personal data collected is no longer required by us, we and our service providers will perform the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form as permitted or required under applicable laws.

Not stated here

• The policy does not say how long these procedures take or how their completion is verified.

Use & Processing · Company practice

Aggregation and de-identification are used as data minimization, including for analytics and training

Anthropic says it applies aggregation and de-identification techniques where appropriate as part of its data minimization practices, and may process personal data in aggregated or de-identified form to analyze and improve the Services, conduct analytics, conduct research, study user behavior and train its AI models as permitted under applicable law.

Supporting quotations

We apply aggregation and de-identification techniques where appropriate as part of our data minimization practices.

For example, we may process personal data in an aggregated or de-identified form to analyze and improve the effectiveness of our Services including to conduct analytics, conduct research, study user behavior, and train our AI models as permitted under applicable laws.

Qualifications & exceptions

• Techniques are applied “where appropriate”; the paragraph gives examples rather than an exhaustive list.

Not stated here

• The policy does not define the aggregation or de-identification standard used.

Inference & Profiling · Company practice

Feedback used for training has Inputs and Outputs disassociated from the user ID

When a user submits Feedback, Anthropic disassociates the Inputs and Outputs from the user's ID before using them to train and improve its models.

Supporting quotations

When you submit Feedback, we disassociate Inputs and Outputs from your user ID to use them for training and improving our models.

Qualifications & exceptions

• Disassociation applies to Feedback-triggered training use.

Not stated here

• The policy does not describe how disassociation is implemented or whether it is reversible.

Inference & Profiling · Company practice

Safety-flagged content is disassociated for classifier training but may be re-identified to enforce policies

Where systems flag Inputs or Outputs for harmful content or for potentially violating Anthropic's policies, the content is disassociated from the user ID and used to train trust and safety internal classification and generative models. Anthropic says it may re-identify that content to enforce the Terms of Service or Usage Policy with the responsible user where necessary.

Supporting quotations

If our systems flag Inputs or Outputs for harmful content or for potentially violating our policies, we disassociate the content from your user ID to train our trust and safety internal classification and generative models. However, we may re-identify the Inputs or Outputs to enforce our Terms of Service or Usage Policy with the responsible user if necessary.

Qualifications & exceptions

• De-identification for safety training is qualified by a re-identification route for enforcement.
• Re-identification is described as possible where necessary, not routine.

Not stated here

• The Terms of Service and Usage Policy are separate documents and their text is not supplied here, so the enforcement grounds are not described.
• The policy does not say who authorizes re-identification or how it is logged.

Use & Processing · Company practice

Aggregated general usage data is analyzed to improve user experience and does not identify individuals

To improve user experience, Anthropic may analyze and aggregate general user behavior and usage data, and states that this information does not identify individual users.

Supporting quotations

To improve user experience, we may analyze and aggregate general user behavior and usage data. This information does not identify individual users.

Not stated here

• The policy does not describe how the non-identification claim is tested or what data is included.

Use & Processing · Company commitment

De-identified information is kept de-identified and not re-identified except as law permits

Where data is de-identified, Anthropic says it will maintain and use the information in de-identified form and will not attempt to re-identify it, except as permitted by law.

Supporting quotations

Where data is de-identified, Anthropic will maintain and use this information in its de-identified form, and will not attempt to re-identify such information, except as permitted by law.

Qualifications & exceptions

• The commitment has a legal-permission exception.

Not stated here

• The policy does not list the circumstances in which the law permits re-identification.

Security & Safeguards · Company practice

Technical and organizational security measures protect personal data

Anthropic says it implements appropriate technical and organizational security measures designed to protect personal data from loss, misuse, unauthorized access, disclosure, alteration or destruction.

Supporting quotations

We implement appropriate technical and organizational security measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.

Qualifications & exceptions

• The measures are described as designed to protect, not as guaranteeing protection.

Not stated here

• The policy does not name the measures, standards, certifications or breach-notification commitments.

Data Access & Collection · Company practice

Services are not directed at under-18s and reported child data is investigated and deleted

Anthropic states that the Services are not directed towards children and that it does not knowingly collect, use, disclose, sell or share information from children under 18. It says it has measures to detect and remove children from the Services, and asks anyone aware that a child under 18 has provided personal data to email privacy@anthropic.com so the matter can be investigated and, if appropriate, the data deleted.

Supporting quotations

Our Services are not directed towards, and we do not knowingly collect, use, disclose, sell, or share any information from children under the age of 18.

We have measures in place to detect and remove children from our Services.

