Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The privacy policy explicitly excludes documents uploaded to the platform, AI inputs, and AI outputs from its scope. Those categories are governed by the Customer Agreement between Harvey and the employing organization, and data subject requests for that content must be directed to the employer, not Harvey.
This analysis describes what Harvey AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a structural bifurcation of data controller and data processor responsibilities that directly determines the path for data subject rights requests. End users whose employers are Harvey Customers may find that their rights regarding platform-submitted content must be exercised through their employer rather than through Harvey's publicly disclosed privacy mechanisms.
Under this clause, individuals using Harvey through an employer or organization do not have a direct privacy rights relationship with Harvey for the content they submit to and receive from the platform. The agreement directs queries about input, output, and uploaded document data to the employer or organization that holds the Customer Agreement with Harvey.
Cross-platform context
See how other platforms handle Customer Data Exclusion from Policy Scope and similar clauses.
Compare across platforms →Monitoring
Harvey AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"This Privacy Policy does not apply to any input or output generated on our online platform, or documents uploaded to our platform. We process this data on behalf of Customers and we call it ("Customer Data" and "Content"). Harvey's use of Customer Data and Content received through the Services is governed by the relevant Customer Agreement. Harvey processes Customer Data and Content received through the Services as a Data Processor so any queries related to this data should be directed to our Customers who are the Data Controllers.Excerpt from Harvey AI's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 28 (processor obligations), UK GDPR equivalent provisions, and CCPA service provider designations. The FTC has jurisdiction over unfair or deceptive practices related to data handling disclosures. The allocation of controller and processor roles must be accurately documented in a Data Processing Addendum to satisfy GDPR Article 28 requirements, and the Customer (employer) must be capable of responding to data subject requests for platform Content. (2) GOVERNANCE EXPOSURE: High. The provision shifts data subject request obligations for platform content entirely to the Customer organization. If Customer organizations are not operationally equipped to respond to access, deletion, or portability requests for Harvey platform data, the practical exercise of data subject rights may be impeded, which creates compliance exposure for both the Customer organization and potentially for Harvey depending on DPA enforcement posture. (3) JURISDICTION FLAGS: EU and UK data subjects have enforceable rights under GDPR and UK GDPR to access and delete data processed on their behalf. If the Customer organization fails to respond to requests, data subjects may escalate to the relevant supervisory authority. California residents may have CCPA rights implications depending on how the service provider designation is structured in the Customer Agreement. Quebec residents retain portability rights under Law 25. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should confirm that the Harvey Data Processing Addendum accurately defines the scope of Customer Data, establishes response timelines for data subject requests, and specifies deletion or return of data upon contract termination. The provision shifts liability for data subject request handling to the Customer, which may not align with standard enterprise data governance expectations without explicit contractual allocation. (5) COMPLIANCE CONSIDERATIONS: Legal teams should audit whether their organization's internal privacy program includes a documented process for receiving and responding to data subject requests for Harvey platform content. Data mapping exercises should distinguish between Account Information governed by this policy and Customer Data governed by the Customer Agreement. Organizations subject to GDPR should ensure the DPA with Harvey is executed and covers all relevant processing activities.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a structural bifurcation of data controller and data processor responsibilities that directly determines the path for data subject rights requests. End users whose employers are Harvey Customers may find that their rights regarding platform-submitted content must be exercised through their employer rather than through Harvey's publicly disclosed privacy mechanisms.
Under this clause, individuals using Harvey through an employer or organization do not have a direct privacy rights relationship with Harvey for the content they submit to and receive from the platform. The agreement directs queries about input, output, and uploaded document data to the employer or organization that holds the Customer Agreement with Harvey.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Harvey AI.