Do we need to disclose LangChain in our privacy policy?

Yes. LangChain processes user inputs, documents, and conversation data through chains and agents, making it a core data handling component requiring explicit disclosure. Users must understand that their prompts, uploaded documents, embeddings, and agent interactions are processed through this framework. Omitting this disclosure violates transparency requirements under GDPR Article 13/14 and CCPA Section 1798.100.

What specific data does LangChain collect and process?

LangChain processes user-submitted prompts and inputs, document content uploaded for retrieval-augmented generation (RAG), vector embeddings generated from user content, agent tool inputs and outputs, and conversation memory/chat history. All this data flows through LangChain's orchestration layer before reaching downstream services like LLMs or vector stores. None of this data is stored by LangChain itself if self-hosted.

Does LangChain require cookie consent or a cookie banner?

No. LangChain does not set cookies. However, downstream services it integrates with (LLMs like OpenAI, vector databases like Pinecone, or cloud infrastructure) may use cookies or tracking. You must audit each third-party integration separately and disclose their cookie policies in your own privacy notice.

Who is the data processor for LangChain, and where is data transferred?

If LangChain is self-hosted, your organization acts as the processor, and data remains on your infrastructure. However, LangChain typically orchestrates data to third-party providers: LLM APIs (OpenAI, Anthropic, Google), vector stores (Pinecone, Weaviate, Chroma), and tool integrations. You must execute Data Processing Agreements (DPAs) with each downstream provider and map data flows to ensure GDPR compliance and cross-border transfer safeguards.

AI & Machine Learning

Privacy policy clauses for LangChain

LangChain is an open-source framework that orchestrates data flow between large language models, vector databases, and external tools to build AI-powered applications. Websites use it to enable conversational AI, document retrieval, and automated agent workflows while managing complex data pipelines.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data LangChain collects

Your privacy policy must disclose each of the following data types when you use LangChain.

User inputs processed through chains

Document content for RAG pipelines

Embeddings of user content

Agent tool call inputs and outputs

Conversation memory and history

When does LangChain trigger privacy obligations?

Installation and Data Flow Start

Adding LangChain to your application triggers data protection obligations the moment user inputs enter the framework—LangChain does not operate without processing data. Specifically:

Data collection begins immediately: User prompts, documents uploaded for RAG pipelines, and conversation history flow through LangChain chains. Embeddings of this content are generated and stored (in vector stores you specify). Agent tool outputs and inputs are logged. None of this is dormant—it activates on first user interaction.

Privacy policy clauses for LangChain

What data LangChain collects

When does LangChain trigger privacy obligations?

Installation and Data Flow Start

Common compliance pitfalls

Pitfall 1: Treating Downstream Integrations as "Not Your Problem"

Pitfall 2: Embedding Sensitive Data Without Consent Categorization

Pitfall 3: Missing Conversation Memory Retention Policies

Legal note

Sample privacy policy clause

What regulators look for

Audit Focus: Third-Party Data Transfers and DPA Gaps

Frequently asked questions

Do we need to disclose LangChain in our privacy policy?

What specific data does LangChain collect and process?

Does LangChain require cookie consent or a cookie banner?

Who is the data processor for LangChain, and where is data transferred?

Don't ship without Bandit.