If you become aware that a child under the age of 18 has provided any personal data to us while using our Services, please email us at privacy@anthropic.com and we will investigate the matter and, if appropriate, delete the personal data.

Qualifications & exceptions

• The age threshold stated is 18, not a lower threshold used in some jurisdictions.

Not stated here

• The 'measures' to detect and remove children are not described.
• The policy does not say how age is verified or what happens to an account closed for this reason.

Legal Rights & Agreement Rules · Company practice

Material changes are notified and previous versions are published in the Privacy Center

Anthropic may update the Privacy Policy from time to time, will notify users of material changes as appropriate, and updates the Effective Date at the top of the policy. A summary of changes and previous versions is available in the Privacy Center.

Supporting quotations

Anthropic may update this Privacy Policy from time to time. We will notify you of any material changes to this Privacy Policy, as appropriate, and update the Effective Date at the top of

You can view a summary of privacy policy changes and previous versions in our Privacy Center

Qualifications & exceptions

• Notice of material changes is given “as appropriate”; no fixed notice period or channel is stated.

Not stated here

• The Privacy Center page with change summaries and previous versions is separately linked and not supplied here, so earlier versions are not compared.
• The policy does not say how users are notified or how far in advance a change takes effect.

Legal Rights & Agreement Rules · Context

Anthropic Ireland controls European Region data and Anthropic PBC controls the rest

The data controller for users in the EEA, UK or Switzerland (the “European Region”) is Anthropic Ireland, Limited. For users outside the European Region the data controller is Anthropic PBC.

Supporting quotations

If you live in the European Economic Area (EEA), UK or Switzerland (the “European Region”), the data controller responsible for your personal data is Anthropic Ireland, Limited. If you live outside the European Region, the data controller responsible for your personal data is Anthropic PBC.

Qualifications & exceptions

• Controller allocation turns on where the user lives, not on where data is processed.

Not stated here

• The policy does not address users who move between regions or who use the Services while travelling.

Legal Rights & Agreement Rules · Procedure

Registered postal addresses for Anthropic PBC and Anthropic Ireland

Questions, complaints or requests can be sent to Anthropic PBC at 548 Market St, PMB 90375, San Francisco, CA 94104, United States, or to Anthropic Ireland, Limited at 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland.

Supporting quotations

Anthropic PBC with a registered address at 548 Market St, PMB 90375, San Francisco, CA 94104 (United States).

Anthropic Ireland, Limited with a registered address at 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29 (Ireland).

Qualifications & exceptions

• The addresses are registered addresses, not stated service-of-process or walk-in locations.

Legal Rights & Agreement Rules · Procedure

Privacy questions go to privacy@anthropic.com and the DPO to dpo@anthropic.com

Users can email Anthropic at privacy@anthropic.com for questions about the Policy, their personal data, complaints or requests, and can contact the Data Protection Officer at dpo@anthropic.com.

Supporting quotations

You can email us at privacy@anthropic.com and contact our Data Protection Officer at dpo@anthropic.com.

Not stated here

• The policy does not give a response time for emails to the DPO or say whether the DPO handles requests directly.

Legal Rights & Agreement Rules · User right or choice

Users may complain to a supervisory authority in their country, with named bodies for the UK, Brazil and Australia

Under many countries' laws users can lodge a complaint with the supervisory authority where they live or work. The policy lists EU supervisory authority contacts and names the UK Information Commissioner's Office, the Brazilian Data Protection Authority (ANPD) and the Office of the Australian Information Commissioner as complaint routes for residents of those countries.

Supporting quotations

Please note that under many countries' laws, you have the right to lodge a complaint with the supervisory authority in the place in which you live or work.

If you live or work in the UK, you have the right to lodge a complaint with the

Qualifications & exceptions

• The right is stated for many countries' laws, not for every jurisdiction.

Not stated here

• The EU list and the regulators' complaint pages are separate resources and their content is not supplied here, so each authority's process is not described.
• The policy does not say whether a complaint must first be raised with Anthropic.

Legal Rights & Agreement Rules · Company practice

Account products and services rest on the contract with the user

For products and services offered with respect to the user's Anthropic account, which the policy says are governed by its Terms of Service, the table lists identity and contact, payment, feedback, inputs and outputs, and technical data, with Contract as the only legal basis. No legitimate-interests explanation is given for this row.

Supporting quotations

To provide, maintain and facilitate any products and services offered to you with respect to your Anthropic account, which are governed by our Terms of Service

Contract

Qualifications & exceptions

• The row states a single legal basis (Contract) and no balancing explanation.

