Copy.ai Privacy Policy

This is Copy.ai's privacy policy, explaining how the company that makes an AI-powered writing and sales automation platform collects and uses your personal data, including the content you create, your account information, and behavioral tracking data gathered through cookies and third-party tools like Google and Microsoft. The most important thing to know is that Copy.ai may use the content you input into its platform to train and improve its AI models unless you actively opt out — meaning your business writing, sales copy, and proprietary workflows could inform future AI behavior. You can opt out of having your content used for AI training by contacting Copy.ai at privacy@copy.ai.

Copy.ai's Privacy Notice governs the collection, use, and disclosure of personal data by Copy.ai (a Delaware corporation) in connection with its GTM AI platform, relying on contractual necessity, legitimate interests, and consent as legal bases depending on jurisdiction. The document creates obligations for Copy.ai to respond to data subject requests within 45 days (extendable to 90), honor opt-outs from data sales/sharing, and refrain from using sensitive personal information beyond disclosed purposes, while users are obligated to provide accurate data and comply with lawful use requirements. A notable provision permits Copy.ai to use customer content to train and improve its AI models unless users opt out, and the policy discloses sharing of personal data with a broad ecosystem of third-party service providers, advertising partners, and analytics vendors — including Google Tag Manager, Microsoft Clarity, and ProfitWell — without granular disclosure of specific data fields transmitted. The policy explicitly engages GDPR (EEA/UK users), CCPA/CPRA (California residents), and references Virginia, Colorado, Connecticut, and other U.S. state privacy laws, creating a multi-jurisdictional compliance obligation. Material compliance considerations include the adequacy of consent mechanisms for AI training data use, the sufficiency of legitimate interest balancing tests for EEA processing, and the completeness of data mapping given the number of undisclosed third-party integrations embedded in the site's technical infrastructure.