Privacy notice

This page explains what personal data PolicyPeek handles, why, who else handles it, how long it's kept, and what you can do about it.

Last updated: 10 November 2026

Who we are

PolicyPeek is a free, independent checker of whether AI and software tools use customer data to train AI models, based on each tool's own published policies. It is run by Elliot Inkley in the United Kingdom, who is the controller of the personal data described here.

Contact for anything on this page, including requests and objections:hello@getpolicypeek.com.

Using the website and browser extension

• There are no accounts and no advertising, and the site sets no cookies.
• The site uses Cloudflare Web Analytics to count page views. It doesn't use cookies and doesn't build a profile of you.
• The extension only reads the address of the tab you're on when you click its icon. To look up a badge it sends that site's domain name (for exampleexample.com) to api.getpolicypeek.com. If you press "Check this site", it also sends that page's address without its query string. Recent results are stored on your device only.
• When you ask us to check a new tool (on the site or in the extension), we record your IP address (for IPv6, its network part) and the date, so we can allow one free check per day. These records are deleted automatically early the next day (UTC); we never keep them longer than about a day. The check itself (the tool's domain, its policy address and what we found) isn't linked to you.
• Our own application logs don't record IP addresses. Cloudflare, which hosts and protects the site, processes IP addresses to deliver it and block abuse, and may keep them briefly in its security logs.

Emails to companies' privacy teams (planned)

When we start these emails: when a tool's published policy doesn't say clearly whether customer data trains AI models, we'll email the privacy, data protection, compliance, legal or press contact that the company publishes in that policy to ask. We'll only use a role address (such as privacy@example.com), never a named person's own address. We'll send one email and, if there is no reply, at most one follow-up 14 days later. Then we stop.

What we'll hold:

• the contact address the company published, the page we found it on, the company and tool name, and the policy we reviewed;
• a record of each email we sent: the date, whether it was the first email or the follow-up, and the message reference our email provider gives it;
• any reply: it's forwarded to Elliot's mailbox, where the message is kept, including the sender's address and the name, job title and signature of the person who replied (if included). Our own system doesn't store the message text or attachments. It keeps only the tool, the date, the message reference, the sender's company domain and the email authentication results (SPF, DKIM and DMARC);
• if you ask us not to email again, or an email bounces: the address and domain, the reason and the date (see "How to object" below).

Where it comes from: the contact address comes from the company's own published privacy policy or notice. Anything else comes from the emails themselves.

Why, and our lawful basis: we rely on legitimate interests (UK GDPR Article 6(1)(f)). Our interest is publishing an accurate, sourced description of whether a company uses customer data to train AI models, instead of guessing. We'll write only to a role address the company published for privacy, data protection, compliance, legal or press questions, send at most two emails, and stop as soon as you ask. These emails are enquiries, not marketing.

Who reads replies: Only Elliot reads replies. No AI service reads reply content. Nothing from a reply is published automatically, and we only quote a company's words with its permission. No verdict changes without Elliot's review.

What we publish: we don't publish the name or email address of the person who replied.

Snapshots of published policy pages (planned)

When we start checking for policy changes: to notice when a listed tool changes its policy, we'll regularly fetch the public policy pages linked on each tool's PolicyPeek page. Our fetcher will identify itself asPolicyPeek-PolicyWatch/1.0, respect each site's robots.txt, and fetch one page at a time per site. We'll store the page text, a fingerprint of it, and a record of what changed. These are companies' published documents. If one names a person (for example a data protection officer), that name will be in our copy too. We plan to keep the latest 10 versions of each page, and change records for up to 24 months. A change will be reviewed by a person; it will never change a rating by itself.

Who else handles this data

• Cloudflare (hosting, email sending and routing; US). It hosts the site, the API, our databases and file storage. Its email service may keep a preview of a sent message for about seven days for delivery checks.
• Proton (Elliot's mailbox; Switzerland). Mail to hello@getpolicypeek.com, and replies to the emails above once they start, is forwarded there.

When a tool is checked through the site or extension, the text of its public policy page is sent to Anthropic so that facts can be extracted from it. That is a company's published text, not your personal data, and it never includes your IP address or any email reply. The policy-change checks above don't use an AI service.

We don't sell personal data, and we don't share it with advertisers or data brokers.

Cloudflare is a US company; transfers rely on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum. Proton is in Switzerland (UK adequacy).

How long we keep it

• IP addresses for the free daily check: deleted automatically early the next day (UTC).
• Emails we send and replies we receive (once these emails start): we'll delete them 12 months after the tool's listing is no longer on hold, or 24 months after our first email, whichever comes first.
• "Don't email us" and bounce records: kept for as long as we send these emails, so that we never email that address or company again. They hold only the address and domain, the reason and the date.
• Policy page snapshots (once these checks start): the latest 10 versions of each page; change records up to 24 months.

Your rights

You have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict how we use it, and to object to how we use it. To make a request, emailhello@getpolicypeek.com. We'll reply within one month. Because the site and extension don't use accounts or identifiers, we may not be able to find records about you there, and IP records are gone within about a day anyway.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator:ico.org.uk/make-a-complaint, or 0303 123 1113.

How to object or stop our emails

Reply "stop" to any email from us, or write tohello@getpolicypeek.com. We'll add your address and your company's domain to a do-not-contact list, cancel any follow-up, and never email that address or company again. If we're unsure whether a reply is an objection, we treat it as one.

Changes

If this notice changes in a way that matters, we'll update the date at the top and say what changed.