Not stated here

• The Terms of Service are a separate document and their text is not supplied here, so the contractual scope of these services is not stated.

Legal Rights & Agreement Rules · Company practice

Optional features rest on consent and legitimate interests

Optional services and features that enhance platform functionality and user experience rest on two bases: Consent, illustrated by precise device location and health app integrations, and Legitimate interests. Anthropic explains the balancing as its own and its users' interest in expanding features and delivering additional services.

Supporting quotations

To provide, maintain and facilitate optional services and features that enhance platform functionality and user experience

Consent (for example for precise device location or for health app integrations)

Legitimate interests

It is in our and our users' legitimate interests to expand our product features and deliver additional services that enhance platform functionality and user experience.

Qualifications & exceptions

• Two bases are listed together; the row does not say which data type or feature uses which basis.
• Consent is illustrated by two examples, not limited to them.

Not stated here

• The policy does not say how consent for these features is captured or withdrawn beyond the settings route described in Section 4.

Legal Rights & Agreement Rules · Company practice

Service updates, announcements and recommendations use three bases

For service updates, communications and tailored recommendations, the table lists three bases with examples: contract where necessary, illustrated by a technical announcement to the user's contact information; consent where Anthropic asks for it, illustrated by certain marketing communications; and Legitimate Interests, explained as promoting Services that may interest the user, including direct marketing.

Supporting quotations

To provide you with service updates, communications, and to provide tailored recommendations about our Services that may be of interest to you.

Where necessary to perform a contract with you, such as processing your contact information to send you a technical announcement about the Services.

Your consent when we ask for it to process your personal data for a specific purpose that we communicate to you, such as processing your contact information to send you certain forms of marketing communications.

Legitimate Interests

It is in our legitimate interests to promote our Services that may be of interest to you, including sending direct marketing.

Qualifications & exceptions

• The three bases are not allocated to specific data types or message types beyond their examples.
• Direct marketing is placed under legitimate interests here, while the consent cell also covers certain marketing communications.

Not stated here

• The policy does not say how a user distinguishes marketing sent on consent from marketing sent on legitimate interests.

Legal Rights & Agreement Rules · Company practice

Creating and administering an account rests on contract

Creating and administering the user's Anthropic account is assigned to Contract as the sole basis, over identity and contact, payment, feedback and verification data.

Supporting quotations

To create and administer your Anthropic account

Contract

Qualifications & exceptions

• Verification data appears for account administration although identity verification is also addressed under the fraud row.

Legal Rights & Agreement Rules · Company practice

Facilitating payments rests on contract

Facilitating payments for products and services is assigned to Contract as the sole basis, over identity and contact data and payment information.

Supporting quotations

To facilitate payments for products and services provided by Anthropic

Contract

Legal Rights & Agreement Rules · Company practice

Fraud prevention, abuse investigations and legal demands rest on four bases

Preventing and investigating fraud, abuse, Usage Policy violations, unlawful activity and unauthorized access, protecting rights and safety, and meeting legal, governmental and institutional policy obligations is assigned to four bases: Consent, illustrated by biometric identity verification; Legitimate interests; Legal obligation; and Vital Interests. The explanation frames the interest as protecting Anthropic's business, employees and users from illegal activity and notes a duty to cooperate with authorities.

Supporting quotations

To prevent and investigate fraud, abuse, and violations of our Usage Policy, unlawful or criminal activity, unauthorized access to or use of personal data or Anthropic systems and networks, to protect our rights and the rights of others, to protect your safety or that of any other person, and to meet legal, governmental and institutional policy obligations

Consent (for example where you choose to verify your identity using biometric data)

Legitimate interests

Legal obligation

Vital Interests

It is in our legitimate interests to protect our business, employees and users from illegal activities, inappropriate behavior or violations of terms that would be detrimental. We also have a duty to cooperate with authorities.

Qualifications & exceptions

• The widest purpose row in the table; its data list includes study participation and verified identity data.
• Vital interests appear once, in this row, without an explanation of the life-or-death circumstances meant.

Not stated here

• The policy does not identify which of the four bases applies to which investigative step, so several bases appear available for the same data.
• The Usage Policy and the legal, governmental and institutional policies are linked but their text is not supplied here, so the obligations behind this row cannot be described.

Legal Rights & Agreement Rules · Company practice

Investigating and resolving disputes rests on legitimate interests and legal obligation

Investigating and resolving disputes rests on Legitimate interests and Legal obligation. The explanation says Anthropic has a legitimate interest in understanding and resolving customer complaints to improve satisfaction and a legal obligation in some cases, without saying which cases.

