Privacy policy clauses for OpenAI
OpenAI is an artificial intelligence platform that powers language models (GPT) and image generation tools (DALL-E). Websites integrate OpenAI to enable AI-driven features such as chatbots, content generation, and image creation for their users.
Free scan · No signup · Results in 60 seconds
What data OpenAI collects
Your privacy policy must disclose each of the following data types when you use OpenAI.
When does OpenAI trigger privacy obligations?
Immediate Data Flow
The moment you integrate OpenAI's API into your product, user prompts and inputs are transmitted to OpenAI's servers in the United States. This is not optional: every API call sends data cross-border. If your users are in the EU, GDPR Article 44 (transfers of personal data) is triggered immediately.
Regulatory Thresholds
GDPR: Applies if any user is in the EU. User prompts may constitute personal data (especially if they contain names, identifiers, or contextual details). You must establish a lawful basis (Article 6) before sending data to OpenAI. Consent is common but not required if you have a contractual or legitimate interest basis.
