Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“When you use the Service, we may provide you or Your employer with information regarding your account and your use of the Services, including as appropriate your Account Information and Log Data.”
“In Canada, we will only collect, use and disclose information about you in accordance with Canadian law. We will only process Personal Data with consent and/or adequate notice if and when required.”
“You have the right to withdraw consent to the collection, use and disclosure of the Personal Data subject to limits in applicable law. Withdrawal of consent will not impact the validity of any consent you have given up to the date of withdrawal. If you withdraw your consent, we may not be able to continue to provide Services to you.”
“If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the UK Extension, or the Swiss-U.S. DPF Principles, the principles shall govern.”
“If you have a Customer Agreement with us, we will delete your data in accordance with your Customer Agreement.”
“We may share your information with a third party, including law enforcement authorities, where not compelled by law when we believe in good faith that such use and/or disclosure is reasonably necessary to detect, prevent or prosecute illegal activity or to prevent imminent death or imminent bodily harm.”
Harvey AI's Privacy Policy covers personal account and usage data collected about you, but it does not cover anything you actually submit to or receive from the platform—those inputs, outputs, and documents are outside the Policy's protections entirely. Your employer may receive information about your account activity and usage logs, and Harvey AI may share your information with law enforcement without being legally required to do so. You have the right to withdraw consent to Harvey AI's data collection and use, but doing so may result in Harvey AI being unable to continue providing Services to you.
Harvey AI's Privacy Policy establishes the scope, use, sharing, and retention of Personal Data collected in connection with its Services, while explicitly carving out inputs, outputs, and documents processed on the platform from the Policy's coverage entirely. Harvey AI acts as a Data Processor for Customer Data and Content, with Customers designated as Data Controllers, and retains Personal Data according to individual Customer Agreements rather than a uniform Policy-defined schedule. Harvey AI collects granular Service Usage Data including email addresses, account identifiers, interaction patterns, query volume, and query type, and may use and share Personal Data for interest-based advertising where law permits and opt-in consent is obtained where required. Harvey AI may voluntarily disclose user information to law enforcement or third parties based on its own good-faith belief of reasonable necessity, and may share account information and log data with a user's employer. Where the Policy conflicts with the EU-U.S., UK, or Swiss-U.S. Data Privacy Framework Principles, those Principles govern.
The most direct impact on an individual user is that the data generated during actual platform use—queries submitted and results received—falls entirely outside this Policy's protections, while behavioral and identity data such as email address, visit frequency, and query patterns are collected and covered. A user's employer may receive detailed account and log data about that user's individual activity. Where interest-based advertising applies, Harvey AI uses and shares Personal Data with third parties, subject to opt-in consent where law requires it. Users have a stated right to withdraw consent to the collection, use, and disclosure of their Personal Data; exercising that right may result in Harvey AI being unable to continue providing Services.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
“When you use the Service, we may provide you or Your employer with information regarding your account and your use of the Services, including as appropriate your Account Information and Log Data.”
“In Canada, we will only collect, use and disclose information about you in accordance with Canadian law. We will only process Personal Data with consent and/or adequate notice if and when required.”
“You have the right to withdraw consent to the collection, use and disclosure of the Personal Data subject to limits in applicable law. Withdrawal of consent will not impact the validity of any consent you have given up to the …”
“If you have a Customer Agreement with us, we will delete your data in accordance with your Customer Agreement.”
“If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the UK Extension, or the Swiss-U.S. DPF Principles, the principles shall govern.”
“We may share your information with a third party, including law enforcement authorities, where not compelled by law when we believe in good faith that such use and/or disclosure is reasonably necessary to detect, prevent or prosecute illegal activity or …”
“Harvey does not sell or share personal data with third parties in exchange for payment. However, to the extent permitted by applicable law we may provide Personal Data of individuals who visit our Websites...to third party partners, such as advertising …”
“This Privacy Policy does not apply to any input or output generated on our online platform, or documents uploaded to our platform. We process this data on behalf of Customers...”
“Harvey processes Customer Data and Content received through the Services as a Data Processor so any queries related to this data should be directed to our Customers who are the Data Controllers.”
“Where allowed by law (including, where required, with your opt-in consent), we use and share your Personal Data with others so that we may market our Services to you, including through interest-based advertising...”
“This includes your email address, account identifiers, data about how often you visit the Websites, how you interact with the Services, the amount of time spent engaging with the Services, the volume of queries you submit, the type of queries...”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Harvey AI has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Account and usage data shared with employer Customers and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.