Supporting quotations

To investigate and resolve disputes

Legitimate interests

Legal obligation

It is in our legitimate interests to fully understand and make reasonable efforts to resolve customer complaints in order to improve user satisfaction. We also have a legal obligation in some cases.

Qualifications & exceptions

• The interplay between the two bases is left open by the phrase 'in some cases'.

Not stated here

• The policy does not state which disputes trigger the legal-obligation basis.

Legal Rights & Agreement Rules · Company practice

Security investigations rest on legal obligation and legitimate interests

Investigating and resolving security issues rests on Legal obligation and Legitimate interests, over the broadest data list in the table after the fraud row. The explanation cites protecting user data and systems through monitoring and swift response, and a legal obligation to provide adequate security safeguards.

Supporting quotations

To investigate and resolve security issues

Legal obligation

Legitimate interests

It is in our legitimate interests to protect user data and our systems from intrusion or compromise through monitoring and swift response. We also have a legal obligation to provide adequate security safeguards.

Qualifications & exceptions

• Monitoring is named as part of the security interest, extending the row beyond incident response.

Legal Rights & Agreement Rules · Company practice

Debugging and error repair rest on legitimate interests

Debugging and identifying and repairing errors that impair existing functionality rests on Legitimate interests alone. The explanation cites maintaining continuous functioning and rapid correction of problems to ensure a positive user experience that encourages engagement.

Supporting quotations

To debug and to identify and repair errors that impair existing functionality

Legitimate interests

It is in our legitimate interests to maintain continuous functioning of our services and rapid correction of problems to ensure a positive user experience that encourages engagement.

Qualifications & exceptions

• The stated interest includes encouraging engagement, not only service stability.

Legal Rights & Agreement Rules · Company practice

Improvement and research other than model training rest on research and legitimate interests

Improving the Services and conducting research is expressly stated to exclude model training, and rests on Scientific Research and Legitimate interests. The explanation covers evaluating use of the Services and adoption of new features, and research into the safety, inner workings and societal impact of AI models, framed as benefiting the AI industry and society.

Supporting quotations

To improve the Services and conduct research (excluding model training)

Scientific Research

Legitimate interests

It is in our legitimate interests and in the interest of Anthropic users to evaluate the use of the Services and adoption of new features to inform the development of future features and improve direction and development of the Services. Our research also benefits the AI industry and society: it investigates the safety, inner workings, and societal impact of AI models so that artificial intelligence has a positive impact on society as it becomes increasingly advanced and capable.

Qualifications & exceptions

• The exclusion of model training separates this row from the training disclosures elsewhere in the policy.
• Scientific Research appears once in the table, in this row.

Not stated here

• The policy does not say what qualifies a study as scientific research or which review it receives.

Cross-references

• contrast (model-proposed): Improvement and research including model training rest on scientific research, consent and legitimate interests — contrast: The general table separates improvement without model training from improvement and research including model training. The two rows rest on different bases (scientific research and legitimate interests, against scientific research, consent and legitimate interests), so a reader who relies only on one row gets an incomplete picture of the basis for model training.

Legal Rights & Agreement Rules · Company practice

Improvement and research including model training rest on scientific research, consent and legitimate interests

Improving the Services and conducting research including model training is assigned to Scientific Research, Consent and Legitimate interests, over feedback, study participation data, inputs and outputs, and data provided through the Development Partner Program. The row points to the Non-User Privacy Policy for the data used to train models. Anthropic explains the interest as evaluating use and adoption of new features to guide development, and as research into the safety, inner workings and societal impact of AI models that benefits the industry and society.

Supporting quotations

To improve the Services and conduct research (including model training). See our Non-User Privacy Policy for more details on the data used to train our models, and the different stages of development.

Scientific Research

Consent

Legitimate interests

It is in our legitimate interests and in the interest of Anthropic users to evaluate the use of the Services and adoption of new features to inform the development of future features and improve direction and development of the Services. Our research also benefits the AI industry and society: it investigates the safety, inner workings, and societal impact of AI models so that artificial intelligence has a positive impact on society as it becomes increasingly advanced and capable.

For more information about how we collect and use personal data to develop our language models that power our Services, the steps we take to minimize the privacy impact on individuals through the training process, and your choices with respect to that information, please see our separate Non-User Privacy Policy.

Qualifications & exceptions

• This row includes model training, while the preceding row for improvement and research excludes it.
• Consent appears without an example in this row, unlike the optional-features and fraud rows.

