AI Privacy Policy Review & Analysis

A Privacy Policy explains how an organization collects, uses, stores, and protects personal data. It is required by law in most jurisdictions for websites and apps that collect user information.

Analyze Your Privacy Policy Free

No account, no card — scores in about half a minute.

PDF, Word, plain text or a photo of a printed page — scanned documents are read with OCR. What happens to your document .

Review your Privacy Policy now

Upload it and read the whole analysis — every score and every explanation, against the clauses that matter in your Privacy Policy. Free, no account needed.

Drop your Privacy Policy here

or click to select

Supported formats: .pdf, .docx, .txt — up to 2 MB

Analysis Results

Upload a document to see the analysis

Why Review Your Privacy Policy with AI?

Privacy policies affect how your personal data is used. Whether you're a business ensuring compliance or a user checking your rights, understanding these policies is essential in the digital age.

How AI Analysis Helps

Review data collection practices and scope
Analyze third-party data sharing provisions
Check user rights (access, deletion, portability)
Verify GDPR, CCPA, and other regulatory compliance
Identify data retention periods and policies
Detect vague or overly broad data usage terms

Common Risks to Watch For

Overly broad data collection beyond stated purposes
Unnamed third-party data sharing without consent
Missing user rights for data access and deletion
No clear data retention limits
Inadequate security measures for data protection
Non-compliance with GDPR, CCPA, or other regulations

What We Check in a Privacy Policy

Naming a clause is the easy half. This is what the review looks for inside each one:

Data Collection Scope What categories are collected, and whether anything is gathered that the stated purpose does not need.

Purpose of Processing Whether each purpose is specific, and whether a lawful basis is named for it.

Third-Party Sharing Whether recipients are named or merely described as 'partners', and whether data leaves the region.

User Rights (DSAR) Access, correction, deletion, portability and objection — and the route and deadline for exercising each.

Data Retention Whether periods are stated per category, or replaced by 'as long as necessary'.

Security Measures Whether specific controls and a breach-notification deadline are named rather than adjectives.

Cookie Policy Whether non-essential cookies wait for consent, and whether refusing is as easy as accepting.

Updates & Modifications Whether users are notified of material changes, or expected to notice them.

A Data Retention Clause, Taken Apart

This is the shape of the reasoning a review applies to every clause in your privacy policy.

The clause as it usually arrives

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy.

What is wrong with it

Circular and unmeasurable: the policy defines the period by reference to itself, with no category-level periods and no deletion trigger.

Why it matters

Nobody — user, regulator or the company's own engineers — can say when a record should be gone. Under GDPR-style storage-limitation rules this is a compliance gap, and in a breach it decides how much data was there to lose.

Wording that fixes it

We retain account data for the life of the account and for twenty-four (24) months thereafter; support correspondence for thirty-six (36) months; and server logs for ninety (90) days. Where a longer period is required by law, we retain only the data that obligation covers, for the period it specifies.

General information about a common drafting problem, not legal advice about your document.

What You Get Back

Six scores out of ten, each with a sentence explaining it, plus a count of the concrete weaknesses a rewrite would fix. All six are free to read — no account.

Clarity and Completeness / 10

whether the document says what it means, and whether anything essential is simply absent

Risk Protection / 10

how much of the foreseeable risk in this kind of agreement it actually addresses

Legal Enforceability / 10

whether the terms are drafted so they could be relied on

Balance of Terms / 10

whether obligations and remedies fall on both sides or only one

Structural Integrity / 10

definitions, cross-references and the order things appear in

Overall Risk Exposure / 10

what signing it as written would leave you carrying

How to read the six scores · What an account adds

Privacy Policy Review — Questions

What makes a privacy policy non-compliant? +

Most often three things: purposes described so broadly that they authorise anything, recipients described as 'partners' rather than named categories, and retention stated as 'as long as necessary'. Each is a specificity failure rather than a missing section.

Does this check GDPR and CCPA compliance? +

It reads the document against what those regimes expect a policy to state — purposes, lawful basis, recipients, retention, rights and transfers — and reports what is missing or vague. It is a document review, not a legal certification, and it cannot see what your systems actually do.

I am a user, not a business. Is this useful to me? +

Yes. Upload the policy of a service you use and the review will tell you what it permits: who your data is shared with, how long it is kept, and what rights you are given to get it back or have it deleted.

How do I analyse a privacy policy that only exists as a web page? +

Save it as a PDF first — there is a free URL-to-PDF tool on this site — then upload the PDF. The review treats it like any other document.

Check Your Privacy Policy for These Risks

Upload it and read all six scores, with the reasoning behind each one. Free, no account, about half a minute.