Amplitude records a sample of user sessions on AI21's platform — capturing your mouse movements, clicks, and potentially keystrokes — to analyze how people use the service. This happens in about 1 in 5 sessions without specific notice at the time of recording.
When you interact with AI21's platform, there is a 20% chance your session — including every click, scroll, and potentially every character you type into AI prompt boxes — is being recorded and sent to Amplitude, a US-based analytics company.
Cross-platform context
See how other platforms handle Session Replay and Behavioral Analytics (Amplitude) and similar clauses.
Compare across platforms →Session replay tools can inadvertently capture sensitive information typed into AI prompt fields, including passwords, personal information, and confidential business content, creating significant privacy risks beyond standard analytics.
(1) REGULATORY FRAMEWORK: Session replay implicates GDPR Art. 5(1)(c) (data minimization), Art. 6 (lawful basis — likely legitimate interests, requiring balancing test), Art. 9 (if sensitive data is inadvertently captured), and Art. 35 (DPIA required for systematic monitoring). CCPA/CPRA §1798.140 'personal information' definition encompasses behavioral data captured by session replay. Illinois BIPA (740 ILCS 14) may be triggered if biometric identifiers are captured. UK GDPR and PECR apply for UK users. FTC Act Section 5 applies to undisclosed behavioral recording. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.