Not stated here

• The Non-User Privacy Policy is linked but its text is not supplied here, so the data used for training and the development stages cannot be described.
• The policy does not say which training-related processing relies on consent rather than scientific research or legitimate interests.

Legal Rights & Agreement Rules · Company practice

Enforcing the Terms of Service and Usage Policy rests on contract and legitimate interests

Enforcing the Terms of Service and similar terms and agreements, including the Usage Policy, is assigned to Contract and Legitimate interests, over identity and contact, inputs and outputs, technical information, study participation data and verification data. Anthropic explains that outside performance of the contract it relies on a legitimate interest in enforcing the rules and policies governing use, maintaining intended functionality and value, and providing a safe, useful platform.

Supporting quotations

To enforce our Terms of Service and similar terms and agreements, including our Usage Policy.

Contract

Legitimate interests

In certain circumstances outside of the performance of our contract with you, we may rely on legitimate interests. It is in our legitimate interests to enforce the rules and policies governing use of our services, to maintain intended functionality and value for users. We aim to provide a safe, useful platform.

Qualifications & exceptions

• Two bases are listed for one enforcement purpose without allocating them to particular enforcement steps.

Not stated here

• The Terms of Service and Usage Policy are linked but their text is not supplied here, so the rules enforced are not described.

Legal Rights & Agreement Rules · Context

Canadian supplemental disclosures prevail over the rest of the policy for Canadian residents

The Canadian supplemental disclosures are additional information for residents of Canada, read with the rest of the Privacy Policy, and they prevail over the Privacy Policy in case of conflict as it applies to Canadian residents.

Supporting quotations

These supplemental disclosures contain additional information relevant to residents of Canada. This content should be read in conjunction with the rest of our Privacy Policy. In case of conflict between our Privacy Policy and these supplemental disclosures, the supplemental disclosures shall prevail in relation to residents of Canada.

Qualifications & exceptions

• The section is drafted as supplemental and overriding only for residents of Canada.

Cross-references

• qualifies (model-proposed): Rights depend on residence and law, are limited, and training-dataset requests are complex — qualifies: The general rights card states rights depend on residence and are limited. For Canadian residents, the supplemental disclosures prevail over the rest of the policy, which sets the controlling terms where the two texts differ.

Legal Rights & Agreement Rules · User right or choice

Canadian consent may be express or implied and can be withdrawn at any time

By expressly consenting to the Privacy Policy, Canadian users confirm they have read, understand and consent to collection, use, processing and disclosure of their personal data, and that Anthropic also relies on other lawful bases where available. Anthropic says it will collect, use and disclose personal data only with consent unless otherwise permitted or required by law, that consent may be express or implied depending on the circumstances and sensitivity of the information, and that consent can be withdrawn at any time subject to legal or contractual restrictions and reasonable notice.

Supporting quotations

Consent. By expressly consenting to this Privacy Policy, you confirm you have read, understand, and consent to the collection, use, processing, and disclosure of your personal data in accordance with this Privacy Policy and understand that, in jurisdictions where it is available, Anthropic also relies on other lawful bases for the foregoing as more fully set out in this policy. We will only collect, use and disclose your personal data with your consent, unless otherwise permitted or required by law. Your consent may be given expressly or implied, depending on the circumstances and the sensitivity of the information involved. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

Qualifications & exceptions

• The withdrawal right is qualified by legal or contractual restrictions and reasonable notice.
• Reliance on other lawful bases is stated for jurisdictions where available.

Not stated here

• The policy does not state how notice of withdrawal is given or what period counts as reasonable notice.

Legal Rights & Agreement Rules · Company practice

Canadian data may be transferred outside Canada, including to the United States and listed subprocessors

By providing personal data, Canadian users acknowledge and agree that it may be transferred or disclosed to other jurisdictions for processing and storage outside Canada, including the United States and the countries on the Subprocessor List, where data protection laws may be less stringent. Anthropic may also disclose the data in those jurisdictions in response to legal processes or where it believes in good faith that disclosure is required or permitted by law.

Supporting quotations

Cross-jurisdictional Transfers. By providing us with personal data, you acknowledge and agree that your personal data may be transferred or disclosed to other jurisdictions for processing and storage outside of Canada, including to the United States and the countries listed on our Subprocessor List, where laws regarding the protection of personal data may be less stringent than the laws in your jurisdiction. Furthermore, we may disclose your personal data in these jurisdictions in response to legal processes or where we believe in good faith that disclosure is required or permitted by law.

