Privacy policy discloses AI data processing

GDPR Articles 13 and 14 require data controllers to inform users about third-party processors and the purposes for which their data is shared — at the time of collection. CCPA §1798.100 similarly mandates disclosure of data sharing practices. A privacy policy that makes no mention of AI providers, large language models, or the categories of data sent to them is a material omission that creates regulatory exposure and undermines user trust. When a breach or complaint triggers regulatory review, an undisclosed sub-processor is one of the clearest indicators of non-compliance.

Add a dedicated AI data processing section to your privacy policy. Name the provider, describe what data categories are sent, the purpose, and the retention period.

## AI Features

Our application uses AI services to power [feature name]. When you use
these features, your input is sent to [Provider Name] for processing.
[Provider Name] processes this data under a Data Processing Agreement
with us and their own privacy policy: [link]. We do not use your data
to train AI models [or: model training opt-out is available in Settings].
AI conversation history is retained for [X days / the session duration].

If you use multiple providers (e.g., OpenAI for chat, Anthropic for summarization), list each one separately. Link to their privacy policies. Revisit this section whenever you add or switch AI providers.