If you use Claude through your employer or through a third-party app that runs on Claude's technology, this privacy policy does not protect you — your employer or that app's company is responsible for your data privacy, not Anthropic.
If you access Claude via an employer account, a third-party app, or any API-powered product, Anthropic's privacy rights and protections described in this policy — including deletion rights, opt-out of training, and data access — do not apply to your data; you must look to your employer or the third-party operator for those protections.
Cross-platform context
See how other platforms handle Controller/Processor Scope Exclusion and similar clauses.
Compare across platforms →Many users accessing Claude through third-party integrations or employer deployments may wrongly assume Anthropic's privacy protections apply to them, when in fact their data practices are governed by their employer or the third-party operator, who may have significantly weaker protections.
1. REGULATORY FRAMEWORK: The controller/processor distinction is defined under GDPR Art. 4(7)-(8) and operationalized through Art. 28 (data processing agreements). CCPA §1798.140(ag) similarly distinguishes service providers from businesses. This exclusion means that commercial customers deploying Claude have independent data controller obligations under GDPR Art. 13/14 (transparency), Art. 28 (processor contracts), and Art. 32 (security). Failure to execute a compliant DPA with Anthropic before deploying Claude constitutes a standalone GDPR Art. 28 violation. 2.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.