Qualifications & exceptions

• The acknowledgment-and-agreement framing is specific to this Canadian section.

Not stated here

• The Subprocessor List is linked but its text is not supplied here, so the recipients and countries cannot be described.
• The policy does not name the safeguards applied to these Canadian transfers.

Legal Rights & Agreement Rules · Procedure

Canadian privacy questions and rights requests go to privacy@anthropic.com

Residents of Canada with questions or comments about processing, or wishing to exercise their rights under Section 4, are directed to privacy@anthropic.com.

Supporting quotations

Contact. If you have any questions or comments about our processing of your personal data, or to exercise your rights as outlined in Section 4 (“Rights and Choices”), please contact us at privacy@anthropic.com.

Legal Rights & Agreement Rules · Context

Brazilian supplemental disclosures prevail over the rest of the policy for Brazilian residents

The Brazilian supplemental disclosures are additional information for residents of Brazil, read with the rest of the Privacy Policy, and they prevail over the Privacy Policy in case of conflict as it applies to Brazilian residents.

Supporting quotations

These supplemental disclosures contain additional information relevant to residents of Brazil. This content should be read in conjunction with the rest of our Privacy Policy. In case of conflict between our Privacy Policy and these supplemental disclosures, the supplemental disclosures shall prevail in relation to residents of Brazil.

Qualifications & exceptions

• The section is drafted as supplemental and overriding only for residents of Brazil.

Legal Rights & Agreement Rules · Company practice

Brazilian processing may rely on LGPD bases other than those in the general table

For Brazil, Anthropic may rely on different legal grounds than those listed under section 2, where permitted by and in accordance with the LGPD, giving the “exercise of legal rights” basis as an example for processing data associated with customer complaints and for enforcing the Terms of Service and similar terms, including the Usage Policy.

Supporting quotations

Legal Bases. Depending on the specific purpose of the processing, we may rely on different grounds than those listed under section 2, where permitted by and in accordance with the Brazilian General Data Protection Law (LGPD). For example, we may rely on the "exercise of legal rights" basis to process personal data associated with customer complaints and to enforce our Terms of Service and similar terms and agreements, including our Usage Policy.

Qualifications & exceptions

• The example is illustrative; the paragraph does not enumerate every LGPD basis Anthropic may use.

Not stated here

• The Terms of Service and Usage Policy are linked but their text is not supplied here, so the enforcement obligations are not described.
• The policy does not say which LGPD basis applies to purposes other than complaints and enforcement.

Cross-references

• qualifies (model-proposed): Section 10 holds the legal bases for the processing described in Section 2 — qualifies: The general statement that Section 10 holds the legal bases is qualified for Brazil by the supplemental disclosure that the controller may rely on different grounds depending on the purpose, so the table is not exhaustive for Brazilian users.

Legal Rights & Agreement Rules · User right or choice

LGPD rights list for Brazilian users, subject to limits

Brazilian users are told LGPD grants rights that differ from Section 4: confirmation of processing; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or erasure of unnecessary, excessive or non-compliant data; portability to a third party subject to trade secrets; information about public and private entities with which data was shared; information about the possibility of refusing consent and its consequences; withdrawal of consent free of charge; and review of decisions made solely on automated processing. Anthropic adds that these rights are not absolute and that it may keep processing or retaining data to comply with legal, contractual and regulatory obligations, safeguard and exercise rights, and in other cases provided by law.

Supporting quotations

Data Subject's Rights. LGPD grants certain rights regarding your personal data, which differ from the ones listed under section 4. We will respond to your requests to exercise your rights below in accordance with applicable law:

Confirmation of whether your data is being processed. You have the right to receive a confirmation on whether Anthropic processes your data.

Access to your data. You have the right to know what personal data Anthropic processes about you.

Correction of incomplete, inaccurate or outdated data. You have the right to request the correction of your data that is incomplete, inaccurate, or outdated.

Anonymization, blocking or erasure of data. You have the right to request the anonymization, blocking or erasure of data that is unnecessary, excessive or processed in non-compliance with the provisions of the law.

Portability of personal data to a third party. You have the right to request portability of your data to a third-party, as long as this does not infringe on our trade secrets.

Information of public and private entities with which we shared data. You have the right to request information of public and private entities with which we have shared your data.

Information about the possibility to refuse to provide consent and the respective consequences, when applicable.

Withdrawal of your consent. You have the right to withdraw your consent. This procedure will be carried out free of charge.

