How a rating gets made

Every badge on PolicyPeek traces back to three separate steps, kept deliberately separate so no single step can quietly turn an opinion into a fact.

An AI model extracts the facts from the tool's own policy.We fetch the privacy policy the tool itself publishes and pull out a handful of factual claims — does it say it trains on your data, is there a stated retention period, does it mention GDPR. This step is not allowed to make a judgment call; it only reports what the text says.
Then fixed rules decide the badge.The facts above run through the same fixed rules for every tool:
- Doesn't train on your data — doesn't train on your data by default, or only trains on it if you opt in.
- Trains by default, you can opt out — trains on your data by default, but a real opt-out exists somewhere in the policy.
- Trains on your data, no opt-out — trains on your data by default, and we found no way to opt out.
- Policy unclear — the policy is genuinely unclear either way. This is not a middle grade — it means we don't know, not that the tool is "somewhat okay."
- Company-wide policy — the only policy we could find is published for a whole company (for example a Google or Microsoft policy), not for this one product. We don't rate the product from a policy that isn't about it.
- Not an AI tool — the site's policy shows no sign it's an AI product, so the question of training on your data doesn't apply. This isn't a training verdict at all.
A good verdict for a new tool always goes to a person first; some other results publish automatically.A green or teal badge for a tool we haven't listed before is always held until someone checks the extracted facts against the actual source. A clear unfavourable result, and a re-check that leaves an existing badge unchanged, can publish to the tools list right away. If a fact needed to decide the badge is missing, the source looks unreliable (e.g. an archived snapshot instead of the live page), it came from a different page than the tool's own site, or a recheck would flip an existing badge, it's held for someone to check before it goes live.

Why "you can opt out" isn't a green badge

An opt-out is a real, meaningful protection — but it's a weaker one than "doesn't train on your data by default." GDPR generally expects opt-in consent, not an opt-out you have to go find in a settings page or a support form. So when a tool trains on your data unless you take action, PolicyPeek shows a distinct teal "Trains by default, you can opt out" badge rather than the plain green "Doesn't train on your data" one — the same size and shape as every other badge, with a double border, deliberately not green, and paired with a one-line note on the tool's page explaining what the caveat actually is. It is also not a shade of amber: amber on this site always means "we don't know." The opt-out badge means the opposite — we know exactly what the policy says, and it's a middle case, not an unknown one.

Why unrated isn't a guess

If a policy doesn't clearly say one way or the other, PolicyPeek marks it unrated rather than rounding it up or down. An amber badge means "read the source yourself before you decide," not "probably fine" — and it is a different kind of uncertainty than the opt-out badge above: "policy unclear" means we couldn't tell from the policy, while the opt-out badge means the policy told us exactly what happens and it's a conditional pass.

Sources

Every tool page links the exact policy page(s) the rating was built from. If a source is stale or wrong, that's a bug in our data, not the tool's fault — the fix is to re-check the source, not to guess.

The short version, including how often tools are rechecked, is on themethodology page.

For worked examples, such as which meeting note-takers or coding assistants train on your data, see the guides.