Privacy policy clauses for Hugging Face
Hugging Face is a machine learning platform that hosts AI models and provides inference APIs for running these models. Websites use Hugging Face to power AI features like text generation, image analysis, or chatbots without building infrastructure from scratch.
Free scan · No signup · Results in 60 seconds
What data Hugging Face collects
Your privacy policy must disclose each of the following data types when you use Hugging Face.
When does Hugging Face trigger privacy obligations?
Installation triggers data-processing obligations immediately
The moment you integrate Hugging Face—whether via Inference API, model downloads, or hosted endpoints—you begin transmitting user input data to Hugging Face Inc.'s servers in the United States. This triggers:
GDPR (if users are in EU/EEA): You become a data controller under GDPR Article 4(7). Input prompts and generated outputs qualify as personal data if they identify or relate to individuals. Article 13 and Article 14 require you to provide privacy notices *before* collection. Article 6 requires lawful basis (typically consent or legitimate interest, though consent is safer for inference queries). Article 28 requires a Data Processing Agreement (DPA) with Hugging Face.
CCPA (if users are California residents): Hugging Face qualifies as a "service provider" under CCPA Section 1798.140(ag). You must disclose data sharing in your privacy policy and cannot opt out of service-provider relationships on behalf of users.