Request a review of decisions made solely based on automated processing of personal data.

Please keep in mind that these rights are not absolute and may not apply in certain circumstances. For example, in certain cases we may continue to process and retain data regardless of your request for deletion, objection, blocking or anonymisation, in order to comply with legal, contractual and regulatory obligations, safeguard and exercise rights, including in judicial, administrative and arbitration proceedings and in other cases provided for by law.

Qualifications & exceptions

• Portability is expressly subject to not infringing Anthropic's trade secrets.
• The closing paragraph qualifies every listed right.
• The list is described as differing from the rights listed under Section 4.

Not stated here

• The policy does not give a response period for Brazilian requests, unlike the periods stated in Section 4 for other laws.
• The policy does not say how a request is submitted for Brazil; the Section 4 contact route is the only one given.

Legal Rights & Agreement Rules · Company practice

Brazilian transfers rely on ANPD-approved standard contractual clauses where no adequacy decision applies

Anthropic states it is headquartered in the United States and that information may be transferred to, used, processed and stored in the United States and other countries whose laws may not be equivalent. For Brazil it says it will rely on standard contractual clauses where required and where transfers are not covered by an adequacy decision, that the clauses are approved by the Brazilian Data Protection Authority (ANPD) as the competent supervisory authority, and it links the ANPD resolution adopting them.

Supporting quotations

International Data Transfers. You acknowledge that Anthropic is a company based and headquartered in the United States. Any information we hold about you will be transferred to, used, processed, and stored in the United States and other countries and territories, which may not have data privacy or data protection laws equivalent to those in your country or territory. For the proper operation of the Services, Anthropic needs to carry out international transfers of personal data. In the case of Brazil, we will rely on standard contractual clauses (SCCs) for our data transfers where required and in instances where they are not covered by an adequacy decision. These SCCs have been approved by the Brazilian Data Protection Authority (ANPD), which is the "competent supervisory authority" for these transfers, as governed by Brazilian Data Protection Laws. You can view the SCCs adopted by the ANPD here.

Qualifications & exceptions

• The SCC commitment is stated for Brazil only, not for other regions.
• The paragraph treats the ANPD as the competent supervisory authority for these transfers.

Not stated here

• The linked ANPD resolution is not supplied here, so the clauses' content cannot be described.
• The policy does not name the other countries or territories involved beyond the United States.

Legal Rights & Agreement Rules · Context

The Korean PIPA addendum prevails over the policy for Korean users

The Korean section applies to the extent Anthropic is subject to PIPA, supplements the Privacy Policy, must be read with it, prevails over the Privacy Policy for users in the Republic of Korea in case of inconsistency, and may be amended or updated.

Supporting quotations

This section applies to the extent that Anthropic is subject to the Personal Information Protection Act (“PIPA”), and supplements the information in the Privacy Policy. This is an addendum to the Privacy Policy and should be read in conjunction with the Privacy Policy. In case of any inconsistency between the Privacy Policy and this Addendum, this Addendum prevails for users in the Republic of Korea. This Addendum may be amended or updated from time to time.

Qualifications & exceptions

• Precedence is stated only for Korean users; elsewhere the policy governs.

Data Access & Collection · Company practice

Korea adds identity-verification data with retention until account deletion

Beyond the Section 1 collection list, the Korean disclosures say Anthropic collects and uses, for identity verification and fraud and abuse monitoring, the user's name, birthdate, sex, native-foreigner-code and DI (duplication information), retained until account deletion.

Supporting quotations

In addition to “1. Collection of Personal Data”, we collect and use your information as follows:

Purpose: Identity verification, Fraud and abuse monitoring

Items of Data: Name, birthdate, sex, native-foreigner-code, and DI (duplication information)

Period of retention and use: Until account deletion

Qualifications & exceptions

• The statement is framed as additional to Section 1, not a replacement.
• Retention is tied to account deletion, without a stated post-deletion period.

Not stated here

• The policy does not explain what a native-foreigner-code or DI (duplication information) is or how it is obtained.
• The policy does not say whether this data is collected for all Korean users or only those who verify identity.

Sharing & Disclosure · Company practice

Korean processing is delegated to the Korea Credit Bureau and Kim & Chang

Anthropic delegates processing of personal data as described on its subprocessor page and to two named delegates in Korea: the Korea Credit Bureau, for fraud and abuse detection and identity verification, and Kim & Chang, for assisting with the domestic representative's duties.

Supporting quotations

Anthropic delegates the processing of personal data as described here and below, and the delegatees may process personal data according to the purpose of the delegation.

Korea Credit Bureau: Fraud and abuse detection and identity verification

Kim & Chang: Assisting with the domestic representative related duties

Qualifications & exceptions

• Delegatees may process personal data according to the purpose of the delegation, not for their own purposes as stated.

Not stated here

• The linked subprocessor page is not supplied here, so the full delegate list and its terms cannot be described.
• The policy does not state what safeguards or contract terms bind these two Korean delegatees.

Sharing & Disclosure · Company practice

Korean data is transferred to Persona in the United States for identity verification and fraud detection

Anthropic delegates processing to affiliates and third parties located overseas and, for Korea, transfers personal data to Persona (privacy@withpersona.com) in the United States. The transferred items are name, birthdate, sex, native-foreigner-code and DI; the recipient's purpose is fraud and abuse detection and identity verification; the retention period is three years; and the stated legal basis is PIPA Article 28-8(1)(iii) delegation.

Supporting quotations

Anthropic delegates the processing of personal data to affiliates and third parties, all of whom are located overseas. In addition, Anthropic transfers personal data overseas as follows:

Recipient’s Name (Contact Information): Persona (privacy@withpersona.com)

Country to which Personal Data to be Transferred: United States

Items of Personal Data to be Transferred: Name, birthdate, sex, native-foreigner-code, and DI (duplication information)

Recipient’s Purpose of Use: Fraud and abuse detection and identity verification

Period of Retention and Use by Recipient: 3 years

Legal Basis for Overseas Transfer: PIPA Article 28-8(1)(iii) delegation

Qualifications & exceptions

• Three years is the recipient's retention period, which the policy does not tie to account deletion.
• The named transfer is to one recipient; affiliates and other third parties are covered by links instead.

Not stated here

• The affiliate and subprocessor links are not supplied here, so the other overseas recipients cannot be identified.
• The policy does not explain how the three-year recipient retention interacts with the account-deletion period stated above.
• The text of PIPA Article 28-8(1)(iii) is not supplied here.

Legal Rights & Agreement Rules · User right or choice

Korean users may ask Anthropic not to transfer their data overseas, at the risk of losing the Services

Korean users are told personal data is transferred to the overseas recipients from time to time via a dedicated network, that they may request that their data not be transferred overseas by emailing privacy@anthropic.com or the Data Protection Officer at dpo@anthropic.com, and that Anthropic may then be unable to provide all or any of the Services.

Supporting quotations

Following collection, personal data is transferred to the overseas recipients listed below from time to time, as necessary, via a dedicated network. You may have the right to request that your personal data not be transferred overseas as described above. If so, you may request this by email us at privacy@anthropic.com and contact our Data Protection Officer at dpo@anthropic.com. However, in doing so, Anthropic may not be able to provide you with all or any of the services we make available through our website.

Qualifications & exceptions

• The consequence of refusal is stated as a possible loss of all or part of the Services, not as an alternative safeguard.

Not stated here

• The policy does not say how such a request is processed or whether existing transfers stop immediately.

Cross-references

• qualifies (model-proposed): Personal data is transferred to the US and other countries for the Policy's purposes — qualifies: Global transfers described in Section 5 are qualified for Korean users by the additional route to ask Anthropic to stop transferring personal data overseas after collection, at the risk of losing access to the Services.

Legal Rights & Agreement Rules · Company practice

Anthropic Korea, Limited is the Korean domestic representative, reachable through Kim & Chang's email domain

For data protection and related regulatory purposes under PIPA Article 31-2 and the Network Act Article 32-5, Anthropic's domestic representative in Korea is Anthropic Korea, Limited, represented by Patrick Azubike Ekeruo, at 41F, 152 Teheran-ro, Gangnam-gu, Seoul, telephone +82 2 734 0940, email anthropic_privacy@kimchang.com.

Supporting quotations

The domestic representative of Anthropic PBC for data protection and related regulatory purposes under Article 31-2 of the Personal Information Protection Act and Article 32-5 of the Act on Promotion of Information and Communications Network Utilization and Data Protection, Etc. in the Republic of Korea is as follows:

Entity Name and Representative: Anthropic Korea, Limited (Representative Patrick Azubike Ekeruo)

Registered Address: (Yeoksam-dong), 41F, 152 Teheran-ro, Gangnam-gu, Seoul, South Korea

Telephone: +82 2 734 0940

Email: anthropic_privacy@kimchang.com

Qualifications & exceptions

• The representative's email address is on the Kim & Chang domain, the firm also named as a processing delegate.